cf 0.1.0 → 0.2.0

package/dist/zero-trust-CKp8j512.mjs

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+import{C as e,T as t,b as n,h as r,t as i,w as a,x as o}from"./auth-CQcAgnOy.mjs";import{n as s,t as c}from"./body-parser-Br-BoYk-.mjs";import{t as l}from"./output-D7_yAFVR.mjs";import{n as u,t as d}from"./progress-CjcQ6ato.mjs";import{n as f,t as p}from"./input-validation-zEO81MWN.mjs";import{t as m}from"./local-VJaJ3BZ1.mjs";import{n as h,t as g}from"./raw-fetch-hRv-6P3D.mjs";function _(e){return e.option(`allow-code-mode`,{type:`boolean`,description:`Allow remote code execution in Dynamic Workers (beta)`,default:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`hostname`,{type:`string`,description:`The hostname field`}).option(`id`,{type:`string`,description:`portal id`}).option(`name`,{type:`string`,description:`The name field`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound MCP traffic through Zero Trust Secure Web Gateway`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ee={command:`create`,describe:`Creates a new MCP portal for managing AI tool access through Cloudflare Access.`,builder:_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access ai-controls mcp portals create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/ai-controls/mcp/portals`,pathParams:{},bodyKind:`json`,body:{"allow-code-mode":e[`allow-code-mode`],description:e.description,hostname:e.hostname,id:e.id,name:e.name,"secure-web-gateway":e[`secure-web-gateway`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/access/ai-controls/mcp/portals`,{body:t})),{successLabel:`Created`});return}e.hostname===void 0&&(e.hostname=await t(`hostname`,`The hostname field`)),e.id===void 0&&(e.id=await t(`id`,`portal id`)),e.name===void 0&&(e.name=await t(`name`,`The name field`));let p={};e[`allow-code-mode`]!==void 0&&s(p,[`allow_code_mode`],e[`allow-code-mode`]),e.description!==void 0&&s(p,[`description`],f(e.description,`description`,`text`)),e.hostname!==void 0&&s(p,[`hostname`],f(e.hostname,`hostname`,`text`)),e.id!==void 0&&s(p,[`id`],f(e.id,`id`,`text`)),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),e[`secure-web-gateway`]!==void 0&&s(p,[`secure_web_gateway`],e[`secure-web-gateway`]),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/access/ai-controls/mcp/portals`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function te(e){return e.positional(`id`,{type:`string`,description:`portal id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const v={command:`delete <id>`,describe:`Deletes an MCP portal from the account.`,builder:te,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access ai-controls mcp portals delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/ai-controls/mcp/portals/${t.id==null?`<id>`:encodeURIComponent(String(t.id))}`,pathParams:{id:String(t.id??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.access.aiControls.mcp.portals.delete(a,t.id)),{successLabel:`Deleted`})}};function y(e){return e.option(`page`,{type:`number`,description:`Page`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`search`,{type:`string`,description:`Search by id, name, hostname`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const b={command:`list`,describe:`Lists all MCP portals configured for the account.`,builder:y,handler:async e=>{let t={page:e.page,per_page:e[`per-page`],search:e.search};if(e.dryRun){u({command:`cf zero-trust access ai-controls mcp portals list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/ai-controls/mcp/portals`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.access.aiControls.mcp.portals.list(a,t)),{successLabel:`Loaded`})}};function x(e){return e.positional(`id`,{type:`string`,description:`portal id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const S={command:`read <id>`,describe:`Retrieves gateway configuration for MCP portals.`,builder:x,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access ai-controls mcp portals read`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/ai-controls/mcp/portals/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.aiControls.mcp.portals.read(e.id,n)),{successLabel:`Loaded`})}};function C(e){return e.positional(`id`,{type:`string`,description:`portal id`,demandOption:!0}).option(`allow-code-mode`,{type:`boolean`,description:`Allow remote code execution in Dynamic Workers (beta)`}).option(`description`,{type:`string`,description:`The description field`}).option(`hostname`,{type:`string`,description:`The hostname field`}).option(`name`,{type:`string`,description:`The name field`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound MCP traffic through Zero Trust Secure Web Gateway`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const w={command:`update <id>`,describe:`Updates an MCP portal configuration.`,builder:C,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access ai-controls mcp portals update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/ai-controls/mcp/portals/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`json`,body:{"allow-code-mode":e[`allow-code-mode`],description:e.description,hostname:e.hostname,name:e.name,"secure-web-gateway":e[`secure-web-gateway`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/ai-controls/mcp/portals/${encodeURIComponent(String(e.id))}`,{body:r})),{successLabel:`Updated`});return}let a={};e[`allow-code-mode`]!==void 0&&s(a,[`allow_code_mode`],e[`allow-code-mode`]),e.description!==void 0&&s(a,[`description`],f(e.description,`description`,`text`)),e.hostname!==void 0&&s(a,[`hostname`],f(e.hostname,`hostname`,`text`)),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),e[`secure-web-gateway`]!==void 0&&s(a,[`secure_web_gateway`],e[`secure-web-gateway`]),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/ai-controls/mcp/portals/${encodeURIComponent(String(e.id))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},T={command:`portals`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(ee).command(v).command(b).command(S).command(w).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function E(e){return e.option(`auth-credentials`,{type:`string`,description:`The auth_credentials field`}).option(`auth-type`,{type:`string`,description:`The auth_type field`,choices:[`oauth`,`bearer`,`unauthenticated`]}).option(`description`,{type:`string`,description:`The description field`}).option(`hostname`,{type:`string`,description:`The hostname field`}).option(`id`,{type:`string`,description:`server id`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const D={command:`create`,describe:`Creates a new MCP portal for managing AI tool access through Cloudflare Access.`,builder:E,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access ai-controls mcp servers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/ai-controls/mcp/servers`,pathParams:{},bodyKind:`json`,body:{"auth-credentials":e[`auth-credentials`],"auth-type":e[`auth-type`],description:e.description,hostname:e.hostname,id:e.id,name:e.name,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${p}/access/ai-controls/mcp/servers`,{body:t})),{successLabel:`Created`});return}e[`auth-type`]===void 0&&(e[`auth-type`]=await a(`auth-type`,`The auth_type field`,[`oauth`,`bearer`,`unauthenticated`])),e.hostname===void 0&&(e.hostname=await t(`hostname`,`The hostname field`)),e.id===void 0&&(e.id=await t(`id`,`server id`)),e.name===void 0&&(e.name=await t(`name`,`The name field`));let h={};e[`auth-credentials`]!==void 0&&s(h,[`auth_credentials`],f(e[`auth-credentials`],`auth-credentials`,`text`)),e[`auth-type`]!==void 0&&s(h,[`auth_type`],f(e[`auth-type`],`auth-type`,`text`)),e.description!==void 0&&s(h,[`description`],f(e.description,`description`,`text`)),e.hostname!==void 0&&s(h,[`hostname`],f(e.hostname,`hostname`,`text`)),e.id!==void 0&&s(h,[`id`],f(e.id,`id`,`text`)),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${p}/access/ai-controls/mcp/servers`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created`})}};function O(e){return e.positional(`id`,{type:`string`,description:`server id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const k={command:`delete <id>`,describe:`Deletes an MCP portal from the account.`,builder:O,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access ai-controls mcp servers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/ai-controls/mcp/servers/${t.id==null?`<id>`:encodeURIComponent(String(t.id))}`,pathParams:{id:String(t.id??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.access.aiControls.mcp.servers.delete(a,t.id)),{successLabel:`Deleted`})}};function A(e){return e.option(`page`,{type:`number`,description:`Page`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`search`,{type:`string`,description:`Search by id, name`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const j={command:`list`,describe:`Lists all MCP portals configured for the account.`,builder:A,handler:async e=>{let t={page:e.page,per_page:e[`per-page`],search:e.search};if(e.dryRun){u({command:`cf zero-trust access ai-controls mcp servers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/ai-controls/mcp/servers`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.access.aiControls.mcp.servers.list(a,t)),{successLabel:`Loaded`})}};function M(e){return e.positional(`id`,{type:`string`,description:`server id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const N={command:`read <id>`,describe:`Retrieves gateway configuration for MCP portals.`,builder:M,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access ai-controls mcp servers read`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/ai-controls/mcp/servers/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.aiControls.mcp.servers.read(n,e.id)),{successLabel:`Loaded`})}};function P(e){return e.positional(`id`,{type:`string`,description:`portal id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const F={command:`sync <id>`,describe:`Syncs an MCP server's tool catalog with the portal.`,builder:P,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access ai-controls mcp servers sync`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/ai-controls/mcp/servers/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}/sync`,pathParams:{id:String(e.id??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Creating`,async()=>t.zeroTrust.access.aiControls.mcp.servers.sync(e.id,n)),{successLabel:`Created`})}};function I(e){return e.positional(`id`,{type:`string`,description:`server id`,demandOption:!0}).option(`auth-credentials`,{type:`string`,description:`The auth_credentials field`}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const L={command:`update <id>`,describe:`Updates an MCP portal configuration.`,builder:I,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access ai-controls mcp servers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/ai-controls/mcp/servers/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`json`,body:{"auth-credentials":e[`auth-credentials`],description:e.description,name:e.name,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/ai-controls/mcp/servers/${encodeURIComponent(String(e.id))}`,{body:r})),{successLabel:`Updated`});return}let a={};e[`auth-credentials`]!==void 0&&s(a,[`auth_credentials`],f(e[`auth-credentials`],`auth-credentials`,`text`)),e.description!==void 0&&s(a,[`description`],f(e.description,`description`,`text`)),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/ai-controls/mcp/servers/${encodeURIComponent(String(e.id))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},R={command:`servers`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(D).command(k).command(j).command(N).command(F).command(L).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},z={command:`mcp`,describe:`Operations for access.ai-controls.mcp`,builder:e=>e.command(T).command(R).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},B={command:`ai-controls`,describe:`Operations for access.ai-controls`,builder:e=>e.command(z).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function V(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const H={command:`create <app-id>`,describe:`Generates a new short-lived certificate CA and public key.`,builder:V,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access applications cas create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Creating`,async()=>t.zeroTrust.access.applications.cas.create(e[`app-id`],n)),{successLabel:`Created`})}};function U(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const W={command:`delete <app-id>`,describe:`Deletes a short-lived certificate CA.`,builder:U,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access applications cas delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/ca`,pathParams:{"app-id":String(t[`app-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.access.applications.cas.delete(t[`app-id`],a)),{successLabel:`Deleted`})}};function G(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const K={command:`get <app-id>`,describe:`Fetches a short-lived certificate CA and its public key.`,builder:G,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access applications cas get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.applications.cas.get(e[`app-id`],n)),{successLabel:`Loaded`})}};function q(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const J={command:`list`,describe:`Lists short-lived certificate CAs and their public keys.`,builder:q,handler:async e=>{let t={page:e.page,per_page:e[`per-page`]};if(e.dryRun){u({command:`cf zero-trust access applications cas list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps/ca`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.access.applications.cas.list(a,t)),{successLabel:`Loaded`})}},Y={command:`cas`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(H).command(W).command(K).command(J).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function X(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Z={command:`create`,describe:`Adds a new application to Access.`,builder:X,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access applications create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps`,pathParams:{},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/access/apps`,{body:r})),{successLabel:`Created`});return}l(await d(`Creating`,async()=>t.zeroTrust.access.applications.create(n)),{successLabel:`Created`})}};function Q(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ne={command:`delete <app-id>`,describe:`Deletes an application from Access.`,builder:Q,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access applications delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}`,pathParams:{"app-id":String(t[`app-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.access.applications.delete(t[`app-id`],a)),{successLabel:`Deleted`})}};function re(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ie={command:`get <app-id>`,describe:`Fetches information about an Access application.`,builder:re,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access applications get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.applications.get(e[`app-id`],n)),{successLabel:`Loaded`})}};function ae(e){return e.option(`name`,{type:`string`,description:`The name of the app.`}).option(`domain`,{type:`string`,description:`The domain of the app.`}).option(`aud`,{type:`string`,description:`The aud of the app.`}).option(`target-attributes`,{type:`string`,description:`Target Criteria attributes in key=value format.`}).option(`exact`,{type:`boolean`,description:`True for only exact string matches against passed name/domain query parameters.`}).option(`search`,{type:`string`,description:`Search for apps by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const oe={command:`list`,describe:`Lists all Access applications in an account.`,builder:ae,handler:async e=>{let t={name:e.name,domain:e.domain,aud:e.aud,target_attributes:e[`target-attributes`],exact:e.exact,search:e.search,page:e.page,per_page:e[`per-page`]};if(e.dryRun){u({command:`cf zero-trust access applications list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.access.applications.list(a,t)),{successLabel:`Loaded`})}};function se(e){return e.positional(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy within an app.
+`}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`}).option(`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`,{type:`string`,array:!0,description:`Clipboard formats allowed when copying from local machine to remote RDP session.`}).option(`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`,{type:`string`,array:!0,description:`Clipboard formats allowed when copying from remote RDP session to local machine.`}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:`Lists the MFA methods that users can authenticate with.`}).option(`mfa-config-mfa-disabled`,{type:`boolean`,description:`Indicates whether to disable MFA for this resource. This option is available at the application and policy level.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.",default:`24h`}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ce={command:`create <app-id>`,describe:`Creates a policy applying exclusive to a single application that defines the users or groups who can reach it. We recommend creating a reusable policy instead and subsequently referencing its ID in the application's 'policies' array.`,builder:se,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access applications policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`json`,body:{precedence:e.precedence,"approval-required":e[`approval-required`],"connection-rules-rdp-allowed-clipboard-local-to-remote-formats":e[`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`],"connection-rules-rdp-allowed-clipboard-remote-to-local-formats":e[`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`],"isolation-required":e[`isolation-required`],"mfa-config-allowed-authenticators":e[`mfa-config-allowed-authenticators`],"mfa-config-mfa-disabled":e[`mfa-config-mfa-disabled`],"mfa-config-session-duration":e[`mfa-config-session-duration`],"purpose-justification-prompt":e[`purpose-justification-prompt`],"purpose-justification-required":e[`purpose-justification-required`],"session-duration":e[`session-duration`],decision:e.decision,name:e.name,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${p}/access/apps/${encodeURIComponent(String(e[`app-id`]))}/policies`,{body:t})),{successLabel:`Created`});return}e.decision===void 0&&(e.decision=await a(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),e.name===void 0&&(e.name=await t(`name`,`The name of the Access policy.`));let h={};e.precedence!==void 0&&s(h,[`precedence`],e.precedence),e[`approval-required`]!==void 0&&s(h,[`approval_required`],e[`approval-required`]),e[`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`]!==void 0&&s(h,[`connection_rules`,`rdp`,`allowed_clipboard_local_to_remote_formats`],e[`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`]),e[`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`]!==void 0&&s(h,[`connection_rules`,`rdp`,`allowed_clipboard_remote_to_local_formats`],e[`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`]),e[`isolation-required`]!==void 0&&s(h,[`isolation_required`],e[`isolation-required`]),e[`mfa-config-allowed-authenticators`]!==void 0&&s(h,[`mfa_config`,`allowed_authenticators`],e[`mfa-config-allowed-authenticators`]),e[`mfa-config-mfa-disabled`]!==void 0&&s(h,[`mfa_config`,`mfa_disabled`],e[`mfa-config-mfa-disabled`]),e[`mfa-config-session-duration`]!==void 0&&s(h,[`mfa_config`,`session_duration`],f(e[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)),e[`purpose-justification-prompt`]!==void 0&&s(h,[`purpose_justification_prompt`],f(e[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`)),e[`purpose-justification-required`]!==void 0&&s(h,[`purpose_justification_required`],e[`purpose-justification-required`]),e[`session-duration`]!==void 0&&s(h,[`session_duration`],f(e[`session-duration`],`session-duration`,`text`)),e.decision!==void 0&&s(h,[`decision`],f(e.decision,`decision`,`text`)),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${p}/access/apps/${encodeURIComponent(String(e[`app-id`]))}/policies`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created`})}};function le(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ue={command:`delete <policy-id>`,describe:`Deletes an Access policy specific to an application. To delete a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint.`,builder:le,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access applications policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/policies/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}`,pathParams:{"app-id":String(t[`app-id`]??``),"policy-id":String(t[`policy-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.access.applications.policies.delete(t[`app-id`],t[`policy-id`],a)),{successLabel:`Deleted`})}};function de(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fe={command:`get <policy-id>`,describe:`Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.`,builder:de,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access applications policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.applications.policies.get(e[`app-id`],e[`policy-id`],n)),{successLabel:`Loaded`})}};function pe(e){return e.option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const me={command:`list`,describe:`Lists Access policies configured for an application. Returns both exclusively scoped and reusable policies used by the application.`,builder:pe,handler:async e=>{let t={page:e.page,per_page:e[`per-page`]};if(e.dryRun){u({command:`cf zero-trust access applications policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies`,pathParams:{"app-id":String(e[`app-id`]??``)},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.access.applications.policies.list(e[`app-id`],a,t)),{successLabel:`Loaded`})}};function he(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy within an app.
+`}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`}).option(`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`,{type:`string`,array:!0,description:`Clipboard formats allowed when copying from local machine to remote RDP session.`}).option(`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`,{type:`string`,array:!0,description:`Clipboard formats allowed when copying from remote RDP session to local machine.`}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:`Lists the MFA methods that users can authenticate with.`}).option(`mfa-config-mfa-disabled`,{type:`boolean`,description:`Indicates whether to disable MFA for this resource. This option is available at the application and policy level.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ge={command:`update <policy-id>`,describe:`Updates an Access policy specific to an application. To update a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint.`,builder:he,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access applications policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"policy-id":String(e[`policy-id`]??``)},bodyKind:`json`,body:{precedence:e.precedence,"approval-required":e[`approval-required`],"connection-rules-rdp-allowed-clipboard-local-to-remote-formats":e[`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`],"connection-rules-rdp-allowed-clipboard-remote-to-local-formats":e[`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`],"isolation-required":e[`isolation-required`],"mfa-config-allowed-authenticators":e[`mfa-config-allowed-authenticators`],"mfa-config-mfa-disabled":e[`mfa-config-mfa-disabled`],"mfa-config-session-duration":e[`mfa-config-session-duration`],"purpose-justification-prompt":e[`purpose-justification-prompt`],"purpose-justification-required":e[`purpose-justification-required`],"session-duration":e[`session-duration`],decision:e.decision,name:e.name,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${p}/access/apps/${encodeURIComponent(String(e[`app-id`]))}/policies/${encodeURIComponent(String(e[`policy-id`]))}`,{body:t})),{successLabel:`Updated`});return}e.decision===void 0&&(e.decision=await a(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),e.name===void 0&&(e.name=await t(`name`,`The name of the Access policy.`));let h={};e.precedence!==void 0&&s(h,[`precedence`],e.precedence),e[`approval-required`]!==void 0&&s(h,[`approval_required`],e[`approval-required`]),e[`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`]!==void 0&&s(h,[`connection_rules`,`rdp`,`allowed_clipboard_local_to_remote_formats`],e[`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`]),e[`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`]!==void 0&&s(h,[`connection_rules`,`rdp`,`allowed_clipboard_remote_to_local_formats`],e[`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`]),e[`isolation-required`]!==void 0&&s(h,[`isolation_required`],e[`isolation-required`]),e[`mfa-config-allowed-authenticators`]!==void 0&&s(h,[`mfa_config`,`allowed_authenticators`],e[`mfa-config-allowed-authenticators`]),e[`mfa-config-mfa-disabled`]!==void 0&&s(h,[`mfa_config`,`mfa_disabled`],e[`mfa-config-mfa-disabled`]),e[`mfa-config-session-duration`]!==void 0&&s(h,[`mfa_config`,`session_duration`],f(e[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)),e[`purpose-justification-prompt`]!==void 0&&s(h,[`purpose_justification_prompt`],f(e[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`)),e[`purpose-justification-required`]!==void 0&&s(h,[`purpose_justification_required`],e[`purpose-justification-required`]),e[`session-duration`]!==void 0&&s(h,[`session_duration`],f(e[`session-duration`],`session-duration`,`text`)),e.decision!==void 0&&s(h,[`decision`],f(e.decision,`decision`,`text`)),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),l(await d(`Updating`,async()=>n.put(`/accounts/${p}/access/apps/${encodeURIComponent(String(e[`app-id`]))}/policies/${encodeURIComponent(String(e[`policy-id`]))}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated`})}},_e={command:`policies`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(ce).command(ue).command(fe).command(me).command(ge).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ve(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ye={command:`create`,describe:`Starts an Access policy test.`,builder:ve,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access applications policy-tests create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/policy-tests`,pathParams:{},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/access/policy-tests`,{body:r})),{successLabel:`Created`});return}l(await d(`Creating`,async()=>t.zeroTrust.access.applications.policyTests.create(n)),{successLabel:`Created`})}};function be(e){return e.positional(`policy-test-id`,{type:`string`,description:`The UUID of the policy test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xe={command:`get <policy-test-id>`,describe:`Fetches the current status of a given Access policy test.`,builder:be,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access applications policy-tests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/policy-tests/${e[`policy-test-id`]==null?`<policy-test-id>`:encodeURIComponent(String(e[`policy-test-id`]))}`,pathParams:{"policy-test-id":String(e[`policy-test-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.applications.policyTests.get(n,e[`policy-test-id`])),{successLabel:`Loaded`})}};function Se(e){return e.option(`policy-test-id`,{type:`string`,description:`The UUID of the policy test.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`status`,{type:`string`,description:`Filter users by their policy evaluation status.`,choices:[`success`,`fail`,`error`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ce={command:`list`,describe:`Fetches a single page of user results from an Access policy test.`,builder:Se,handler:async e=>{let t={page:e.page,per_page:e[`per-page`],status:e.status};if(e.dryRun){u({command:`cf zero-trust access applications policy-tests users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/policy-tests/${e[`policy-test-id`]==null?`<policy-test-id>`:encodeURIComponent(String(e[`policy-test-id`]))}/users`,pathParams:{"policy-test-id":String(e[`policy-test-id`]??``)},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.access.applications.policyTests.users.list(a,e[`policy-test-id`],t)),{successLabel:`Loaded`})}},we={command:`users`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Ce).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Te={command:`policy-tests`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(ye).command(xe).command(we).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ee(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const De={command:`revoke-tokens <app-id>`,describe:`Revokes all tokens issued for an application.`,builder:Ee,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access applications revoke-tokens`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/revoke_tokens`,pathParams:{"app-id":String(t[`app-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force,message:`This operation invalidates every service token for the app.`})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.access.applications.revokeTokens(t[`app-id`],a)),{successLabel:`Deleted`})}};function Oe(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ke={command:`edit <app-id>`,describe:`Updates Access application settings.`,builder:Oe,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access applications settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/settings`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`json`,body:{"allow-iframe":e[`allow-iframe`],"skip-interstitial":e[`skip-interstitial`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/access/apps/${encodeURIComponent(String(e[`app-id`]))}/settings`,{body:r})),{successLabel:`Updated`});return}let a={};e[`allow-iframe`]!==void 0&&s(a,[`allow_iframe`],e[`allow-iframe`]),e[`skip-interstitial`]!==void 0&&s(a,[`skip_interstitial`],e[`skip-interstitial`]),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/access/apps/${encodeURIComponent(String(e[`app-id`]))}/settings`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}};function Ae(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const je={command:`update <app-id>`,describe:`Updates Access application settings.`,builder:Ae,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access applications settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/settings`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`json`,body:{"allow-iframe":e[`allow-iframe`],"skip-interstitial":e[`skip-interstitial`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/apps/${encodeURIComponent(String(e[`app-id`]))}/settings`,{body:r})),{successLabel:`Updated`});return}let a={};e[`allow-iframe`]!==void 0&&s(a,[`allow_iframe`],e[`allow-iframe`]),e[`skip-interstitial`]!==void 0&&s(a,[`skip_interstitial`],e[`skip-interstitial`]),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/apps/${encodeURIComponent(String(e[`app-id`]))}/settings`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},Me={command:`settings`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(ke).command(je).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ne(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Pe={command:`update <app-id>`,describe:`Updates an Access application.`,builder:Ne,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access applications update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/apps/${encodeURIComponent(String(e[`app-id`]))}`,{body:r})),{successLabel:`Updated`});return}l(await d(`Updating`,async()=>t.zeroTrust.access.applications.update(e[`app-id`],n)),{successLabel:`Updated`})}};function Fe(e){return e.option(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ie={command:`list`,describe:`Tests if a specific user has permission to access an application.`,builder:Fe,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access applications user-policy-checks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/user_policy_checks`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.applications.userPolicyChecks.list(e[`app-id`],n)),{successLabel:`Loaded`})}},Le={command:`user-policy-checks`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Ie).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Re={command:`applications`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Z).command(ne).command(ie).command(oe).command(De).command(Pe).command(Y).command(_e).command(Te).command(Me).command(Le).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ze(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Be={command:`create <bookmark-id>`,describe:`Create a new Bookmark application.`,builder:ze,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access bookmarks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/bookmarks/${e[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(e[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(e[`bookmark-id`]??``)},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/access/bookmarks/${encodeURIComponent(String(e[`bookmark-id`]))}`,{body:r})),{successLabel:`Created`});return}l(await d(`Creating`,async()=>t.zeroTrust.access.bookmarks.create(e[`bookmark-id`],n)),{successLabel:`Created`})}};function Ve(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const He={command:`delete <bookmark-id>`,describe:`Deletes a Bookmark application.`,builder:Ve,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access bookmarks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/bookmarks/${t[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(t[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(t[`bookmark-id`]??``)},bodyKind:`json`,body:{body:t.body}});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body);l(await d(`Deleting`,async()=>n.delete(`/accounts/${a}/access/bookmarks/${encodeURIComponent(String(t[`bookmark-id`]))}`,{body:e})),{successLabel:`Deleted`});return}l(await d(`Deleting`,async()=>n.zeroTrust.access.bookmarks.delete(t[`bookmark-id`],a)),{successLabel:`Deleted`})}};function Ue(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const We={command:`get <bookmark-id>`,describe:`Fetches a single Bookmark application.`,builder:Ue,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access bookmarks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/bookmarks/${e[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(e[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(e[`bookmark-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.bookmarks.get(e[`bookmark-id`],n)),{successLabel:`Loaded`})}};function Ge(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ke={command:`list`,describe:`Lists Bookmark applications.`,builder:Ge,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access bookmarks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/bookmarks`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.bookmarks.list(n)),{successLabel:`Loaded`})}};function qe(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Je={command:`update <bookmark-id>`,describe:`Updates a configured Bookmark application.`,builder:qe,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access bookmarks update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/bookmarks/${e[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(e[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(e[`bookmark-id`]??``)},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/bookmarks/${encodeURIComponent(String(e[`bookmark-id`]))}`,{body:r})),{successLabel:`Updated`});return}l(await d(`Updating`,async()=>t.zeroTrust.access.bookmarks.update(e[`bookmark-id`],n)),{successLabel:`Updated`})}},Ye={command:`bookmarks`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Be).command(He).command(We).command(Ke).command(Je).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Xe(e){return e.option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`certificate`,{type:`string`,description:`The certificate content.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ze={command:`create`,describe:`Adds a new mTLS root certificate to Access.`,builder:Xe,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/certificates`,pathParams:{},bodyKind:`json`,body:{"associated-hostnames":e[`associated-hostnames`],certificate:e.certificate,name:e.name,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/access/certificates`,{body:t})),{successLabel:`Created`});return}e.certificate===void 0&&(e.certificate=await t(`certificate`,`The certificate content.`)),e.name===void 0&&(e.name=await t(`name`,`The name of the certificate.`));let p={};e[`associated-hostnames`]!==void 0&&s(p,[`associated_hostnames`],e[`associated-hostnames`]),e.certificate!==void 0&&s(p,[`certificate`],f(e.certificate,`certificate`,`text`)),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/access/certificates`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function Qe(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const $e={command:`delete <certificate-id>`,describe:`Deletes an mTLS certificate.`,builder:Qe,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/certificates/${t[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(t[`certificate-id`]))}`,pathParams:{"certificate-id":String(t[`certificate-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.access.certificates.delete(t[`certificate-id`],a)),{successLabel:`Deleted`})}};function et(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const tt={command:`get <certificate-id>`,describe:`Fetches a single mTLS certificate.`,builder:et,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.certificates.get(e[`certificate-id`],n)),{successLabel:`Loaded`})}};function nt(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const rt={command:`list`,describe:`Lists all mTLS root certificates.`,builder:nt,handler:async e=>{let t={page:e.page,per_page:e[`per-page`]};if(e.dryRun){u({command:`cf zero-trust access certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/certificates`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.access.certificates.list(a,t)),{successLabel:`Loaded`})}};function it(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const at={command:`get`,describe:`List all mTLS hostname settings for this account.`,builder:it,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access certificates settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/certificates/settings`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.certificates.settings.get(n)),{successLabel:`Loaded`})}};function ot(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const st={command:`update`,describe:`Updates an mTLS certificate's hostname settings.`,builder:ot,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access certificates settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/certificates/settings`,pathParams:{},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/certificates/settings`,{body:r})),{successLabel:`Updated`});return}l(await d(`Updating`,async()=>t.zeroTrust.access.certificates.settings.update(n)),{successLabel:`Updated`})}},ct={command:`settings`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(at).command(st).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function lt(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ut={command:`update <certificate-id>`,describe:`Updates a configured mTLS certificate.`,builder:lt,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access certificates update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`json`,body:{"associated-hostnames":e[`associated-hostnames`],name:e.name,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/certificates/${encodeURIComponent(String(e[`certificate-id`]))}`,{body:r})),{successLabel:`Updated`});return}if(e[`associated-hostnames`]===void 0)throw Error(`--associated-hostnames is required (or pass --body with this field set).`);let a={};e[`associated-hostnames`]!==void 0&&s(a,[`associated_hostnames`],e[`associated-hostnames`]),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/certificates/${encodeURIComponent(String(e[`certificate-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},dt={command:`certificates`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Ze).command($e).command(tt).command(rt).command(ut).command(ct).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ft(e){return e.option(`app-count`,{type:`number`,description:`Number of apps the custom page is assigned to.`}).option(`custom-html`,{type:`string`,description:`Custom page HTML.`}).option(`name`,{type:`string`,description:`Custom page name.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`]}).option(`uid`,{type:`string`,description:`UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pt={command:`create`,describe:`Create a custom page`,builder:ft,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access custom-pages create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/custom_pages`,pathParams:{},bodyKind:`json`,body:{"app-count":e[`app-count`],"custom-html":e[`custom-html`],name:e.name,type:e.type,uid:e.uid,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${p}/access/custom_pages`,{body:t})),{successLabel:`Created`});return}e[`custom-html`]===void 0&&(e[`custom-html`]=await t(`custom-html`,`Custom page HTML.`)),e.name===void 0&&(e.name=await t(`name`,`Custom page name.`)),e.type===void 0&&(e.type=await a(`type`,`Custom page type.`,[`identity_denied`,`forbidden`]));let h={};e[`app-count`]!==void 0&&s(h,[`app_count`],e[`app-count`]),e[`custom-html`]!==void 0&&s(h,[`custom_html`],f(e[`custom-html`],`custom-html`,`text`)),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),e.type!==void 0&&s(h,[`type`],f(e.type,`type`,`text`)),e.uid!==void 0&&s(h,[`uid`],f(e.uid,`uid`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${p}/access/custom_pages`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created`})}};function mt(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ht={command:`delete <custom-page-id>`,describe:`Delete a custom page`,builder:mt,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access custom-pages delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/custom_pages/${t[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(t[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(t[`custom-page-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.access.customPages.delete(t[`custom-page-id`],a)),{successLabel:`Deleted`})}};function gt(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _t={command:`get <custom-page-id>`,describe:`Fetches a custom page and also returns its HTML.`,builder:gt,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access custom-pages get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/custom_pages/${e[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(e[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(e[`custom-page-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.customPages.get(e[`custom-page-id`],n)),{successLabel:`Loaded`})}};function vt(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yt={command:`list`,describe:`List custom pages`,builder:vt,handler:async e=>{let t={page:e.page,per_page:e[`per-page`]};if(e.dryRun){u({command:`cf zero-trust access custom-pages list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/custom_pages`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.access.customPages.list(a,t)),{successLabel:`Loaded`})}};function bt(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-count`,{type:`number`,description:`Number of apps the custom page is assigned to.`}).option(`custom-html`,{type:`string`,description:`Custom page HTML.`}).option(`name`,{type:`string`,description:`Custom page name.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`]}).option(`uid`,{type:`string`,description:`UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xt={command:`update <custom-page-id>`,describe:`Update a custom page`,builder:bt,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access custom-pages update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/custom_pages/${e[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(e[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(e[`custom-page-id`]??``)},bodyKind:`json`,body:{"app-count":e[`app-count`],"custom-html":e[`custom-html`],name:e.name,type:e.type,uid:e.uid,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${p}/access/custom_pages/${encodeURIComponent(String(e[`custom-page-id`]))}`,{body:t})),{successLabel:`Updated`});return}e[`custom-html`]===void 0&&(e[`custom-html`]=await t(`custom-html`,`Custom page HTML.`)),e.name===void 0&&(e.name=await t(`name`,`Custom page name.`)),e.type===void 0&&(e.type=await a(`type`,`Custom page type.`,[`identity_denied`,`forbidden`]));let h={};e[`app-count`]!==void 0&&s(h,[`app_count`],e[`app-count`]),e[`custom-html`]!==void 0&&s(h,[`custom_html`],f(e[`custom-html`],`custom-html`,`text`)),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),e.type!==void 0&&s(h,[`type`],f(e.type,`type`,`text`)),e.uid!==void 0&&s(h,[`uid`],f(e.uid,`uid`,`text`)),l(await d(`Updating`,async()=>n.put(`/accounts/${p}/access/custom_pages/${encodeURIComponent(String(e[`custom-page-id`]))}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated`})}},St={command:`custom-pages`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(pt).command(ht).command(_t).command(yt).command(xt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ct(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wt={command:`create`,describe:`Adds a new SSH Certificate Authority (CA).`,builder:Ct,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access gateway-ca create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/gateway_ca`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Creating`,async()=>t.zeroTrust.access.gatewayCa.create(n)),{successLabel:`Created`})}};function Tt(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Et={command:`delete <certificate-id>`,describe:`Deletes an SSH Certificate Authority.`,builder:Tt,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access gateway-ca delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/gateway_ca/${t[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(t[`certificate-id`]))}`,pathParams:{"certificate-id":String(t[`certificate-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.access.gatewayCa.delete(t[`certificate-id`],a)),{successLabel:`Deleted`})}};function Dt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ot={command:`list`,describe:`Lists SSH Certificate Authorities (CA).`,builder:Dt,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access gateway-ca list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/gateway_ca`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.gatewayCa.list(n)),{successLabel:`Loaded`})}},kt={command:`gateway-ca`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(wt).command(Et).command(Ot).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function At(e){return e.option(`is-default`,{type:`boolean`,description:`Whether this is the default group`}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const jt={command:`create`,describe:`Creates a new Access group.`,builder:At,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/groups`,pathParams:{},bodyKind:`json`,body:{"is-default":e[`is-default`],name:e.name,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/access/groups`,{body:t})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await t(`name`,`The name of the Access group.`));let p={};e[`is-default`]!==void 0&&s(p,[`is_default`],e[`is-default`]),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/access/groups`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function Mt(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Nt={command:`delete <group-id>`,describe:`Deletes an Access group.`,builder:Mt,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/groups/${t[`group-id`]==null?`<group-id>`:encodeURIComponent(String(t[`group-id`]))}`,pathParams:{"group-id":String(t[`group-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.access.groups.delete(t[`group-id`],a)),{successLabel:`Deleted`})}};function Pt(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ft={command:`get <group-id>`,describe:`Fetches a single Access group.`,builder:Pt,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.groups.get(e[`group-id`],n)),{successLabel:`Loaded`})}};function It(e){return e.option(`name`,{type:`string`,description:`The name of the group.`}).option(`search`,{type:`string`,description:`Search for groups by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Lt={command:`list`,describe:`Lists all Access groups.`,builder:It,handler:async e=>{let t={name:e.name,search:e.search,page:e.page,per_page:e[`per-page`]};if(e.dryRun){u({command:`cf zero-trust access groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/groups`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.access.groups.list(a,t)),{successLabel:`Loaded`})}};function Rt(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`is-default`,{type:`boolean`,description:`Whether this is the default group`}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const zt={command:`update <group-id>`,describe:`Updates a configured Access group.`,builder:Rt,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``)},bodyKind:`json`,body:{"is-default":e[`is-default`],name:e.name,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${a}/access/groups/${encodeURIComponent(String(e[`group-id`]))}`,{body:t})),{successLabel:`Updated`});return}e.name===void 0&&(e.name=await t(`name`,`The name of the Access group.`));let p={};e[`is-default`]!==void 0&&s(p,[`is_default`],e[`is-default`]),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),l(await d(`Updating`,async()=>n.put(`/accounts/${a}/access/groups/${encodeURIComponent(String(e[`group-id`]))}`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated`})}},Bt={command:`groups`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(jt).command(Nt).command(Ft).command(Lt).command(zt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Vt(e){return e.option(`target-ids`,{type:`string`,array:!0,description:`List of target IDs to bulk delete`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ht={command:`bulk-delete-v2`,describe:`Removes one or more targets.`,builder:Vt,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access infrastructure targets bulk-delete-v2`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/infrastructure/targets/batch_delete`,pathParams:{},bodyKind:`json`,body:{"target-ids":t[`target-ids`],body:t.body}});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force,message:`This operation bulk-deletes infrastructure targets destructively.`})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body);l(await d(`Deleting`,async()=>n.post(`/accounts/${a}/infrastructure/targets/batch_delete`,{body:e})),{successLabel:`Deleted`});return}if(t[`target-ids`]===void 0)throw Error(`--target-ids is required (or pass --body with this field set).`);let f={};t[`target-ids`]!==void 0&&s(f,[`target_ids`],t[`target-ids`]),l(await d(`Deleting`,async()=>n.post(`/accounts/${a}/infrastructure/targets/batch_delete`,{body:Object.keys(f).length>0?f:void 0})),{successLabel:`Deleted`})}};function Ut(e){return e.option(`target-ids`,{type:`string`,array:!0,description:`List of target IDs to bulk delete`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wt={command:`bulk-delete`,describe:`Removes one or more targets.`,builder:Ut,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access infrastructure targets bulk-delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/infrastructure/targets/batch`,pathParams:{},bodyKind:`json`,body:{"target-ids":t[`target-ids`],body:t.body}});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body);l(await d(`Deleting`,async()=>n.delete(`/accounts/${a}/infrastructure/targets/batch`,{body:e})),{successLabel:`Deleted`});return}if(t[`target-ids`]===void 0)throw Error(`--target-ids is required (or pass --body with this field set).`);let f={};t[`target-ids`]!==void 0&&s(f,[`target_ids`],t[`target-ids`]),l(await d(`Deleting`,async()=>n.delete(`/accounts/${a}/infrastructure/targets/batch`,{body:Object.keys(f).length>0?f:void 0})),{successLabel:`Deleted`})}};function Gt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Kt={command:`bulk-update`,describe:`Adds one or more targets.`,builder:Gt,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access infrastructure targets bulk-update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/infrastructure/targets/batch`,pathParams:{},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/infrastructure/targets/batch`,{body:r})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function qt(e){return e.option(`hostname`,{type:`string`,description:`A non-unique field that refers to a target. Case insensitive, maximum
+length of 255 characters, supports the use of special characters dash
+and period, does not support spaces, and must start and end with an
+alphanumeric character.`}).option(`ip-ipv4-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv4-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`ip-ipv6-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv6-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Jt={command:`create`,describe:`Creates a new infrastructure access target for secure access through Cloudflare Access. Targets can be servers, databases, or other infrastructure.`,builder:qt,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access infrastructure targets create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/infrastructure/targets`,pathParams:{},bodyKind:`json`,body:{hostname:e.hostname,"ip-ipv4-ip-addr":e[`ip-ipv4-ip-addr`],"ip-ipv4-virtual-network-id":e[`ip-ipv4-virtual-network-id`],"ip-ipv6-ip-addr":e[`ip-ipv6-ip-addr`],"ip-ipv6-virtual-network-id":e[`ip-ipv6-virtual-network-id`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/infrastructure/targets`,{body:t})),{successLabel:`Created`});return}e.hostname===void 0&&(e.hostname=await t(`hostname`,`A non-unique field that refers to a target. Case insensitive, maximum length of 255 characters, supports the use of special characters dash and period, does not support spaces, and must start and end with an alphanumeric character.`));let p={};e.hostname!==void 0&&s(p,[`hostname`],f(e.hostname,`hostname`,`text`)),e[`ip-ipv4-ip-addr`]!==void 0&&s(p,[`ip`,`ipv4`,`ip_addr`],f(e[`ip-ipv4-ip-addr`],`ip-ipv4-ip-addr`,`text`)),e[`ip-ipv4-virtual-network-id`]!==void 0&&s(p,[`ip`,`ipv4`,`virtual_network_id`],f(e[`ip-ipv4-virtual-network-id`],`ip-ipv4-virtual-network-id`,`text`)),e[`ip-ipv6-ip-addr`]!==void 0&&s(p,[`ip`,`ipv6`,`ip_addr`],f(e[`ip-ipv6-ip-addr`],`ip-ipv6-ip-addr`,`text`)),e[`ip-ipv6-virtual-network-id`]!==void 0&&s(p,[`ip`,`ipv6`,`virtual_network_id`],f(e[`ip-ipv6-virtual-network-id`],`ip-ipv6-virtual-network-id`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/infrastructure/targets`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function Yt(e){return e.positional(`target-id`,{type:`string`,description:`Target identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Xt={command:`delete <target-id>`,describe:`Removes an infrastructure access target. The target will no longer be accessible through Cloudflare Access.`,builder:Yt,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access infrastructure targets delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/infrastructure/targets/${t[`target-id`]==null?`<target-id>`:encodeURIComponent(String(t[`target-id`]))}`,pathParams:{"target-id":String(t[`target-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.access.infrastructure.targets.delete(a,t[`target-id`])),{successLabel:`Deleted`})}};function Zt(e){return e.positional(`target-id`,{type:`string`,description:`Target identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qt={command:`get <target-id>`,describe:`Retrieves details for a specific infrastructure access target, including its hostname, IP, and access configuration.`,builder:Zt,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access infrastructure targets get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/infrastructure/targets/${e[`target-id`]==null?`<target-id>`:encodeURIComponent(String(e[`target-id`]))}`,pathParams:{"target-id":String(e[`target-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.infrastructure.targets.get(n,e[`target-id`])),{successLabel:`Loaded`})}};function $t(e){return e.option(`hostname`,{type:`string`,description:`Hostname of a target`}).option(`hostname-contains`,{type:`string`,description:`Partial match to the hostname of a target`}).option(`virtual-network-id`,{type:`string`,description:`Private virtual network identifier of the target`}).option(`ip-v4`,{type:`string`,description:`IPv4 address of the target`}).option(`ip-v6`,{type:`string`,description:`IPv6 address of the target`}).option(`created-before`,{type:`string`,description:`Date and time at which the target was created before (inclusive)`}).option(`created-after`,{type:`string`,description:`Date and time at which the target was created after (inclusive)`}).option(`modified-before`,{type:`string`,description:`Date and time at which the target was modified before (inclusive)`}).option(`modified-after`,{type:`string`,description:`Date and time at which the target was modified after (inclusive)`}).option(`ips`,{type:`string`,description:"Filters for targets that have any of the following IP addresses. Specify\n`ips` multiple times in query parameter to build list of candidates."}).option(`target-ids`,{type:`string`,description:`Filters for targets that have any of the following UUIDs. Specify
+\`target_ids\` multiple times in query parameter to build list of
+candidates.`}).option(`ip-like`,{type:`string`,description:"Filters for targets whose IP addresses look like the specified string.\nSupports `*` as a wildcard character"}).option(`ipv4-start`,{type:`string`,description:"Defines an IPv4 filter range's starting value (inclusive). Requires\n`ipv4_end` to be specified as well."}).option(`ipv4-end`,{type:`string`,description:"Defines an IPv4 filter range's ending value (inclusive). Requires\n`ipv4_start` to be specified as well."}).option(`ipv6-start`,{type:`string`,description:"Defines an IPv6 filter range's starting value (inclusive). Requires\n`ipv6_end` to be specified as well."}).option(`ipv6-end`,{type:`string`,description:"Defines an IPv6 filter range's ending value (inclusive). Requires\n`ipv6_start` to be specified as well."}).option(`page`,{type:`number`,description:`Current page in the response`}).option(`per-page`,{type:`number`,description:`Max amount of entries returned per page`}).option(`order`,{type:`string`,description:`The field to sort by.`,choices:[`hostname`,`created_at`]}).option(`direction`,{type:`string`,description:`The sorting direction.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const en={command:`list`,describe:`Lists and sorts an account’s targets. Filters are optional and are ANDed together.`,builder:$t,handler:async e=>{let t={hostname:e.hostname,hostname_contains:e[`hostname-contains`],virtual_network_id:e[`virtual-network-id`],ip_v4:e[`ip-v4`],ip_v6:e[`ip-v6`],created_before:e[`created-before`],created_after:e[`created-after`],modified_before:e[`modified-before`],modified_after:e[`modified-after`],ips:e.ips,target_ids:e[`target-ids`],ip_like:e[`ip-like`],ipv4_start:e[`ipv4-start`],ipv4_end:e[`ipv4-end`],ipv6_start:e[`ipv6-start`],ipv6_end:e[`ipv6-end`],page:e.page,per_page:e[`per-page`],order:e.order,direction:e.direction};if(e.dryRun){u({command:`cf zero-trust access infrastructure targets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/infrastructure/targets`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.access.infrastructure.targets.list(a,t)),{successLabel:`Loaded`})}};function tn(e){return e.positional(`target-id`,{type:`string`,description:`Target identifier`,demandOption:!0}).option(`hostname`,{type:`string`,description:`A non-unique field that refers to a target. Case insensitive, maximum
+length of 255 characters, supports the use of special characters dash
+and period, does not support spaces, and must start and end with an
+alphanumeric character.`}).option(`ip-ipv4-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv4-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`ip-ipv6-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv6-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const nn={command:`update <target-id>`,describe:`Updates an existing infrastructure access target's configuration, including connection parameters and access policies.`,builder:tn,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access infrastructure targets update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/infrastructure/targets/${e[`target-id`]==null?`<target-id>`:encodeURIComponent(String(e[`target-id`]))}`,pathParams:{"target-id":String(e[`target-id`]??``)},bodyKind:`json`,body:{hostname:e.hostname,"ip-ipv4-ip-addr":e[`ip-ipv4-ip-addr`],"ip-ipv4-virtual-network-id":e[`ip-ipv4-virtual-network-id`],"ip-ipv6-ip-addr":e[`ip-ipv6-ip-addr`],"ip-ipv6-virtual-network-id":e[`ip-ipv6-virtual-network-id`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${a}/infrastructure/targets/${encodeURIComponent(String(e[`target-id`]))}`,{body:t})),{successLabel:`Updated`});return}e.hostname===void 0&&(e.hostname=await t(`hostname`,`A non-unique field that refers to a target. Case insensitive, maximum length of 255 characters, supports the use of special characters dash and period, does not support spaces, and must start and end with an alphanumeric character.`));let p={};e.hostname!==void 0&&s(p,[`hostname`],f(e.hostname,`hostname`,`text`)),e[`ip-ipv4-ip-addr`]!==void 0&&s(p,[`ip`,`ipv4`,`ip_addr`],f(e[`ip-ipv4-ip-addr`],`ip-ipv4-ip-addr`,`text`)),e[`ip-ipv4-virtual-network-id`]!==void 0&&s(p,[`ip`,`ipv4`,`virtual_network_id`],f(e[`ip-ipv4-virtual-network-id`],`ip-ipv4-virtual-network-id`,`text`)),e[`ip-ipv6-ip-addr`]!==void 0&&s(p,[`ip`,`ipv6`,`ip_addr`],f(e[`ip-ipv6-ip-addr`],`ip-ipv6-ip-addr`,`text`)),e[`ip-ipv6-virtual-network-id`]!==void 0&&s(p,[`ip`,`ipv6`,`virtual_network_id`],f(e[`ip-ipv6-virtual-network-id`],`ip-ipv6-virtual-network-id`,`text`)),l(await d(`Updating`,async()=>n.put(`/accounts/${a}/infrastructure/targets/${encodeURIComponent(String(e[`target-id`]))}`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated`})}},rn={command:`targets`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Wt).command(Ht).command(Kt).command(Jt).command(Xt).command(Qt).command(en).command(nn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},an={command:`infrastructure`,describe:`Operations for access.infrastructure`,builder:e=>e.command(rn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function on(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sn={command:`get`,describe:`Gets the Access key rotation settings for an account.`,builder:on,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access keys get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/keys`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.keys.get(n)),{successLabel:`Loaded`})}};function cn(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ln={command:`rotate`,describe:`Perfoms a key rotation for an account.`,builder:cn,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access keys rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/keys/rotate`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Creating`,async()=>t.zeroTrust.access.keys.rotate(n)),{successLabel:`Created`})}};function un(e){return e.option(`key-rotation-interval-days`,{type:`number`,description:`The number of days between key rotations.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const dn={command:`update`,describe:`Updates the Access key rotation settings for an account.`,builder:un,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access keys update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/keys`,pathParams:{},bodyKind:`json`,body:{"key-rotation-interval-days":e[`key-rotation-interval-days`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/keys`,{body:r})),{successLabel:`Updated`});return}if(e[`key-rotation-interval-days`]===void 0)throw Error(`--key-rotation-interval-days is required (or pass --body with this field set).`);let a={};e[`key-rotation-interval-days`]!==void 0&&s(a,[`key_rotation_interval_days`],e[`key-rotation-interval-days`]),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/keys`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},fn={command:`keys`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(sn).command(ln).command(dn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pn(e){return e.option(`limit`,{type:`number`,description:`The maximum number of log entries to retrieve.`}).option(`direction`,{type:`string`,description:`The chronological sorting order for the logs.`,choices:[`desc`,`asc`]}).option(`since`,{type:`string`,description:`The earliest event timestamp to query.`}).option(`until`,{type:`string`,description:`The latest event timestamp to query.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`email`,{type:`string`,description:"Filter by user email. Defaults to substring matching. To force exact matching, set `email_exact=true`.\nExample (default): `email=@example.com` returns all events with that domain.\nExample (exact): `email=user@example.com&email_exact=true` returns only that user."}).option(`email-exact`,{type:`boolean`,description:"When true, `email` is matched exactly instead of substring matching."}).option(`user-id`,{type:`string`,description:`Filter by user UUID.`}).option(`allowed-op`,{type:`string`,description:"Operator for the `allowed` filter.",choices:[`eq`,`neq`]}).option(`country-code-op`,{type:`string`,description:"Operator for the `country_code` filter.",choices:[`eq`,`neq`]}).option(`app-type-op`,{type:`string`,description:"Operator for the `app_type` filter.",choices:[`eq`,`neq`]}).option(`app-uid-op`,{type:`string`,description:"Operator for the `app_uid` filter.",choices:[`eq`,`neq`]}).option(`ray-id-op`,{type:`string`,description:"Operator for the `ray_id` filter.",choices:[`eq`,`neq`]}).option(`email-op`,{type:`string`,description:"Operator for the `email` filter.",choices:[`eq`,`neq`]}).option(`idp-op`,{type:`string`,description:"Operator for the `idp` filter.",choices:[`eq`,`neq`]}).option(`non-identity-op`,{type:`string`,description:"Operator for the `non_identity` filter.",choices:[`eq`,`neq`]}).option(`user-id-op`,{type:`string`,description:"Operator for the `user_id` filter.",choices:[`eq`,`neq`]}).option(`fields`,{type:`string`,description:`Comma-separated list of fields to include in the response.
+When omitted, all fields are returned.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const mn={command:`list`,describe:`Gets a list of Access authentication audit logs for an account.`,builder:pn,handler:async e=>{let t={limit:e.limit,direction:e.direction,since:e.since,until:e.until,page:e.page,per_page:e[`per-page`],email:e.email,email_exact:e[`email-exact`],user_id:e[`user-id`],allowedOp:e[`allowed-op`],country_codeOp:e[`country-code-op`],app_typeOp:e[`app-type-op`],app_uidOp:e[`app-uid-op`],ray_idOp:e[`ray-id-op`],emailOp:e[`email-op`],idpOp:e[`idp-op`],non_identityOp:e[`non-identity-op`],user_idOp:e[`user-id-op`],fields:e.fields};if(e.dryRun){u({command:`cf zero-trust access logs access-requests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/logs/access_requests`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.access.logs.accessRequests.list(a,t)),{successLabel:`Loaded`})}},hn={command:`access-requests`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(mn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function gn(e){return e.option(`limit`,{type:`string`,description:`The maximum number of update logs to retrieve.`}).option(`direction`,{type:`string`,description:`The chronological order used to sort the logs.`,choices:[`desc`,`asc`]}).option(`since`,{type:`string`,description:`the timestamp of the earliest update log.`}).option(`until`,{type:`string`,description:`the timestamp of the most-recent update log.`}).option(`idp-id`,{type:`string`,description:`The unique Id of the IdP that has SCIM enabled.`,demandOption:!0}).option(`status`,{type:`string`,description:`The status of the SCIM request.`}).option(`resource-type`,{type:`string`,description:`The resource type of the SCIM request.`}).option(`request-method`,{type:`string`,description:`The request method of the SCIM request.`}).option(`resource-user-email`,{type:`string`,description:`The email address of the SCIM User resource.`}).option(`resource-group-name`,{type:`string`,description:`The display name of the SCIM Group resource.`}).option(`cf-resource-id`,{type:`string`,description:`The unique Cloudflare-generated Id of the SCIM resource.`}).option(`idp-resource-id`,{type:`string`,description:`The IdP-generated Id of the SCIM resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _n={command:`list`,describe:`Lists Access SCIM update logs that maintain a record of updates made to User and Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:gn,handler:async e=>{let t={limit:e.limit,direction:e.direction,since:e.since,until:e.until,idp_id:e[`idp-id`],status:e.status,resource_type:e[`resource-type`],request_method:e[`request-method`],resource_user_email:e[`resource-user-email`],resource_group_name:e[`resource-group-name`],cf_resource_id:e[`cf-resource-id`],idp_resource_id:e[`idp-resource-id`],page:e.page,per_page:e[`per-page`]};if(e.dryRun){u({command:`cf zero-trust access logs scim updates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/logs/scim/updates`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.access.logs.scim.updates.list(a,t)),{successLabel:`Loaded`})}},vn={command:`updates`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(_n).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},yn={command:`scim`,describe:`Operations for access.logs.scim`,builder:e=>e.command(vn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},bn={command:`logs`,describe:`Operations for access.logs`,builder:e=>e.command(hn).command(yn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function xn(e){return e.option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Sn={command:`create`,describe:`Creates a new Access reusable policy.`,builder:xn,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/policies`,pathParams:{},bodyKind:`json`,body:{decision:e.decision,name:e.name,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${p}/access/policies`,{body:t})),{successLabel:`Created`});return}e.decision===void 0&&(e.decision=await a(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),e.name===void 0&&(e.name=await t(`name`,`The name of the Access policy.`));let h={};e.decision!==void 0&&s(h,[`decision`],f(e.decision,`decision`,`text`)),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${p}/access/policies`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created`})}};function Cn(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const wn={command:`delete <policy-id>`,describe:`Deletes an Access reusable policy.`,builder:Cn,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/policies/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}`,pathParams:{"policy-id":String(t[`policy-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.access.policies.delete(a,t[`policy-id`])),{successLabel:`Deleted`})}};function Tn(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const En={command:`get <policy-id>`,describe:`Fetches a single Access reusable policy.`,builder:Tn,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.policies.get(n,e[`policy-id`])),{successLabel:`Loaded`})}};function Dn(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const On={command:`list`,describe:`Lists Access reusable policies.`,builder:Dn,handler:async e=>{let t={page:e.page,per_page:e[`per-page`]};if(e.dryRun){u({command:`cf zero-trust access policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/policies`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.access.policies.list(a,t)),{successLabel:`Loaded`})}};function kn(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const An={command:`update <policy-id>`,describe:`Updates a Access reusable policy.`,builder:kn,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`json`,body:{decision:e.decision,name:e.name,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${p}/access/policies/${encodeURIComponent(String(e[`policy-id`]))}`,{body:t})),{successLabel:`Updated`});return}e.decision===void 0&&(e.decision=await a(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),e.name===void 0&&(e.name=await t(`name`,`The name of the Access policy.`));let h={};e.decision!==void 0&&s(h,[`decision`],f(e.decision,`decision`,`text`)),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),l(await d(`Updating`,async()=>n.put(`/accounts/${p}/access/policies/${encodeURIComponent(String(e[`policy-id`]))}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated`})}},jn={command:`policies`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Sn).command(wn).command(En).command(On).command(An).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Mn(e){return e.option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.",default:1}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).",default:`8760h`}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Nn={command:`create`,describe:`Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token.`,builder:Mn,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access service-tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/service_tokens`,pathParams:{},bodyKind:`json`,body:{"client-secret-version":e[`client-secret-version`],duration:e.duration,name:e.name,"previous-client-secret-expires-at":e[`previous-client-secret-expires-at`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/access/service_tokens`,{body:t})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await t(`name`,`The name of the service token.`));let p={};e[`client-secret-version`]!==void 0&&s(p,[`client_secret_version`],e[`client-secret-version`]),e.duration!==void 0&&s(p,[`duration`],f(e.duration,`duration`,`text`)),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),e[`previous-client-secret-expires-at`]!==void 0&&s(p,[`previous_client_secret_expires_at`],f(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/access/service_tokens`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function Pn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Fn={command:`delete <service-token-id>`,describe:`Deletes a service token.`,builder:Pn,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access service-tokens delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/service_tokens/${t[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(t[`service-token-id`]))}`,pathParams:{"service-token-id":String(t[`service-token-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.access.serviceTokens.delete(t[`service-token-id`],a)),{successLabel:`Deleted`})}};function In(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ln={command:`get <service-token-id>`,describe:`Fetches a single service token.`,builder:In,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access service-tokens get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.serviceTokens.get(e[`service-token-id`],n)),{successLabel:`Loaded`})}};function Rn(e){return e.option(`name`,{type:`string`,description:`The name of the service token.`}).option(`search`,{type:`string`,description:`Search for service tokens by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zn={command:`list`,describe:`Lists all service tokens.`,builder:Rn,handler:async e=>{let t={name:e.name,search:e.search,page:e.page,per_page:e[`per-page`]};if(e.dryRun){u({command:`cf zero-trust access service-tokens list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/service_tokens`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.access.serviceTokens.list(a,t)),{successLabel:`Loaded`})}};function Bn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vn={command:`refresh <service-token-id>`,describe:`Refreshes the expiration of a service token.`,builder:Bn,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access service-tokens refresh`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}/refresh`,pathParams:{"service-token-id":String(e[`service-token-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Creating`,async()=>t.zeroTrust.access.serviceTokens.refresh(e[`service-token-id`],n)),{successLabel:`Created`})}};function Hn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. If not provided, it defaults to the current timestamp in order to immediately expire the previous secret."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Un={command:`rotate <service-token-id>`,describe:`Generates a new Client Secret for a service token and revokes the old one.`,builder:Hn,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access service-tokens rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}/rotate`,pathParams:{"service-token-id":String(e[`service-token-id`]??``)},bodyKind:`json`,body:{"previous-client-secret-expires-at":e[`previous-client-secret-expires-at`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/access/service_tokens/${encodeURIComponent(String(e[`service-token-id`]))}/rotate`,{body:r})),{successLabel:`Created`});return}let a={};e[`previous-client-secret-expires-at`]!==void 0&&s(a,[`previous_client_secret_expires_at`],f(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)),l(await d(`Creating`,async()=>t.post(`/accounts/${n}/access/service_tokens/${encodeURIComponent(String(e[`service-token-id`]))}/rotate`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Created`})}};function Wn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`."}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h)."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Gn={command:`update <service-token-id>`,describe:`Updates a configured service token.`,builder:Wn,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access service-tokens update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``)},bodyKind:`json`,body:{"client-secret-version":e[`client-secret-version`],duration:e.duration,name:e.name,"previous-client-secret-expires-at":e[`previous-client-secret-expires-at`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/service_tokens/${encodeURIComponent(String(e[`service-token-id`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e[`client-secret-version`]!==void 0&&s(a,[`client_secret_version`],e[`client-secret-version`]),e.duration!==void 0&&s(a,[`duration`],f(e.duration,`duration`,`text`)),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),e[`previous-client-secret-expires-at`]!==void 0&&s(a,[`previous_client_secret_expires_at`],f(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/service_tokens/${encodeURIComponent(String(e[`service-token-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},Kn={command:`service-tokens`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Nn).command(Fn).command(Ln).command(zn).command(Vn).command(Un).command(Gn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function qn(e){return e.option(`name`,{type:`string`,description:`The name of the tag`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Jn={command:`create`,describe:`Create a tag`,builder:qn,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access tags create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/tags`,pathParams:{},bodyKind:`json`,body:{name:e.name,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/access/tags`,{body:r})),{successLabel:`Created`});return}let a={};e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),l(await d(`Creating`,async()=>t.post(`/accounts/${n}/access/tags`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Created`})}};function Yn(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Xn={command:`delete <tag-name>`,describe:`Delete a tag`,builder:Yn,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access tags delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/tags/${t[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(t[`tag-name`]))}`,pathParams:{"tag-name":String(t[`tag-name`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.access.tags.delete(a,t[`tag-name`])),{successLabel:`Deleted`})}};function Zn(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qn={command:`get <tag-name>`,describe:`Get a tag`,builder:Zn,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access tags get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/tags/${e[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(e[`tag-name`]))}`,pathParams:{"tag-name":String(e[`tag-name`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.tags.get(n,e[`tag-name`])),{successLabel:`Loaded`})}};function $n(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const er={command:`list`,describe:`List tags`,builder:$n,handler:async e=>{let t={page:e.page,per_page:e[`per-page`]};if(e.dryRun){u({command:`cf zero-trust access tags list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/tags`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.access.tags.list(a,t)),{successLabel:`Loaded`})}};function tr(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`name`,{type:`string`,description:`The name of the tag`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A tag`})}const nr={command:`update <tag-name>`,describe:`Update a tag`,builder:tr,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access tags update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/tags/${e[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(e[`tag-name`]))}`,pathParams:{"tag-name":String(e[`tag-name`]??``)},bodyKind:`json`,body:{name:e.name,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${a}/access/tags/${encodeURIComponent(String(e[`tag-name`]))}`,{body:t})),{successLabel:`Updated`});return}e.name===void 0&&(e.name=await t(`name`,`The name of the tag`));let p={};e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),l(await d(`Updating`,async()=>n.put(`/accounts/${a}/access/tags/${encodeURIComponent(String(e[`tag-name`]))}`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated`})}},rr={command:`tags`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Jn).command(Xn).command(Qn).command(er).command(nr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ir(e){return e.positional(`nonce`,{type:`string`,description:`Nonce`,demandOption:!0}).option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ar={command:`get <nonce>`,describe:`Get an active session for a single user.`,builder:ir,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access users active-sessions get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}/active_sessions/${e.nonce==null?`<nonce>`:encodeURIComponent(String(e.nonce))}`,pathParams:{"user-id":String(e[`user-id`]??``),nonce:String(e.nonce??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.users.activeSessions.get(e[`user-id`],n,e.nonce)),{successLabel:`Loaded`})}};function or(e){return e.option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sr={command:`list`,describe:`Get active sessions for a single user.`,builder:or,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access users active-sessions list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}/active_sessions`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.users.activeSessions.list(e[`user-id`],n)),{successLabel:`Loaded`})}},cr={command:`active-sessions`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(ar).command(sr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function lr(e){return e.option(`email`,{type:`string`,description:`The email of the user.`}).option(`name`,{type:`string`,description:`The name of the user.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ur={command:`create`,describe:`Creates a new user.`,builder:lr,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access users create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/users`,pathParams:{},bodyKind:`json`,body:{email:e.email,name:e.name,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/access/users`,{body:t})),{successLabel:`Created`});return}e.email===void 0&&(e.email=await t(`email`,`The email of the user.`));let p={};e.email!==void 0&&s(p,[`email`],f(e.email,`email`,`text`)),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/access/users`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function dr(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const fr={command:`delete <user-id>`,describe:`Deletes a specific user for an account. This will also revoke any active seats and tokens for the user.`,builder:dr,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust access users delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/users/${t[`user-id`]==null?`<user-id>`:encodeURIComponent(String(t[`user-id`]))}`,pathParams:{"user-id":String(t[`user-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.access.users.delete(t[`user-id`],a)),{successLabel:`Deleted`})}};function pr(e){return e.option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const mr={command:`list`,describe:`Get all failed login attempts for a single user.`,builder:pr,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access users failed-logins list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}/failed_logins`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.users.failedLogins.list(e[`user-id`],n)),{successLabel:`Loaded`})}},hr={command:`failed-logins`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(mr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function gr(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _r={command:`get <user-id>`,describe:`Gets a specific user for an account.`,builder:gr,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access users get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.users.get(e[`user-id`],n)),{successLabel:`Loaded`})}};function vr(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yr={command:`get <user-id>`,describe:`Get last seen identity for a single user.`,builder:vr,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access users last-seen-identity get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}/last_seen_identity`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.access.users.lastSeenIdentity.get(e[`user-id`],n)),{successLabel:`Loaded`})}},br={command:`last-seen-identity`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(yr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function xr(e){return e.option(`name`,{type:`string`,description:`The name of the user.`}).option(`email`,{type:`string`,description:`The email of the user.`}).option(`search`,{type:`string`,description:`Search for users by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sr={command:`list`,describe:`Gets a list of users for an account.`,builder:xr,handler:async e=>{let t={name:e.name,email:e.email,search:e.search,page:e.page,per_page:e[`per-page`]};if(e.dryRun){u({command:`cf zero-trust access users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/users`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.access.users.list(a,t)),{successLabel:`Loaded`})}};function Cr(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`email`,{type:`string`,description:`The email of the user.`}).option(`name`,{type:`string`,description:`The name of the user.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const wr={command:`update <user-id>`,describe:`Updates a specific user's name for an account. Requires the user's current email as confirmation (email cannot be changed).`,builder:Cr,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust access users update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`json`,body:{email:e.email,name:e.name,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${a}/access/users/${encodeURIComponent(String(e[`user-id`]))}`,{body:t})),{successLabel:`Updated`});return}e.email===void 0&&(e.email=await t(`email`,`The email of the user.`)),e.name===void 0&&(e.name=await t(`name`,`The name of the user.`));let p={};e.email!==void 0&&s(p,[`email`],f(e.email,`email`,`text`)),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),l(await d(`Updating`,async()=>n.put(`/accounts/${a}/access/users/${encodeURIComponent(String(e[`user-id`]))}`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated`})}},Tr={command:`users`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(ur).command(fr).command(_r).command(Sr).command(wr).command(cr).command(hr).command(br).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Er={command:`access`,describe:`Operations for access`,builder:e=>e.command(B).command(Re).command(Ye).command(dt).command(St).command(kt).command(Bt).command(an).command(fn).command(bn).command(jn).command(Kn).command(rr).command(Tr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Dr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Or={command:`create <app-id>`,describe:`Generates a new short-lived certificate CA and public key.`,builder:Dr,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust apps ca create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Creating`,async()=>t.zeroTrust.apps.ca.create(e[`app-id`],r)),{successLabel:`Created`})}};function kr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ar={command:`delete <app-id>`,describe:`Deletes a short-lived certificate CA.`,builder:kr,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust apps ca delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/ca`,pathParams:{"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let r=await i(t),a=await n({zone:t.zone},r,{quiet:t.quiet});if(t.zoneId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>r.zeroTrust.apps.ca.delete(t[`app-id`],a)),{successLabel:`Deleted`})}};function jr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Mr={command:`get <app-id>`,describe:`Fetches a short-lived certificate CA and its public key.`,builder:jr,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust apps ca get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.apps.ca.get(e[`app-id`],r)),{successLabel:`Loaded`})}};function Nr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pr={command:`list`,describe:`Lists short-lived certificate CAs and their public keys.`,builder:Nr,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust apps ca list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/ca`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.apps.ca.list(r)),{successLabel:`Loaded`})}},Fr={command:`ca`,describe:`Apps operations`,builder:e=>e.command(Or).command(Ar).command(Mr).command(Pr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ir(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Lr={command:`create`,describe:`Adds a new application to Access.`,builder:Ir,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust apps create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=r,e.body){let n=c(e.body);l(await d(`Creating`,async()=>t.post(`/zones/${e.zoneId}/access/apps`,{body:n})),{successLabel:`Created`});return}l(await d(`Creating`,async()=>t.zeroTrust.apps.create(r)),{successLabel:`Created`})}};function Rr(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const zr={command:`delete <app-id>`,describe:`Deletes an application from Access.`,builder:Rr,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust apps delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}`,pathParams:{"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let r=await i(t),a=await n({zone:t.zone},r,{quiet:t.quiet});if(t.zoneId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>r.zeroTrust.apps.delete(t[`app-id`],a)),{successLabel:`Deleted`})}};function Br(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vr={command:`get <app-id>`,describe:`Fetches information about an Access application.`,builder:Br,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust apps get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.apps.get(e[`app-id`],r)),{successLabel:`Loaded`})}};function Hr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ur={command:`list`,describe:`List all Access Applications in a zone.`,builder:Hr,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust apps list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.apps.list(r)),{successLabel:`Loaded`})}};function Wr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`,default:!1}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy.`,default:!1}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy.`}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Gr={command:`create <app-id>`,describe:`Create a new Access policy for an application.`,builder:Wr,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust apps policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{"approval-required":e[`approval-required`],decision:e.decision,"isolation-required":e[`isolation-required`],name:e.name,precedence:e.precedence,"purpose-justification-prompt":e[`purpose-justification-prompt`],"purpose-justification-required":e[`purpose-justification-required`],body:e.body}});return}let r=await i(e);if(e.zoneId=await n({zone:e.zone},r,{quiet:e.quiet}),e.body){let t=c(e.body);l(await d(`Creating`,async()=>r.post(`/zones/${e.zoneId}/access/apps/${encodeURIComponent(String(e[`app-id`]))}/policies`,{body:t})),{successLabel:`Created`});return}e.decision===void 0&&(e.decision=await a(`decision`,`The action Access will take if a user matches this policy.`,[`allow`,`deny`,`non_identity`,`bypass`])),e.name===void 0&&(e.name=await t(`name`,`The name of the Access policy.`));let o={};e[`approval-required`]!==void 0&&s(o,[`approval_required`],e[`approval-required`]),e.decision!==void 0&&s(o,[`decision`],f(e.decision,`decision`,`text`)),e[`isolation-required`]!==void 0&&s(o,[`isolation_required`],e[`isolation-required`]),e.name!==void 0&&s(o,[`name`],f(e.name,`name`,`text`)),e.precedence!==void 0&&s(o,[`precedence`],e.precedence),e[`purpose-justification-prompt`]!==void 0&&s(o,[`purpose_justification_prompt`],f(e[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`)),e[`purpose-justification-required`]!==void 0&&s(o,[`purpose_justification_required`],e[`purpose-justification-required`]),l(await d(`Creating`,async()=>r.post(`/zones/${e.zoneId}/access/apps/${encodeURIComponent(String(e[`app-id`]))}/policies`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Created`})}};function Kr(e){return e.positional(`policy-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const qr={command:`delete <policy-id>`,describe:`Delete an Access policy.`,builder:Kr,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust apps policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/policies/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}`,pathParams:{"policy-id":String(t[`policy-id`]??``),"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let r=await i(t),a=await n({zone:t.zone},r,{quiet:t.quiet});if(t.zoneId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>r.zeroTrust.apps.policies.delete(t[`policy-id`],t[`app-id`],a)),{successLabel:`Deleted`})}};function Jr(e){return e.positional(`policy-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yr={command:`get <policy-id>`,describe:`Fetches a single Access policy.`,builder:Jr,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust apps policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``),"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.apps.policies.get(e[`policy-id`],e[`app-id`],r)),{successLabel:`Loaded`})}};function Xr(e){return e.option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zr={command:`list`,describe:`Lists Access policies configured for an application.`,builder:Xr,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust apps policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.apps.policies.list(e[`app-id`],r)),{successLabel:`Loaded`})}};function Qr(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $r={command:`update <policy-id>`,describe:`Converts an application-scoped policy to a reusable policy. The policy will no longer be exclusively scoped to the application. Further updates to the policy should go through the /accounts/{account_id}/policies/{uid} endpoint.`,builder:Qr,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust apps policies make reusable update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/make_reusable`,pathParams:{"app-id":String(e[`app-id`]??``),"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Updating`,async()=>t.zeroTrust.apps.policies.make.reusable.update(e[`app-id`],e[`policy-id`],n)),{successLabel:`Updated`})}},ei={command:`reusable`,describe:`Apps operations`,builder:e=>e.command($r).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ti={command:`make`,describe:`Operations for apps.policies.make`,builder:e=>e.command(ei).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ni(e){return e.positional(`policy-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy.`}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy.`}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ri={command:`update <policy-id>`,describe:`Update a configured Access policy.`,builder:ni,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust apps policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``),"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{"approval-required":e[`approval-required`],decision:e.decision,"isolation-required":e[`isolation-required`],name:e.name,precedence:e.precedence,"purpose-justification-prompt":e[`purpose-justification-prompt`],"purpose-justification-required":e[`purpose-justification-required`],body:e.body}});return}let r=await i(e);if(e.zoneId=await n({zone:e.zone},r,{quiet:e.quiet}),e.body){let t=c(e.body);l(await d(`Updating`,async()=>r.put(`/zones/${e.zoneId}/access/apps/${encodeURIComponent(String(e[`app-id`]))}/policies/${encodeURIComponent(String(e[`policy-id`]))}`,{body:t})),{successLabel:`Updated`});return}e.decision===void 0&&(e.decision=await a(`decision`,`The action Access will take if a user matches this policy.`,[`allow`,`deny`,`non_identity`,`bypass`])),e.name===void 0&&(e.name=await t(`name`,`The name of the Access policy.`));let o={};e[`approval-required`]!==void 0&&s(o,[`approval_required`],e[`approval-required`]),e.decision!==void 0&&s(o,[`decision`],f(e.decision,`decision`,`text`)),e[`isolation-required`]!==void 0&&s(o,[`isolation_required`],e[`isolation-required`]),e.name!==void 0&&s(o,[`name`],f(e.name,`name`,`text`)),e.precedence!==void 0&&s(o,[`precedence`],e.precedence),e[`purpose-justification-prompt`]!==void 0&&s(o,[`purpose_justification_prompt`],f(e[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`)),e[`purpose-justification-required`]!==void 0&&s(o,[`purpose_justification_required`],e[`purpose-justification-required`]),l(await d(`Updating`,async()=>r.put(`/zones/${e.zoneId}/access/apps/${encodeURIComponent(String(e[`app-id`]))}/policies/${encodeURIComponent(String(e[`policy-id`]))}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated`})}},ii={command:`policies`,describe:`Apps operations`,builder:e=>e.command(Gr).command(qr).command(Yr).command(Zr).command(ri).command(ti).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ai(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const oi={command:`list`,describe:`Retrieve the statuses of your applications.`,builder:ai,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust apps review status list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/apps/review_status`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.apps.review.status.list(n)),{successLabel:`Loaded`})}};function si(e){return e.option(`approved-apps`,{type:`string`,array:!0,description:`Contains the ids of the approved applications.`}).option(`in-review-apps`,{type:`string`,array:!0,description:`Contains the ids of the applications in review.`}).option(`unapproved-apps`,{type:`string`,array:!0,description:`Contains the ids of the unapproved applications.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ci={command:`update`,describe:`Update the statuses of your applications.`,builder:si,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust apps review status update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/apps/review_status`,pathParams:{},bodyKind:`json`,body:{"approved-apps":e[`approved-apps`],"in-review-apps":e[`in-review-apps`],"unapproved-apps":e[`unapproved-apps`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/gateway/apps/review_status`,{body:r})),{successLabel:`Updated`});return}if(e[`approved-apps`]===void 0)throw Error(`--approved-apps is required (or pass --body with this field set).`);if(e[`in-review-apps`]===void 0)throw Error(`--in-review-apps is required (or pass --body with this field set).`);if(e[`unapproved-apps`]===void 0)throw Error(`--unapproved-apps is required (or pass --body with this field set).`);let a={};e[`approved-apps`]!==void 0&&s(a,[`approved_apps`],e[`approved-apps`]),e[`in-review-apps`]!==void 0&&s(a,[`in_review_apps`],e[`in-review-apps`]),e[`unapproved-apps`]!==void 0&&s(a,[`unapproved_apps`],e[`unapproved-apps`]),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/gateway/apps/review_status`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},li={command:`status`,describe:`Apps operations`,builder:e=>e.command(oi).command(ci).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ui={command:`review`,describe:`Operations for apps.review`,builder:e=>e.command(li).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function di(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const fi={command:`create <app-id>`,describe:`Revokes all tokens issued for an application.`,builder:di,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust apps revoke tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/revoke_tokens`,pathParams:{"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let r=await i(t),a=await n({zone:t.zone},r,{quiet:t.quiet});if(t.zoneId=a,!await e({force:!!t.force,message:`This operation revokes all service tokens for the application.`})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>r.zeroTrust.apps.revoke.tokens.create(t[`app-id`],a)),{successLabel:`Deleted`})}},pi={command:`tokens`,describe:`Apps operations`,builder:e=>e.command(fi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},mi={command:`revoke`,describe:`Operations for apps.revoke`,builder:e=>e.command(pi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function hi(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const gi={command:`edit <app-id>`,describe:`Updates application settings.`,builder:hi,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust apps settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/settings`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{"allow-iframe":e[`allow-iframe`],"skip-interstitial":e[`skip-interstitial`],body:e.body}});return}let t=await i(e);if(e.zoneId=await n({zone:e.zone},t,{quiet:e.quiet}),e.body){let n=c(e.body);l(await d(`Updating`,async()=>t.patch(`/zones/${e.zoneId}/access/apps/${encodeURIComponent(String(e[`app-id`]))}/settings`,{body:n})),{successLabel:`Updated`});return}let r={};e[`allow-iframe`]!==void 0&&s(r,[`allow_iframe`],e[`allow-iframe`]),e[`skip-interstitial`]!==void 0&&s(r,[`skip_interstitial`],e[`skip-interstitial`]),l(await d(`Updating`,async()=>t.patch(`/zones/${e.zoneId}/access/apps/${encodeURIComponent(String(e[`app-id`]))}/settings`,{body:Object.keys(r).length>0?r:void 0})),{successLabel:`Updated`})}};function _i(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const vi={command:`update <app-id>`,describe:`Updates application settings.`,builder:_i,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust apps settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/settings`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{"allow-iframe":e[`allow-iframe`],"skip-interstitial":e[`skip-interstitial`],body:e.body}});return}let t=await i(e);if(e.zoneId=await n({zone:e.zone},t,{quiet:e.quiet}),e.body){let n=c(e.body);l(await d(`Updating`,async()=>t.put(`/zones/${e.zoneId}/access/apps/${encodeURIComponent(String(e[`app-id`]))}/settings`,{body:n})),{successLabel:`Updated`});return}let r={};e[`allow-iframe`]!==void 0&&s(r,[`allow_iframe`],e[`allow-iframe`]),e[`skip-interstitial`]!==void 0&&s(r,[`skip_interstitial`],e[`skip-interstitial`]),l(await d(`Updating`,async()=>t.put(`/zones/${e.zoneId}/access/apps/${encodeURIComponent(String(e[`app-id`]))}/settings`,{body:Object.keys(r).length>0?r:void 0})),{successLabel:`Updated`})}},yi={command:`settings`,describe:`Apps operations`,builder:e=>e.command(gi).command(vi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bi(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xi={command:`update <app-id>`,describe:`Updates an Access application.`,builder:bi,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust apps update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=r,e.body){let n=c(e.body);l(await d(`Updating`,async()=>t.put(`/zones/${e.zoneId}/access/apps/${encodeURIComponent(String(e[`app-id`]))}`,{body:n})),{successLabel:`Updated`});return}l(await d(`Updating`,async()=>t.zeroTrust.apps.update(e[`app-id`],r)),{successLabel:`Updated`})}};function Si(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ci={command:`get <app-id>`,describe:`Tests if a specific user has permission to access an application.`,builder:Si,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust apps user policy checks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/user_policy_checks`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.apps.user.policy.checks.get(e[`app-id`],r)),{successLabel:`Loaded`})}},wi={command:`checks`,describe:`Apps operations`,builder:e=>e.command(Ci).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ti={command:`policy`,describe:`Operations for apps.user.policy`,builder:e=>e.command(wi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ei={command:`user`,describe:`Operations for apps.user`,builder:e=>e.command(Ti).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Di={command:`apps`,describe:`Apps operations`,builder:e=>e.command(Lr).command(zr).command(Vr).command(Ur).command(xi).command(Fr).command(ii).command(ui).command(mi).command(yi).command(Ei).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Oi(e){return e.option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`certificate`,{type:`string`,description:`The certificate content.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ki={command:`create`,describe:`Adds a new mTLS root certificate to Access.`,builder:Oi,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{"associated-hostnames":e[`associated-hostnames`],certificate:e.certificate,name:e.name,body:e.body}});return}let r=await i(e);if(e.zoneId=await n({zone:e.zone},r,{quiet:e.quiet}),e.body){let t=c(e.body);l(await d(`Creating`,async()=>r.post(`/zones/${e.zoneId}/access/certificates`,{body:t})),{successLabel:`Created`});return}e.certificate===void 0&&(e.certificate=await t(`certificate`,`The certificate content.`)),e.name===void 0&&(e.name=await t(`name`,`The name of the certificate.`));let a={};e[`associated-hostnames`]!==void 0&&s(a,[`associated_hostnames`],e[`associated-hostnames`]),e.certificate!==void 0&&s(a,[`certificate`],f(e.certificate,`certificate`,`text`)),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),l(await d(`Creating`,async()=>r.post(`/zones/${e.zoneId}/access/certificates`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Created`})}};function Ai(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ji={command:`delete <certificate-id>`,describe:`Deletes an mTLS certificate.`,builder:Ai,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/certificates/${t[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(t[`certificate-id`]))}`,pathParams:{"certificate-id":String(t[`certificate-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let r=await i(t),a=await n({zone:t.zone},r,{quiet:t.quiet});if(t.zoneId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>r.zeroTrust.certificates.delete(t[`certificate-id`],a)),{successLabel:`Deleted`})}};function Mi(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ni={command:`get <certificate-id>`,describe:`Fetches a single mTLS certificate.`,builder:Mi,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.certificates.get(e[`certificate-id`],r)),{successLabel:`Loaded`})}};function Pi(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fi={command:`list`,describe:`Lists all mTLS certificates.`,builder:Pi,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.certificates.list(r)),{successLabel:`Loaded`})}};function Ii(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Li={command:`list`,describe:`List all mTLS hostname settings for this zone.`,builder:Ii,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust certificates settings list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/settings`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.certificates.settings.list(r)),{successLabel:`Loaded`})}};function Ri(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const zi={command:`update`,describe:`Updates an mTLS certificate's hostname settings.`,builder:Ri,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust certificates settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/settings`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=r,e.body){let n=c(e.body);l(await d(`Updating`,async()=>t.put(`/zones/${e.zoneId}/access/certificates/settings`,{body:n})),{successLabel:`Updated`});return}l(await d(`Updating`,async()=>t.zeroTrust.certificates.settings.update(r)),{successLabel:`Updated`})}},Bi={command:`settings`,describe:`Certificates operations`,builder:e=>e.command(Li).command(zi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Vi(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Hi={command:`update <certificate-id>`,describe:`Updates a configured mTLS certificate.`,builder:Vi,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust certificates update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{"associated-hostnames":e[`associated-hostnames`],name:e.name,body:e.body}});return}let t=await i(e);if(e.zoneId=await n({zone:e.zone},t,{quiet:e.quiet}),e.body){let n=c(e.body);l(await d(`Updating`,async()=>t.put(`/zones/${e.zoneId}/access/certificates/${encodeURIComponent(String(e[`certificate-id`]))}`,{body:n})),{successLabel:`Updated`});return}if(e[`associated-hostnames`]===void 0)throw Error(`--associated-hostnames is required (or pass --body with this field set).`);let r={};e[`associated-hostnames`]!==void 0&&s(r,[`associated_hostnames`],e[`associated-hostnames`]),e.name!==void 0&&s(r,[`name`],f(e.name,`name`,`text`)),l(await d(`Updating`,async()=>t.put(`/zones/${e.zoneId}/access/certificates/${encodeURIComponent(String(e[`certificate-id`]))}`,{body:Object.keys(r).length>0?r:void 0})),{successLabel:`Updated`})}},Ui={command:`certificates`,describe:`Certificates operations`,builder:e=>e.command(ki).command(ji).command(Ni).command(Fi).command(Hi).command(Bi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Wi(e){return e.option(`icmp-proxy-enabled`,{type:`boolean`,description:`A flag to enable the ICMP proxy for the account network.`}).option(`offramp-warp-enabled`,{type:`boolean`,description:`A flag to enable WARP to WARP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Gi={command:`edit`,describe:`Updates the Zero Trust Connectivity Settings for the given account.`,builder:Wi,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust connectivity-settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zerotrust/connectivity_settings`,pathParams:{},bodyKind:`json`,body:{"icmp-proxy-enabled":e[`icmp-proxy-enabled`],"offramp-warp-enabled":e[`offramp-warp-enabled`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/zerotrust/connectivity_settings`,{body:r})),{successLabel:`Updated`});return}let a={};e[`icmp-proxy-enabled`]!==void 0&&s(a,[`icmp_proxy_enabled`],e[`icmp-proxy-enabled`]),e[`offramp-warp-enabled`]!==void 0&&s(a,[`offramp_warp_enabled`],e[`offramp-warp-enabled`]),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/zerotrust/connectivity_settings`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}};function Ki(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qi={command:`get`,describe:`Gets the Zero Trust Connectivity Settings for the given account.`,builder:Ki,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust connectivity-settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zerotrust/connectivity_settings`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.connectivitySettings.get(n)),{successLabel:`Loaded`})}},Ji={command:`connectivity-settings`,describe:`Account-level connectivity defaults for WARP, IPv6, and ICMP proxy behavior`,builder:e=>e.command(Gi).command(qi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Yi(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xi={command:`list`,describe:`Retrieves a list of all available target environments with their display names. This endpoint is in Beta.`,builder:Yi,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices client target environments list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/client-versions/target-environments`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.client.target.environments.list(n)),{successLabel:`Loaded`})}},Zi={command:`environments`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Xi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Qi={command:`target`,describe:`Operations for devices.client.target`,builder:e=>e.command(Zi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $i(e){return e.option(`target-environment`,{type:`string`,description:`The target environment for the client version (e.g., windows, macos).`,demandOption:!0}).option(`release-track`,{type:`string`,description:`The release track (ga for General Availability, beta for Beta releases).`,choices:[`ga`,`beta`],demandOption:!0}).option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The maximum number of versions to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ea={command:`list`,describe:`Lists available WARP client versions for a specific target environment and release track. This endpoint is in Beta.`,builder:$i,handler:async e=>{let t={target_environment:e[`target-environment`],release_track:e[`release-track`],page:e.page,per_page:e[`per-page`]};if(e.dryRun){u({command:`cf zero-trust devices client versions list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/client-versions`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.devices.client.versions.list(a,t)),{successLabel:`Loaded`})}},ta={command:`versions`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(ea).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},na={command:`client`,describe:`Operations for devices.client`,builder:e=>e.command(Qi).command(ta).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ra(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for the deployment group.`}).option(`policy-ids`,{type:`string`,array:!0,description:`Contains an optional list of policy IDs assigned to a group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ia={command:`create`,describe:`Creates a new deployment group. Policy IDs must be unique across all deployment groups. This endpoint is in Beta.`,builder:ra,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices deployment groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/deployment-groups`,pathParams:{},bodyKind:`json`,body:{name:e.name,"policy-ids":e[`policy-ids`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/devices/deployment-groups`,{body:t})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await t(`name`,`A user-friendly name for the deployment group.`));let p={};e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),e[`policy-ids`]!==void 0&&s(p,[`policy_ids`],e[`policy-ids`]),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/devices/deployment-groups`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function aa(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const oa={command:`delete <group-id>`,describe:`Deletes a deployment group. Associated policies no longer apply and devices stop receiving version targets. This endpoint is in Beta.`,builder:aa,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust devices deployment groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/deployment-groups/${t[`group-id`]==null?`<group-id>`:encodeURIComponent(String(t[`group-id`]))}`,pathParams:{"group-id":String(t[`group-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.devices.deployment.groups.delete(a,t[`group-id`])),{successLabel:`Deleted`})}};function sa(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ca={command:`get <group-id>`,describe:`Fetches a single deployment group by its ID. This endpoint is in Beta.`,builder:sa,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices deployment groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/deployment-groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.deployment.groups.get(n,e[`group-id`])),{successLabel:`Loaded`})}};function la(e){return e.option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The maximum number of deployment groups to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ua={command:`list`,describe:`Lists all deployment groups for an account. Use deployment groups to assign target WARP client versions to specific devices. This endpoint is in Beta.`,builder:la,handler:async e=>{let t={page:e.page,per_page:e[`per-page`]};if(e.dryRun){u({command:`cf zero-trust devices deployment groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/deployment-groups`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.devices.deployment.groups.list(a,t)),{successLabel:`Loaded`})}};function da(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for the deployment group.`}).option(`policy-ids`,{type:`string`,array:!0,description:`Replaces the entire list of policy IDs.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const fa={command:`update <group-id>`,describe:`Updates a deployment group. Returns 409 if any newly added policy IDs already belong to another deployment group. This endpoint is in Beta.`,builder:da,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices deployment groups update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/deployment-groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``)},bodyKind:`json`,body:{name:e.name,"policy-ids":e[`policy-ids`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/devices/deployment-groups/${encodeURIComponent(String(e[`group-id`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),e[`policy-ids`]!==void 0&&s(a,[`policy_ids`],e[`policy-ids`]),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/devices/deployment-groups/${encodeURIComponent(String(e[`group-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},pa={command:`groups`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(ia).command(oa).command(ca).command(ua).command(fa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ma={command:`deployment`,describe:`Operations for devices.deployment`,builder:e=>e.command(pa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ha(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ga={command:`delete <device-id>`,describe:`Deletes a WARP device.`,builder:ha,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust devices devices delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/physical-devices/${t[`device-id`]==null?`<device-id>`:encodeURIComponent(String(t[`device-id`]))}`,pathParams:{"device-id":String(t[`device-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.devices.devices.delete(t[`device-id`],a)),{successLabel:`Deleted`})}};function _a(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the device response. Supported values are: "last_seen_registration.policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const va={command:`get <device-id>`,describe:`Fetches a single WARP device.`,builder:_a,handler:async e=>{let t={include:e.include};if(e.dryRun){u({command:`cf zero-trust devices devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/physical-devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}`,pathParams:{"device-id":String(e[`device-id`]??``)},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.devices.devices.get(e[`device-id`],a,t)),{successLabel:`Loaded`})}};function ya(e){return e.option(`cursor`,{type:`string`,description:`Opaque token indicating the starting position when requesting the next set of records. A cursor value can be obtained from the result_info.cursor field in the response.`}).option(`sort-by`,{type:`string`,description:`The device field to order results by.`,choices:[`name`,`id`,`client_version`,`last_seen_user.email`,`last_seen_at`,`active_registrations`,`created_at`]}).option(`sort-order`,{type:`string`,description:`Sort direction.`,choices:[`asc`,`desc`]}).option(`last-seen-user-email`,{type:`string`,description:`Filter by the last seen user's email.`}).option(`seen-after`,{type:`string`,description:`Filter by the last_seen timestamp - returns only devices last seen after this timestamp.`}).option(`seen-before`,{type:`string`,description:`Filter by the last_seen timestamp - returns only devices last seen before this timestamp.`}).option(`per-page`,{type:`number`,description:`The maximum number of devices to return in a single response.`}).option(`search`,{type:`string`,description:`Search by device details.`}).option(`active-registrations`,{type:`string`,description:`Include or exclude devices with active registrations. The default is "only" - return only devices with active registrations.`,choices:[`include`,`only`,`exclude`]}).option(`id`,{type:`string`,description:`Filter by a one or more device IDs.`}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the device response. Supported values are: "last_seen_registration.policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ba={command:`list`,describe:`Lists WARP devices.`,builder:ya,handler:async e=>{let t={cursor:e.cursor,sort_by:e[`sort-by`],sort_order:e[`sort-order`],"last_seen_user.email":e[`last-seen-user-email`],seen_after:e[`seen-after`],seen_before:e[`seen-before`],per_page:e[`per-page`],search:e.search,active_registrations:e[`active-registrations`],id:e.id,include:e.include};if(e.dryRun){u({command:`cf zero-trust devices devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/physical-devices`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.devices.devices.list(a,t)),{successLabel:`Loaded`})}};function xa(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Sa={command:`revoke <device-id>`,describe:`Revokes all WARP registrations associated with the specified device.`,builder:xa,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust devices devices revoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/physical-devices/${t[`device-id`]==null?`<device-id>`:encodeURIComponent(String(t[`device-id`]))}/revoke`,pathParams:{"device-id":String(t[`device-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force,message:`This operation revokes a device's session destructively.`})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.devices.devices.revoke(a,t[`device-id`])),{successLabel:`Deleted`})}},Ca={command:`devices`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(ga).command(va).command(ba).command(Sa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function wa(e){return e.option(`data-host`,{type:`string`,description:`The desired endpoint to test.`}).option(`data-kind`,{type:`string`,description:`The type of test.`,choices:[`http`,`traceroute`]}).option(`data-method`,{type:`string`,description:`The HTTP request method type.`,choices:[`GET`]}).option(`description`,{type:`string`,description:`Additional details about the test.`}).option(`enabled`,{type:`boolean`,description:`Determines whether or not the test is active.`}).option(`interval`,{type:`string`,description:`How often the test will run.`}).option(`name`,{type:`string`,description:`The name of the DEX test. Must be unique.`}).option(`targeted`,{type:`boolean`,description:`The targeted field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ta={command:`create`,describe:`Create a DEX test.`,builder:wa,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices dex-tests create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/devices/dex_tests`,pathParams:{},bodyKind:`json`,body:{"data-host":e[`data-host`],"data-kind":e[`data-kind`],"data-method":e[`data-method`],description:e.description,enabled:e.enabled,interval:e.interval,name:e.name,targeted:e.targeted,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${p}/dex/devices/dex_tests`,{body:t})),{successLabel:`Created`});return}if(e[`data-host`]===void 0&&(e[`data-host`]=await t(`data-host`,`The desired endpoint to test.`)),e[`data-kind`]===void 0&&(e[`data-kind`]=await a(`data-kind`,`The type of test.`,[`http`,`traceroute`])),e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);e.interval===void 0&&(e.interval=await t(`interval`,`How often the test will run.`)),e.name===void 0&&(e.name=await t(`name`,`The name of the DEX test. Must be unique.`));let h={};e[`data-host`]!==void 0&&s(h,[`data`,`host`],f(e[`data-host`],`data-host`,`text`)),e[`data-kind`]!==void 0&&s(h,[`data`,`kind`],f(e[`data-kind`],`data-kind`,`text`)),e[`data-method`]!==void 0&&s(h,[`data`,`method`],f(e[`data-method`],`data-method`,`text`)),e.description!==void 0&&s(h,[`description`],f(e.description,`description`,`text`)),e.enabled!==void 0&&s(h,[`enabled`],e.enabled),e.interval!==void 0&&s(h,[`interval`],f(e.interval,`interval`,`text`)),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),e.targeted!==void 0&&s(h,[`targeted`],e.targeted),l(await d(`Creating`,async()=>n.post(`/accounts/${p}/dex/devices/dex_tests`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created`})}};function Ea(e){return e.positional(`dex-test-id`,{type:`string`,description:`API Resource UUID tag.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Da={command:`delete <dex-test-id>`,describe:`Delete a Device DEX test. Returns the remaining device dex tests for the account.`,builder:Ea,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust devices dex-tests delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/devices/dex_tests/${t[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(t[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(t[`dex-test-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.devices.dexTests.delete(a,t[`dex-test-id`])),{successLabel:`Deleted`})}};function Oa(e){return e.positional(`dex-test-id`,{type:`string`,description:`The unique identifier for the test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ka={command:`get <dex-test-id>`,describe:`Fetch a single DEX test.`,builder:Oa,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices dex-tests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/devices/dex_tests/${e[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(e[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(e[`dex-test-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.dexTests.get(n,e[`dex-test-id`])),{successLabel:`Loaded`})}};function Aa(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results`}).option(`per-page`,{type:`number`,description:`Number of items per page`}).option(`test-name`,{type:`string`,description:`Filter by test name`}).option(`kind`,{type:`string`,description:`Filter by test type`,choices:[`http`,`traceroute`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ja={command:`list`,describe:`Fetch all DEX tests`,builder:Aa,handler:async e=>{let t={page:e.page,per_page:e[`per-page`],testName:e[`test-name`],kind:e.kind};if(e.dryRun){u({command:`cf zero-trust devices dex-tests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/devices/dex_tests`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.devices.dexTests.list(a,t)),{successLabel:`Loaded`})}};function Ma(e){return e.positional(`dex-test-id`,{type:`string`,description:`API Resource UUID tag.`,demandOption:!0}).option(`data-host`,{type:`string`,description:`The desired endpoint to test.`}).option(`data-kind`,{type:`string`,description:`The type of test.`,choices:[`http`,`traceroute`]}).option(`data-method`,{type:`string`,description:`The HTTP request method type.`,choices:[`GET`]}).option(`description`,{type:`string`,description:`Additional details about the test.`}).option(`enabled`,{type:`boolean`,description:`Determines whether or not the test is active.`}).option(`interval`,{type:`string`,description:`How often the test will run.`}).option(`name`,{type:`string`,description:`The name of the DEX test. Must be unique.`}).option(`targeted`,{type:`boolean`,description:`The targeted field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Na={command:`update <dex-test-id>`,describe:`Update a DEX test.`,builder:Ma,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices dex-tests update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/devices/dex_tests/${e[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(e[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(e[`dex-test-id`]??``)},bodyKind:`json`,body:{"data-host":e[`data-host`],"data-kind":e[`data-kind`],"data-method":e[`data-method`],description:e.description,enabled:e.enabled,interval:e.interval,name:e.name,targeted:e.targeted,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${p}/dex/devices/dex_tests/${encodeURIComponent(String(e[`dex-test-id`]))}`,{body:t})),{successLabel:`Updated`});return}if(e[`data-host`]===void 0&&(e[`data-host`]=await t(`data-host`,`The desired endpoint to test.`)),e[`data-kind`]===void 0&&(e[`data-kind`]=await a(`data-kind`,`The type of test.`,[`http`,`traceroute`])),e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);e.interval===void 0&&(e.interval=await t(`interval`,`How often the test will run.`)),e.name===void 0&&(e.name=await t(`name`,`The name of the DEX test. Must be unique.`));let h={};e[`data-host`]!==void 0&&s(h,[`data`,`host`],f(e[`data-host`],`data-host`,`text`)),e[`data-kind`]!==void 0&&s(h,[`data`,`kind`],f(e[`data-kind`],`data-kind`,`text`)),e[`data-method`]!==void 0&&s(h,[`data`,`method`],f(e[`data-method`],`data-method`,`text`)),e.description!==void 0&&s(h,[`description`],f(e.description,`description`,`text`)),e.enabled!==void 0&&s(h,[`enabled`],e.enabled),e.interval!==void 0&&s(h,[`interval`],f(e.interval,`interval`,`text`)),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),e.targeted!==void 0&&s(h,[`targeted`],e.targeted),l(await d(`Updating`,async()=>n.put(`/accounts/${p}/dex/devices/dex_tests/${encodeURIComponent(String(e[`dex-test-id`]))}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated`})}},Pa={command:`dex-tests`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Ta).command(Da).command(ka).command(ja).command(Na).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Fa(e){return e.positional(`device-id`,{type:`string`,description:`Unique identifier for device`,demandOption:!0}).option(`since-minutes`,{type:`string`,description:`Number of minutes before current time`,demandOption:!0}).option(`time-now`,{type:`string`,description:`Number of minutes before current time`}).option(`colo`,{type:`string`,description:`List of data centers to filter results`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ia={command:`get <device-id>`,describe:`Get the live status of a latest device given device_id from the device_state table`,builder:Fa,handler:async e=>{let t={since_minutes:e[`since-minutes`],time_now:e[`time-now`],colo:e.colo};if(e.dryRun){u({command:`cf zero-trust devices fleet-status get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}/fleet-status/live`,pathParams:{"device-id":String(e[`device-id`]??``)},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.devices.fleetStatus.get(a,e[`device-id`],t)),{successLabel:`Loaded`})}},La={command:`fleet-status`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Ia).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ra(e){return e.positional(`device-id`,{type:`string`,description:`Registration ID. Equal to Device ID except for accounts which enabled [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/).`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const za={command:`get <device-id>`,describe:`Fetches a single WARP device. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices/{device_id} - GET /accounts/{account_id}/devices/registrations/{registration_id}`,builder:Ra,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}`,pathParams:{"device-id":String(e[`device-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.get(e[`device-id`],n)),{successLabel:`Loaded`})}};function Ba(e){return e.option(`description`,{type:`string`,description:`An optional description of the Device IP profile.`}).option(`enabled`,{type:`boolean`,description:`Whether the Device IP profile will be applied to matching devices.`,default:!0}).option(`match`,{type:`string`,description:`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`}).option(`name`,{type:`string`,description:`A user-friendly name for the Device IP profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.`}).option(`subnet-id`,{type:`string`,description:`The ID of the Subnet.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Va={command:`create`,describe:`Creates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.`,builder:Ba,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices ip-profiles create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/ip-profiles`,pathParams:{},bodyKind:`json`,body:{description:e.description,enabled:e.enabled,match:e.match,name:e.name,precedence:e.precedence,"subnet-id":e[`subnet-id`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/devices/ip-profiles`,{body:t})),{successLabel:`Created`});return}if(e.match===void 0&&(e.match=await t(`match`,`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`)),e.name===void 0&&(e.name=await t(`name`,`A user-friendly name for the Device IP profile.`)),e.precedence===void 0)throw Error(`--precedence is required (or pass --body with this field set).`);e[`subnet-id`]===void 0&&(e[`subnet-id`]=await t(`subnet-id`,`The ID of the Subnet.`));let p={};e.description!==void 0&&s(p,[`description`],f(e.description,`description`,`text`)),e.enabled!==void 0&&s(p,[`enabled`],e.enabled),e.match!==void 0&&s(p,[`match`],f(e.match,`match`,`text`)),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),e.precedence!==void 0&&s(p,[`precedence`],e.precedence),e[`subnet-id`]!==void 0&&s(p,[`subnet_id`],f(e[`subnet-id`],`subnet-id`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/devices/ip-profiles`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function Ha(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ua={command:`delete <profile-id>`,describe:`Delete a WARP Device IP profile.`,builder:Ha,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust devices ip-profiles delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/ip-profiles/${t[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(t[`profile-id`]))}`,pathParams:{"profile-id":String(t[`profile-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.devices.ipProfiles.delete(a,t[`profile-id`])),{successLabel:`Deleted`})}};function Wa(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ga={command:`get <profile-id>`,describe:`Fetches a single WARP Device IP profile.`,builder:Wa,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices ip-profiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/ip-profiles/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.ipProfiles.get(n,e[`profile-id`])),{successLabel:`Loaded`})}};function Ka(e){return e.option(`per-page`,{type:`number`,description:`The number of IP profiles to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qa={command:`list`,describe:`Lists WARP Device IP profiles.`,builder:Ka,handler:async e=>{let t={per_page:e[`per-page`]};if(e.dryRun){u({command:`cf zero-trust devices ip-profiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/ip-profiles`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.devices.ipProfiles.list(a,t)),{successLabel:`Loaded`})}};function Ja(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`description`,{type:`string`,description:`An optional description of the Device IP profile.`}).option(`enabled`,{type:`boolean`,description:`Whether the Device IP profile is enabled.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`}).option(`name`,{type:`string`,description:`A user-friendly name for the Device IP profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.`}).option(`subnet-id`,{type:`string`,description:`The ID of the Subnet.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ya={command:`update <profile-id>`,describe:`Updates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.`,builder:Ja,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices ip-profiles update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/ip-profiles/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`json`,body:{description:e.description,enabled:e.enabled,match:e.match,name:e.name,precedence:e.precedence,"subnet-id":e[`subnet-id`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/devices/ip-profiles/${encodeURIComponent(String(e[`profile-id`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e.description!==void 0&&s(a,[`description`],f(e.description,`description`,`text`)),e.enabled!==void 0&&s(a,[`enabled`],e.enabled),e.match!==void 0&&s(a,[`match`],f(e.match,`match`,`text`)),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),e.precedence!==void 0&&s(a,[`precedence`],e.precedence),e[`subnet-id`]!==void 0&&s(a,[`subnet_id`],f(e[`subnet-id`],`subnet-id`,`text`)),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/devices/ip-profiles/${encodeURIComponent(String(e[`profile-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},Xa={command:`ip-profiles`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Va).command(Ua).command(Ga).command(qa).command(Ya).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Za(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qa={command:`list`,describe:`List WARP devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices - GET /accounts/{account_id}/devices/registrations`,builder:Za,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.list(n)),{successLabel:`Loaded`})}};function $a(e){return e.option(`config-sha256`,{type:`string`,description:`The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.`}).option(`config-tls-sockaddr`,{type:`string`,description:`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`}).option(`name`,{type:`string`,description:`The name of the device managed network. This name must be unique.`}).option(`type`,{type:`string`,description:`The type of device managed network.`,choices:[`tls`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const eo={command:`create`,describe:`Creates a new device managed network.`,builder:$a,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/networks`,pathParams:{},bodyKind:`json`,body:{"config-sha256":e[`config-sha256`],"config-tls-sockaddr":e[`config-tls-sockaddr`],name:e.name,type:e.type,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${p}/devices/networks`,{body:t})),{successLabel:`Created`});return}e[`config-tls-sockaddr`]===void 0&&(e[`config-tls-sockaddr`]=await t(`config-tls-sockaddr`,`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`)),e.name===void 0&&(e.name=await t(`name`,`The name of the device managed network. This name must be unique.`)),e.type===void 0&&(e.type=await a(`type`,`The type of device managed network.`,[`tls`]));let h={};e[`config-sha256`]!==void 0&&s(h,[`config`,`sha256`],f(e[`config-sha256`],`config-sha256`,`text`)),e[`config-tls-sockaddr`]!==void 0&&s(h,[`config`,`tls_sockaddr`],f(e[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),e.type!==void 0&&s(h,[`type`],f(e.type,`type`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${p}/devices/networks`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created`})}};function to(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const no={command:`delete <network-id>`,describe:`Deletes a device managed network and fetches a list of the remaining device managed networks for an account.`,builder:to,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust devices networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/networks/${t[`network-id`]==null?`<network-id>`:encodeURIComponent(String(t[`network-id`]))}`,pathParams:{"network-id":String(t[`network-id`]??``)},bodyKind:`json`,body:{body:t.body}});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body);l(await d(`Deleting`,async()=>n.delete(`/accounts/${a}/devices/networks/${encodeURIComponent(String(t[`network-id`]))}`,{body:e})),{successLabel:`Deleted`});return}l(await d(`Deleting`,async()=>n.zeroTrust.devices.networks.delete(t[`network-id`],a)),{successLabel:`Deleted`})}};function ro(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const io={command:`get <network-id>`,describe:`Fetches details for a single managed network.`,builder:ro,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices networks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/networks/${e[`network-id`]==null?`<network-id>`:encodeURIComponent(String(e[`network-id`]))}`,pathParams:{"network-id":String(e[`network-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.networks.get(e[`network-id`],n)),{successLabel:`Loaded`})}};function ao(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const oo={command:`list`,describe:`Fetches a list of managed networks for an account.`,builder:ao,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices networks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/networks`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.networks.list(n)),{successLabel:`Loaded`})}};function so(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`config-sha256`,{type:`string`,description:`The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.`}).option(`config-tls-sockaddr`,{type:`string`,description:`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`}).option(`name`,{type:`string`,description:`The name of the device managed network. This name must be unique.`}).option(`type`,{type:`string`,description:`The type of device managed network.`,choices:[`tls`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`config-sha256`,`config-tls-sockaddr`].some(t=>e[t]!==void 0)){let t=[`config-tls-sockaddr`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --config-* flag is set`)}return!0})}const co={command:`update <network-id>`,describe:`Updates a configured device managed network.`,builder:so,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices networks update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/networks/${e[`network-id`]==null?`<network-id>`:encodeURIComponent(String(e[`network-id`]))}`,pathParams:{"network-id":String(e[`network-id`]??``)},bodyKind:`json`,body:{"config-sha256":e[`config-sha256`],"config-tls-sockaddr":e[`config-tls-sockaddr`],name:e.name,type:e.type,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/devices/networks/${encodeURIComponent(String(e[`network-id`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e[`config-sha256`]!==void 0&&s(a,[`config`,`sha256`],f(e[`config-sha256`],`config-sha256`,`text`)),e[`config-tls-sockaddr`]!==void 0&&s(a,[`config`,`tls_sockaddr`],f(e[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),e.type!==void 0&&s(a,[`type`],f(e.type,`type`,`text`)),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/devices/networks/${encodeURIComponent(String(e[`network-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},lo={command:`networks`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(eo).command(no).command(io).command(oo).command(co).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function uo(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fo={command:`get <registration-id>`,describe:`Fetches one-time use admin override codes for a registration. This relies on the **Admin Override** setting being enabled in your device configuration.`,builder:uo,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices override-codes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/registrations/${e[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(e[`registration-id`]))}/override_codes`,pathParams:{"registration-id":String(e[`registration-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.overrideCodes.get(n,e[`registration-id`])),{successLabel:`Loaded`})}};function po(e){return e.option(`device-id`,{type:`string`,description:`Registration ID. Equal to Device ID except for accounts which enabled [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/).`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const mo={command:`list`,describe:`Fetches a one-time use admin override code for a device. This relies on the **Admin Override** setting being enabled in your device configuration. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated:** please use GET /accounts/{account_id}/devices/registrations/{registration_id}/override_codes instead.`,builder:po,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices override-codes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}/override_codes`,pathParams:{"device-id":String(e[`device-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.overrideCodes.list(e[`device-id`],n)),{successLabel:`Loaded`})}},ho={command:`override-codes`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(fo).command(mo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function go(e){return e.option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`,default:!1}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`,default:!1}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`,default:!0}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`,default:0}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`,default:180}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`.",default:!1}).option(`enabled`,{type:`boolean`,description:`Whether the policy will be applied to matching devices.`,default:!0}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`,default:!1}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`}).option(`name`,{type:`string`,description:`The name of the device settings profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`,default:!0}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`,default:!1}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`,default:``}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`,default:!1}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`,default:``}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _o={command:`create`,describe:`Creates a device settings profile to be applied to certain devices matching the criteria.`,builder:go,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`json`,body:{"allow-mode-switch":e[`allow-mode-switch`],"allow-updates":e[`allow-updates`],"allowed-to-leave":e[`allowed-to-leave`],"auto-connect":e[`auto-connect`],"captive-portal":e[`captive-portal`],"disable-auto-fallback":e[`disable-auto-fallback`],enabled:e.enabled,"exclude-office-ips":e[`exclude-office-ips`],"lan-allow-minutes":e[`lan-allow-minutes`],"lan-allow-subnet-size":e[`lan-allow-subnet-size`],match:e.match,name:e.name,precedence:e.precedence,"register-interface-ip-with-dns":e[`register-interface-ip-with-dns`],"sccm-vpn-boundary-support":e[`sccm-vpn-boundary-support`],"service-mode-v2-mode":e[`service-mode-v2-mode`],"service-mode-v2-port":e[`service-mode-v2-port`],"support-url":e[`support-url`],"switch-locked":e[`switch-locked`],"tunnel-protocol":e[`tunnel-protocol`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/devices/policy`,{body:t})),{successLabel:`Created`});return}if(e.match===void 0&&(e.match=await t(`match`,`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`)),e.name===void 0&&(e.name=await t(`name`,`The name of the device settings profile.`)),e.precedence===void 0)throw Error(`--precedence is required (or pass --body with this field set).`);let p={};e[`allow-mode-switch`]!==void 0&&s(p,[`allow_mode_switch`],e[`allow-mode-switch`]),e[`allow-updates`]!==void 0&&s(p,[`allow_updates`],e[`allow-updates`]),e[`allowed-to-leave`]!==void 0&&s(p,[`allowed_to_leave`],e[`allowed-to-leave`]),e[`auto-connect`]!==void 0&&s(p,[`auto_connect`],e[`auto-connect`]),e[`captive-portal`]!==void 0&&s(p,[`captive_portal`],e[`captive-portal`]),e[`disable-auto-fallback`]!==void 0&&s(p,[`disable_auto_fallback`],e[`disable-auto-fallback`]),e.enabled!==void 0&&s(p,[`enabled`],e.enabled),e[`exclude-office-ips`]!==void 0&&s(p,[`exclude_office_ips`],e[`exclude-office-ips`]),e[`lan-allow-minutes`]!==void 0&&s(p,[`lan_allow_minutes`],e[`lan-allow-minutes`]),e[`lan-allow-subnet-size`]!==void 0&&s(p,[`lan_allow_subnet_size`],e[`lan-allow-subnet-size`]),e.match!==void 0&&s(p,[`match`],f(e.match,`match`,`text`)),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),e.precedence!==void 0&&s(p,[`precedence`],e.precedence),e[`register-interface-ip-with-dns`]!==void 0&&s(p,[`register_interface_ip_with_dns`],e[`register-interface-ip-with-dns`]),e[`sccm-vpn-boundary-support`]!==void 0&&s(p,[`sccm_vpn_boundary_support`],e[`sccm-vpn-boundary-support`]),e[`service-mode-v2-mode`]!==void 0&&s(p,[`service_mode_v2`,`mode`],f(e[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`)),e[`service-mode-v2-port`]!==void 0&&s(p,[`service_mode_v2`,`port`],e[`service-mode-v2-port`]),e[`support-url`]!==void 0&&s(p,[`support_url`],f(e[`support-url`],`support-url`,`text`)),e[`switch-locked`]!==void 0&&s(p,[`switch_locked`],e[`switch-locked`]),e[`tunnel-protocol`]!==void 0&&s(p,[`tunnel_protocol`],f(e[`tunnel-protocol`],`tunnel-protocol`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/devices/policy`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function vo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const yo={command:`delete <policy-id>`,describe:`Deletes a device settings profile and fetches a list of the remaining profiles for an account.`,builder:vo,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust devices policies custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}`,pathParams:{"policy-id":String(t[`policy-id`]??``)},bodyKind:`json`,body:{body:t.body}});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body);l(await d(`Deleting`,async()=>n.delete(`/accounts/${a}/devices/policy/${encodeURIComponent(String(t[`policy-id`]))}`,{body:e})),{successLabel:`Deleted`});return}l(await d(`Deleting`,async()=>n.zeroTrust.devices.policies.custom.delete(t[`policy-id`],a)),{successLabel:`Deleted`})}};function bo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`}).option(`description`,{type:`string`,description:`A description of the policy.`}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`."}).option(`enabled`,{type:`boolean`,description:`Whether the policy will be applied to matching devices.`}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`}).option(`name`,{type:`string`,description:`The name of the device settings profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xo={command:`edit <policy-id>`,describe:`Updates a configured device settings profile.`,builder:bo,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies custom edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`json`,body:{"allow-mode-switch":e[`allow-mode-switch`],"allow-updates":e[`allow-updates`],"allowed-to-leave":e[`allowed-to-leave`],"auto-connect":e[`auto-connect`],"captive-portal":e[`captive-portal`],description:e.description,"disable-auto-fallback":e[`disable-auto-fallback`],enabled:e.enabled,"exclude-office-ips":e[`exclude-office-ips`],"lan-allow-minutes":e[`lan-allow-minutes`],"lan-allow-subnet-size":e[`lan-allow-subnet-size`],match:e.match,name:e.name,precedence:e.precedence,"register-interface-ip-with-dns":e[`register-interface-ip-with-dns`],"sccm-vpn-boundary-support":e[`sccm-vpn-boundary-support`],"service-mode-v2-mode":e[`service-mode-v2-mode`],"service-mode-v2-port":e[`service-mode-v2-port`],"support-url":e[`support-url`],"switch-locked":e[`switch-locked`],"tunnel-protocol":e[`tunnel-protocol`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/devices/policy/${encodeURIComponent(String(e[`policy-id`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e[`allow-mode-switch`]!==void 0&&s(a,[`allow_mode_switch`],e[`allow-mode-switch`]),e[`allow-updates`]!==void 0&&s(a,[`allow_updates`],e[`allow-updates`]),e[`allowed-to-leave`]!==void 0&&s(a,[`allowed_to_leave`],e[`allowed-to-leave`]),e[`auto-connect`]!==void 0&&s(a,[`auto_connect`],e[`auto-connect`]),e[`captive-portal`]!==void 0&&s(a,[`captive_portal`],e[`captive-portal`]),e.description!==void 0&&s(a,[`description`],f(e.description,`description`,`text`)),e[`disable-auto-fallback`]!==void 0&&s(a,[`disable_auto_fallback`],e[`disable-auto-fallback`]),e.enabled!==void 0&&s(a,[`enabled`],e.enabled),e[`exclude-office-ips`]!==void 0&&s(a,[`exclude_office_ips`],e[`exclude-office-ips`]),e[`lan-allow-minutes`]!==void 0&&s(a,[`lan_allow_minutes`],e[`lan-allow-minutes`]),e[`lan-allow-subnet-size`]!==void 0&&s(a,[`lan_allow_subnet_size`],e[`lan-allow-subnet-size`]),e.match!==void 0&&s(a,[`match`],f(e.match,`match`,`text`)),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),e.precedence!==void 0&&s(a,[`precedence`],e.precedence),e[`register-interface-ip-with-dns`]!==void 0&&s(a,[`register_interface_ip_with_dns`],e[`register-interface-ip-with-dns`]),e[`sccm-vpn-boundary-support`]!==void 0&&s(a,[`sccm_vpn_boundary_support`],e[`sccm-vpn-boundary-support`]),e[`service-mode-v2-mode`]!==void 0&&s(a,[`service_mode_v2`,`mode`],f(e[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`)),e[`service-mode-v2-port`]!==void 0&&s(a,[`service_mode_v2`,`port`],e[`service-mode-v2-port`]),e[`support-url`]!==void 0&&s(a,[`support_url`],f(e[`support-url`],`support-url`,`text`)),e[`switch-locked`]!==void 0&&s(a,[`switch_locked`],e[`switch-locked`]),e[`tunnel-protocol`]!==void 0&&s(a,[`tunnel_protocol`],f(e[`tunnel-protocol`],`tunnel-protocol`,`text`)),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/devices/policy/${encodeURIComponent(String(e[`policy-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}};function So(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Co={command:`get <policy-id>`,describe:`Fetches the list of routes excluded from the WARP client's tunnel for a specific device settings profile.`,builder:So,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies custom excludes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/exclude`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.policies.custom.excludes.get(e[`policy-id`],n)),{successLabel:`Loaded`})}};function wo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const To={command:`update <policy-id>`,describe:`Sets the list of routes excluded from the WARP client's tunnel for a specific device settings profile.`,builder:wo,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies custom excludes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/exclude`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/devices/policy/${encodeURIComponent(String(e[`policy-id`]))}/exclude`,{body:r})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Eo={command:`excludes`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Co).command(To).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Do(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Oo={command:`get <policy-id>`,describe:`Fetches the list of domains to bypass Gateway DNS resolution from a specified device settings profile. These domains will use the specified local DNS resolver instead.`,builder:Do,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies custom fallback-domains get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/fallback_domains`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.policies.custom.fallbackDomains.get(e[`policy-id`],n)),{successLabel:`Loaded`})}};function ko(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ao={command:`update <policy-id>`,describe:`Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. This will only apply to the specified device settings profile.`,builder:ko,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies custom fallback-domains update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/fallback_domains`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/devices/policy/${encodeURIComponent(String(e[`policy-id`]))}/fallback_domains`,{body:r})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},jo={command:`fallback-domains`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Oo).command(Ao).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Mo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const No={command:`get <policy-id>`,describe:`Fetches a device settings profile by ID.`,builder:Mo,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies custom get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.policies.custom.get(e[`policy-id`],n)),{successLabel:`Loaded`})}};function Po(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fo={command:`get <policy-id>`,describe:`Fetches the list of routes included in the WARP client's tunnel for a specific device settings profile.`,builder:Po,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies custom includes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/include`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.policies.custom.includes.get(e[`policy-id`],n)),{successLabel:`Loaded`})}};function Io(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Lo={command:`update <policy-id>`,describe:`Sets the list of routes included in the WARP client's tunnel for a specific device settings profile.`,builder:Io,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies custom includes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/include`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/devices/policy/${encodeURIComponent(String(e[`policy-id`]))}/include`,{body:r})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ro={command:`includes`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Fo).command(Lo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function zo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bo={command:`list`,describe:`Fetches a list of the device settings profiles for an account.`,builder:zo,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies custom list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policies`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.policies.custom.list(n)),{successLabel:`Loaded`})}},Vo={command:`custom`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(_o).command(yo).command(xo).command(No).command(Bo).command(Eo).command(jo).command(Ro).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ho(e){return e.option(`enabled`,{type:`boolean`,description:`The current status of the device policy certificate provisioning feature for WARP clients.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Uo={command:`edit`,describe:`Enable Zero Trust Clients to provision a certificate, containing a x509 subject, and referenced by Access device posture policies when the client visits MTLS protected domains. This facilitates device posture without a WARP session.`,builder:Ho,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies default certificates edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/devices/policy/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{enabled:e.enabled,body:e.body}});return}let t=await i(e);if(e.zoneId=await n({zone:e.zone},t,{quiet:e.quiet}),e.body){let n=c(e.body);l(await d(`Updating`,async()=>t.patch(`/zones/${e.zoneId}/devices/policy/certificates`,{body:n})),{successLabel:`Updated`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let r={};e.enabled!==void 0&&s(r,[`enabled`],e.enabled),l(await d(`Updating`,async()=>t.patch(`/zones/${e.zoneId}/devices/policy/certificates`,{body:Object.keys(r).length>0?r:void 0})),{successLabel:`Updated`})}};function Wo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Go={command:`get`,describe:`Fetches device certificate provisioning.`,builder:Wo,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies default certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/devices/policy/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.devices.policies.default.certificates.get(r)),{successLabel:`Loaded`})}},Ko={command:`certificates`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Uo).command(Go).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function qo(e){return e.option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`."}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Jo={command:`edit`,describe:`Updates the default device settings profile for an account.`,builder:qo,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies default edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`json`,body:{"allow-mode-switch":e[`allow-mode-switch`],"allow-updates":e[`allow-updates`],"allowed-to-leave":e[`allowed-to-leave`],"auto-connect":e[`auto-connect`],"captive-portal":e[`captive-portal`],"disable-auto-fallback":e[`disable-auto-fallback`],"exclude-office-ips":e[`exclude-office-ips`],"lan-allow-minutes":e[`lan-allow-minutes`],"lan-allow-subnet-size":e[`lan-allow-subnet-size`],"register-interface-ip-with-dns":e[`register-interface-ip-with-dns`],"sccm-vpn-boundary-support":e[`sccm-vpn-boundary-support`],"service-mode-v2-mode":e[`service-mode-v2-mode`],"service-mode-v2-port":e[`service-mode-v2-port`],"support-url":e[`support-url`],"switch-locked":e[`switch-locked`],"tunnel-protocol":e[`tunnel-protocol`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/devices/policy`,{body:r})),{successLabel:`Updated`});return}let a={};e[`allow-mode-switch`]!==void 0&&s(a,[`allow_mode_switch`],e[`allow-mode-switch`]),e[`allow-updates`]!==void 0&&s(a,[`allow_updates`],e[`allow-updates`]),e[`allowed-to-leave`]!==void 0&&s(a,[`allowed_to_leave`],e[`allowed-to-leave`]),e[`auto-connect`]!==void 0&&s(a,[`auto_connect`],e[`auto-connect`]),e[`captive-portal`]!==void 0&&s(a,[`captive_portal`],e[`captive-portal`]),e[`disable-auto-fallback`]!==void 0&&s(a,[`disable_auto_fallback`],e[`disable-auto-fallback`]),e[`exclude-office-ips`]!==void 0&&s(a,[`exclude_office_ips`],e[`exclude-office-ips`]),e[`lan-allow-minutes`]!==void 0&&s(a,[`lan_allow_minutes`],e[`lan-allow-minutes`]),e[`lan-allow-subnet-size`]!==void 0&&s(a,[`lan_allow_subnet_size`],e[`lan-allow-subnet-size`]),e[`register-interface-ip-with-dns`]!==void 0&&s(a,[`register_interface_ip_with_dns`],e[`register-interface-ip-with-dns`]),e[`sccm-vpn-boundary-support`]!==void 0&&s(a,[`sccm_vpn_boundary_support`],e[`sccm-vpn-boundary-support`]),e[`service-mode-v2-mode`]!==void 0&&s(a,[`service_mode_v2`,`mode`],f(e[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`)),e[`service-mode-v2-port`]!==void 0&&s(a,[`service_mode_v2`,`port`],e[`service-mode-v2-port`]),e[`support-url`]!==void 0&&s(a,[`support_url`],f(e[`support-url`],`support-url`,`text`)),e[`switch-locked`]!==void 0&&s(a,[`switch_locked`],e[`switch-locked`]),e[`tunnel-protocol`]!==void 0&&s(a,[`tunnel_protocol`],f(e[`tunnel-protocol`],`tunnel-protocol`,`text`)),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/devices/policy`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}};function Yo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xo={command:`get`,describe:`Fetches the list of routes excluded from the WARP client's tunnel.`,builder:Yo,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies default excludes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy/exclude`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.policies.default.excludes.get(n)),{successLabel:`Loaded`})}};function Zo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Qo={command:`update`,describe:`Sets the list of routes excluded from the WARP client's tunnel.`,builder:Zo,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies default excludes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy/exclude`,pathParams:{},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/devices/policy/exclude`,{body:r})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},$o={command:`excludes`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Xo).command(Qo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function es(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ts={command:`get`,describe:`Fetches a list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.`,builder:es,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies default fallback-domains get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy/fallback_domains`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.policies.default.fallbackDomains.get(n)),{successLabel:`Loaded`})}};function ns(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const rs={command:`update`,describe:`Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.`,builder:ns,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies default fallback-domains update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy/fallback_domains`,pathParams:{},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/devices/policy/fallback_domains`,{body:r})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},is={command:`fallback-domains`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(ts).command(rs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function as(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const os={command:`get`,describe:`Fetches the default device settings profile for an account.`,builder:as,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies default get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.policies.default.get(n)),{successLabel:`Loaded`})}};function ss(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const cs={command:`get`,describe:`Fetches the list of routes included in the WARP client's tunnel.`,builder:ss,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies default includes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy/include`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.policies.default.includes.get(n)),{successLabel:`Loaded`})}};function ls(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const us={command:`update`,describe:`Sets the list of routes included in the WARP client's tunnel.`,builder:ls,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices policies default includes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/policy/include`,pathParams:{},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/devices/policy/include`,{body:r})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},ds={command:`includes`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(cs).command(us).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},fs={command:`default`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Jo).command(os).command(Ko).command($o).command(is).command(ds).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ps={command:`policies`,describe:`Operations for devices.policies`,builder:e=>e.command(Vo).command(fs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ms(e){return e.option(`description`,{type:`string`,description:`The description of the device posture rule.`}).option(`expiration`,{type:`string`,description:`Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.`}).option(`input-exists`,{type:`boolean`,description:`Whether or not file exists.`}).option(`input-operating-system`,{type:`string`,description:`Operating system.`,choices:[`windows`,`linux`,`mac`,`android`,`ios`,`chromeos`]}).option(`input-path`,{type:`string`,description:`File path.`}).option(`input-sha256`,{type:`string`,description:`SHA-256.`}).option(`input-thumbprint`,{type:`string`,description:`Signing certificate thumbprint.`}).option(`input-id`,{type:`string`,description:`List ID.`}).option(`input-domain`,{type:`string`,description:`Domain.`}).option(`input-operator`,{type:`string`,description:`Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-os-distro-name`,{type:`string`,description:`Operating System Distribution Name (linux only).`}).option(`input-os-distro-revision`,{type:`string`,description:`Version of OS Distribution (linux only).`}).option(`input-os-version-extra`,{type:`string`,description:`Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.`}).option(`input-version`,{type:`string`,description:`Version of OS.`}).option(`input-enabled`,{type:`boolean`,description:`Enabled.`}).option(`input-check-disks`,{type:`string`,array:!0,description:`List of volume names to be checked for encryption.`}).option(`input-require-all`,{type:`boolean`,description:`Whether to check all disks for encryption.`}).option(`input-certificate-id`,{type:`string`,description:`UUID of Cloudflare managed certificate.`}).option(`input-cn`,{type:`string`,description:`Common Name that is protected by the certificate.`}).option(`input-check-private-key`,{type:`boolean`,description:`Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.`}).option(`input-extended-key-usage`,{type:`string`,array:!0,description:`List of values indicating purposes for which the certificate public key can be used.`}).option(`input-locations-paths`,{type:`string`,array:!0,description:`List of paths to check for client certificate on linux.`}).option(`input-locations-trust-stores`,{type:`string`,array:!0,description:`List of trust stores to check for client certificate.`}).option(`input-subject-alternative-names`,{type:`string`,array:!0,description:`List of certificate Subject Alternative Names.`}).option(`input-update-window-days`,{type:`number`,description:`Number of days that the antivirus should be updated within.`}).option(`input-compliance-status`,{type:`string`,description:`Compliance Status.`,choices:[`compliant`,`noncompliant`,`unknown`,`notapplicable`,`ingraceperiod`,`error`]}).option(`input-connection-id`,{type:`string`,description:`Posture Integration ID.`}).option(`input-last-seen`,{type:`string`,description:`For more details on last seen, please refer to the Crowdstrike documentation.`}).option(`input-os`,{type:`string`,description:`Os Version.`}).option(`input-overall`,{type:`string`,description:`Overall.`}).option(`input-sensor-config`,{type:`string`,description:`SensorConfig.`}).option(`input-state`,{type:`string`,description:`For more details on state, please refer to the Crowdstrike documentation.`,choices:[`online`,`offline`,`unknown`]}).option(`input-version-operator`,{type:`string`,description:`Version Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-auth-state`,{type:`string`,array:!0,description:`The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.`}).option(`input-count-operator`,{type:`string`,description:`Count Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-issue-count`,{type:`string`,description:`The Number of Issues.`}).option(`input-eid-last-seen`,{type:`string`,description:`For more details on eid last seen, refer to the Tanium documentation.`}).option(`input-risk-level`,{type:`string`,description:`For more details on risk level, refer to the Tanium documentation.`,choices:[`low`,`medium`,`high`,`critical`]}).option(`input-score-operator`,{type:`string`,description:`Score Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-total-score`,{type:`number`,description:`For more details on total score, refer to the Tanium documentation.`}).option(`input-active-threats`,{type:`number`,description:`The Number of active threats.`}).option(`input-infected`,{type:`boolean`,description:`Whether device is infected.`}).option(`input-is-active`,{type:`boolean`,description:`Whether device is active.`}).option(`input-network-status`,{type:`string`,description:`Network status of device.`,choices:[`connected`,`disconnected`,`disconnecting`,`connecting`]}).option(`input-operational-state`,{type:`string`,description:`Agent operational state.`,choices:[`na`,`partially_disabled`,`auto_fully_disabled`,`fully_disabled`,`auto_partially_disabled`,`disabled_error`,`db_corruption`]}).option(`input-score`,{type:`number`,description:`A value between 0-100 assigned to devices set by the 3rd party posture provider.`}).option(`name`,{type:`string`,description:`The name of the device posture rule.`}).option(`schedule`,{type:`string`,description:"Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`."}).option(`type`,{type:`string`,description:`The type of device posture rule.`,choices:[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`input-exists`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operating-system`,`input-id.input-check-disks.input-require-all.input-certificate-id.input-cn.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-operator.input-os.input-overall.input-sensor-config.input-state.input-version.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-path`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sha256`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-thumbprint`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-id`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-domain`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operator`,[`input-exists`,`input-path`,`input-sha256`,`input-thumbprint`,`input-operating-system`,`input-id`,`input-domain`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`,`input-compliance-status`,`input-connection-id`,`input-auth-state`,`input-count-operator`,`input-issue-count`]).conflicts(`input-os-distro-name`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-distro-revision`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-version-extra`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-version`,[`input-operating-system`,`input-operator`]).conflicts(`input-enabled`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-enabled`,[`input-operating-system`]).conflicts(`input-check-disks`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-require-all`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-certificate-id`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-cn`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-cn`,[`input-certificate-id`]).conflicts(`input-check-private-key`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-check-private-key`,[`input-certificate-id`,`input-operating-system`]).conflicts(`input-extended-key-usage`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-paths`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-trust-stores`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-subject-alternative-names`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-update-window-days`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-compliance-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-connection-id`,[`input-exists`,`input-operating-system`,`input-path`,`input-sha256`,`input-thumbprint`,`input-id`,`input-domain`,`input-operator`,`input-os-distro-name`,`input-os-distro-revision`,`input-os-version-extra`,`input-version`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`]).conflicts(`input-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-overall`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sensor-config`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-auth-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-count-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-issue-count`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-eid-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-risk-level`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-score-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-total-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-active-threats`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-infected`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-is-active`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-network-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-operational-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state`.split(`.`)).implies(`input-score`,[`input-connection-id`,`input-operator`])}const hs={command:`create`,describe:`Creates a new device posture rule.`,builder:ms,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices posture create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/posture`,pathParams:{},bodyKind:`json`,body:{description:e.description,expiration:e.expiration,"input-exists":e[`input-exists`],"input-operating-system":e[`input-operating-system`],"input-path":e[`input-path`],"input-sha256":e[`input-sha256`],"input-thumbprint":e[`input-thumbprint`],"input-id":e[`input-id`],"input-domain":e[`input-domain`],"input-operator":e[`input-operator`],"input-os-distro-name":e[`input-os-distro-name`],"input-os-distro-revision":e[`input-os-distro-revision`],"input-os-version-extra":e[`input-os-version-extra`],"input-version":e[`input-version`],"input-enabled":e[`input-enabled`],"input-check-disks":e[`input-check-disks`],"input-require-all":e[`input-require-all`],"input-certificate-id":e[`input-certificate-id`],"input-cn":e[`input-cn`],"input-check-private-key":e[`input-check-private-key`],"input-extended-key-usage":e[`input-extended-key-usage`],"input-locations-paths":e[`input-locations-paths`],"input-locations-trust-stores":e[`input-locations-trust-stores`],"input-subject-alternative-names":e[`input-subject-alternative-names`],"input-update-window-days":e[`input-update-window-days`],"input-compliance-status":e[`input-compliance-status`],"input-connection-id":e[`input-connection-id`],"input-last-seen":e[`input-last-seen`],"input-os":e[`input-os`],"input-overall":e[`input-overall`],"input-sensor-config":e[`input-sensor-config`],"input-state":e[`input-state`],"input-version-operator":e[`input-version-operator`],"input-auth-state":e[`input-auth-state`],"input-count-operator":e[`input-count-operator`],"input-issue-count":e[`input-issue-count`],"input-eid-last-seen":e[`input-eid-last-seen`],"input-risk-level":e[`input-risk-level`],"input-score-operator":e[`input-score-operator`],"input-total-score":e[`input-total-score`],"input-active-threats":e[`input-active-threats`],"input-infected":e[`input-infected`],"input-is-active":e[`input-is-active`],"input-network-status":e[`input-network-status`],"input-operational-state":e[`input-operational-state`],"input-score":e[`input-score`],name:e.name,schedule:e.schedule,type:e.type,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${p}/devices/posture`,{body:t})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await t(`name`,`The name of the device posture rule.`)),e.type===void 0&&(e.type=await a(`type`,`The type of device posture rule.`,[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]));let h={};e.description!==void 0&&s(h,[`description`],f(e.description,`description`,`text`)),e.expiration!==void 0&&s(h,[`expiration`],f(e.expiration,`expiration`,`text`)),e[`input-exists`]!==void 0&&s(h,[`input`,`exists`],e[`input-exists`]),e[`input-operating-system`]!==void 0&&s(h,[`input`,`operating_system`],f(e[`input-operating-system`],`input-operating-system`,`text`)),e[`input-path`]!==void 0&&s(h,[`input`,`path`],f(e[`input-path`],`input-path`,`text`)),e[`input-sha256`]!==void 0&&s(h,[`input`,`sha256`],f(e[`input-sha256`],`input-sha256`,`text`)),e[`input-thumbprint`]!==void 0&&s(h,[`input`,`thumbprint`],f(e[`input-thumbprint`],`input-thumbprint`,`text`)),e[`input-id`]!==void 0&&s(h,[`input`,`id`],f(e[`input-id`],`input-id`,`text`)),e[`input-domain`]!==void 0&&s(h,[`input`,`domain`],f(e[`input-domain`],`input-domain`,`text`)),e[`input-operator`]!==void 0&&s(h,[`input`,`operator`],f(e[`input-operator`],`input-operator`,`text`)),e[`input-os-distro-name`]!==void 0&&s(h,[`input`,`os_distro_name`],f(e[`input-os-distro-name`],`input-os-distro-name`,`text`)),e[`input-os-distro-revision`]!==void 0&&s(h,[`input`,`os_distro_revision`],f(e[`input-os-distro-revision`],`input-os-distro-revision`,`text`)),e[`input-os-version-extra`]!==void 0&&s(h,[`input`,`os_version_extra`],f(e[`input-os-version-extra`],`input-os-version-extra`,`text`)),e[`input-version`]!==void 0&&s(h,[`input`,`version`],f(e[`input-version`],`input-version`,`text`)),e[`input-enabled`]!==void 0&&s(h,[`input`,`enabled`],e[`input-enabled`]),e[`input-check-disks`]!==void 0&&s(h,[`input`,`checkDisks`],e[`input-check-disks`]),e[`input-require-all`]!==void 0&&s(h,[`input`,`requireAll`],e[`input-require-all`]),e[`input-certificate-id`]!==void 0&&s(h,[`input`,`certificate_id`],f(e[`input-certificate-id`],`input-certificate-id`,`text`)),e[`input-cn`]!==void 0&&s(h,[`input`,`cn`],f(e[`input-cn`],`input-cn`,`text`)),e[`input-check-private-key`]!==void 0&&s(h,[`input`,`check_private_key`],e[`input-check-private-key`]),e[`input-extended-key-usage`]!==void 0&&s(h,[`input`,`extended_key_usage`],e[`input-extended-key-usage`]),e[`input-locations-paths`]!==void 0&&s(h,[`input`,`locations`,`paths`],e[`input-locations-paths`]),e[`input-locations-trust-stores`]!==void 0&&s(h,[`input`,`locations`,`trust_stores`],e[`input-locations-trust-stores`]),e[`input-subject-alternative-names`]!==void 0&&s(h,[`input`,`subject_alternative_names`],e[`input-subject-alternative-names`]),e[`input-update-window-days`]!==void 0&&s(h,[`input`,`update_window_days`],e[`input-update-window-days`]),e[`input-compliance-status`]!==void 0&&s(h,[`input`,`compliance_status`],f(e[`input-compliance-status`],`input-compliance-status`,`text`)),e[`input-connection-id`]!==void 0&&s(h,[`input`,`connection_id`],f(e[`input-connection-id`],`input-connection-id`,`text`)),e[`input-last-seen`]!==void 0&&s(h,[`input`,`last_seen`],f(e[`input-last-seen`],`input-last-seen`,`text`)),e[`input-os`]!==void 0&&s(h,[`input`,`os`],f(e[`input-os`],`input-os`,`text`)),e[`input-overall`]!==void 0&&s(h,[`input`,`overall`],f(e[`input-overall`],`input-overall`,`text`)),e[`input-sensor-config`]!==void 0&&s(h,[`input`,`sensor_config`],f(e[`input-sensor-config`],`input-sensor-config`,`text`)),e[`input-state`]!==void 0&&s(h,[`input`,`state`],f(e[`input-state`],`input-state`,`text`)),e[`input-version-operator`]!==void 0&&s(h,[`input`,`versionOperator`],f(e[`input-version-operator`],`input-version-operator`,`text`)),e[`input-auth-state`]!==void 0&&s(h,[`input`,`auth_state`],e[`input-auth-state`]),e[`input-count-operator`]!==void 0&&s(h,[`input`,`countOperator`],f(e[`input-count-operator`],`input-count-operator`,`text`)),e[`input-issue-count`]!==void 0&&s(h,[`input`,`issue_count`],f(e[`input-issue-count`],`input-issue-count`,`text`)),e[`input-eid-last-seen`]!==void 0&&s(h,[`input`,`eid_last_seen`],f(e[`input-eid-last-seen`],`input-eid-last-seen`,`text`)),e[`input-risk-level`]!==void 0&&s(h,[`input`,`risk_level`],f(e[`input-risk-level`],`input-risk-level`,`text`)),e[`input-score-operator`]!==void 0&&s(h,[`input`,`scoreOperator`],f(e[`input-score-operator`],`input-score-operator`,`text`)),e[`input-total-score`]!==void 0&&s(h,[`input`,`total_score`],e[`input-total-score`]),e[`input-active-threats`]!==void 0&&s(h,[`input`,`active_threats`],e[`input-active-threats`]),e[`input-infected`]!==void 0&&s(h,[`input`,`infected`],e[`input-infected`]),e[`input-is-active`]!==void 0&&s(h,[`input`,`is_active`],e[`input-is-active`]),e[`input-network-status`]!==void 0&&s(h,[`input`,`network_status`],f(e[`input-network-status`],`input-network-status`,`text`)),e[`input-operational-state`]!==void 0&&s(h,[`input`,`operational_state`],f(e[`input-operational-state`],`input-operational-state`,`text`)),e[`input-score`]!==void 0&&s(h,[`input`,`score`],e[`input-score`]),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),e.schedule!==void 0&&s(h,[`schedule`],f(e.schedule,`schedule`,`text`)),e.type!==void 0&&s(h,[`type`],f(e.type,`type`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${p}/devices/posture`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created`})}};function gs(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _s={command:`delete <rule-id>`,describe:`Deletes a device posture rule.`,builder:gs,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust devices posture delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/posture/${t[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(t[`rule-id`]))}`,pathParams:{"rule-id":String(t[`rule-id`]??``)},bodyKind:`json`,body:{body:t.body}});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body);l(await d(`Deleting`,async()=>n.delete(`/accounts/${a}/devices/posture/${encodeURIComponent(String(t[`rule-id`]))}`,{body:e})),{successLabel:`Deleted`});return}l(await d(`Deleting`,async()=>n.zeroTrust.devices.posture.delete(t[`rule-id`],a)),{successLabel:`Deleted`})}};function vs(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ys={command:`get <rule-id>`,describe:`Fetches a single device posture rule.`,builder:vs,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices posture get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/posture/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.posture.get(e[`rule-id`],n)),{successLabel:`Loaded`})}};function bs(e){return e.option(`config-api-url`,{type:`string`,description:`The Workspace One API URL provided in the Workspace One Admin Dashboard.`}).option(`config-auth-url`,{type:`string`,description:`The Workspace One Authorization URL depending on your region.`}).option(`config-client-id`,{type:`string`,description:`The Workspace One client ID provided in the Workspace One Admin Dashboard.`}).option(`config-client-secret`,{type:`string`,description:`The Workspace One client secret provided in the Workspace One Admin Dashboard.`}).option(`config-customer-id`,{type:`string`,description:`The Crowdstrike customer ID.`}).option(`config-client-key`,{type:`string`,description:`The Uptycs client secret.`}).option(`config-access-client-id`,{type:`string`,description:"If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`."}).option(`config-access-client-secret`,{type:`string`,description:"If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`."}).option(`interval`,{type:`string`,description:"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`)."}).option(`name`,{type:`string`,description:`The name of the device posture integration.`}).option(`type`,{type:`string`,description:`The type of device posture integration.`,choices:[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`config-api-url`,[`config-customer-id`,`config-client-id`,`config-client-secret`]).conflicts(`config-auth-url`,[`config-customer-id`,`config-client-key`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-auth-url`,[`config-api-url`,`config-client-id`,`config-client-secret`]).conflicts(`config-client-id`,[`config-client-key`,`config-customer-id`,`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-client-secret`,[`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-customer-id`,[`config-auth-url`,`config-client-id`,`config-api-url`,`config-access-client-id`,`config-access-client-secret`]).conflicts(`config-client-key`,[`config-auth-url`,`config-client-id`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-client-key`,[`config-api-url`,`config-customer-id`,`config-client-secret`]).conflicts(`config-access-client-id`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-id`,[`config-api-url`,`config-access-client-secret`]).conflicts(`config-access-client-secret`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-secret`,[`config-api-url`,`config-access-client-id`])}const xs={command:`create`,describe:`Create a new device posture integration.`,builder:bs,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices posture integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/posture/integration`,pathParams:{},bodyKind:`json`,body:{"config-api-url":e[`config-api-url`],"config-auth-url":e[`config-auth-url`],"config-client-id":e[`config-client-id`],"config-client-secret":e[`config-client-secret`],"config-customer-id":e[`config-customer-id`],"config-client-key":e[`config-client-key`],"config-access-client-id":e[`config-access-client-id`],"config-access-client-secret":e[`config-access-client-secret`],interval:e.interval,name:e.name,type:e.type,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${p}/devices/posture/integration`,{body:t})),{successLabel:`Created`});return}e.interval===void 0&&(e.interval=await t(`interval`,"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`).")),e.name===void 0&&(e.name=await t(`name`,`The name of the device posture integration.`)),e.type===void 0&&(e.type=await a(`type`,`The type of device posture integration.`,[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]));let h={};e[`config-api-url`]!==void 0&&s(h,[`config`,`api_url`],f(e[`config-api-url`],`config-api-url`,`text`)),e[`config-auth-url`]!==void 0&&s(h,[`config`,`auth_url`],f(e[`config-auth-url`],`config-auth-url`,`text`)),e[`config-client-id`]!==void 0&&s(h,[`config`,`client_id`],f(e[`config-client-id`],`config-client-id`,`text`)),e[`config-client-secret`]!==void 0&&s(h,[`config`,`client_secret`],f(e[`config-client-secret`],`config-client-secret`,`text`)),e[`config-customer-id`]!==void 0&&s(h,[`config`,`customer_id`],f(e[`config-customer-id`],`config-customer-id`,`text`)),e[`config-client-key`]!==void 0&&s(h,[`config`,`client_key`],f(e[`config-client-key`],`config-client-key`,`text`)),e[`config-access-client-id`]!==void 0&&s(h,[`config`,`access_client_id`],f(e[`config-access-client-id`],`config-access-client-id`,`text`)),e[`config-access-client-secret`]!==void 0&&s(h,[`config`,`access_client_secret`],f(e[`config-access-client-secret`],`config-access-client-secret`,`text`)),e.interval!==void 0&&s(h,[`interval`],f(e.interval,`interval`,`text`)),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),e.type!==void 0&&s(h,[`type`],f(e.type,`type`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${p}/devices/posture/integration`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created`})}};function Ss(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Cs={command:`delete <integration-id>`,describe:`Delete a configured device posture integration.`,builder:Ss,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust devices posture integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/posture/integration/${t[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(t[`integration-id`]))}`,pathParams:{"integration-id":String(t[`integration-id`]??``)},bodyKind:`json`,body:{body:t.body}});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body);l(await d(`Deleting`,async()=>n.delete(`/accounts/${a}/devices/posture/integration/${encodeURIComponent(String(t[`integration-id`]))}`,{body:e})),{successLabel:`Deleted`});return}l(await d(`Deleting`,async()=>n.zeroTrust.devices.posture.integrations.delete(t[`integration-id`],a)),{successLabel:`Deleted`})}};function ws(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`config-api-url`,{type:`string`,description:`The Workspace One API URL provided in the Workspace One Admin Dashboard.`}).option(`config-auth-url`,{type:`string`,description:`The Workspace One Authorization URL depending on your region.`}).option(`config-client-id`,{type:`string`,description:`The Workspace One client ID provided in the Workspace One Admin Dashboard.`}).option(`config-client-secret`,{type:`string`,description:`The Workspace One client secret provided in the Workspace One Admin Dashboard.`}).option(`config-customer-id`,{type:`string`,description:`The Crowdstrike customer ID.`}).option(`config-client-key`,{type:`string`,description:`The Uptycs client secret.`}).option(`config-access-client-id`,{type:`string`,description:"If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`."}).option(`config-access-client-secret`,{type:`string`,description:"If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`."}).option(`interval`,{type:`string`,description:"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`)."}).option(`name`,{type:`string`,description:`The name of the device posture integration.`}).option(`type`,{type:`string`,description:`The type of device posture integration.`,choices:[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`config-api-url`,[`config-customer-id`,`config-client-id`,`config-client-secret`]).conflicts(`config-auth-url`,[`config-customer-id`,`config-client-key`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-auth-url`,[`config-api-url`,`config-client-id`,`config-client-secret`]).conflicts(`config-client-id`,[`config-client-key`,`config-customer-id`,`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-client-secret`,[`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-customer-id`,[`config-auth-url`,`config-client-id`,`config-api-url`,`config-access-client-id`,`config-access-client-secret`]).conflicts(`config-client-key`,[`config-auth-url`,`config-client-id`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-client-key`,[`config-api-url`,`config-customer-id`,`config-client-secret`]).conflicts(`config-access-client-id`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-id`,[`config-api-url`,`config-access-client-secret`]).conflicts(`config-access-client-secret`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-secret`,[`config-api-url`,`config-access-client-id`])}const Ts={command:`edit <integration-id>`,describe:`Updates a configured device posture integration.`,builder:ws,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices posture integrations edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/posture/integration/${e[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(e[`integration-id`]))}`,pathParams:{"integration-id":String(e[`integration-id`]??``)},bodyKind:`json`,body:{"config-api-url":e[`config-api-url`],"config-auth-url":e[`config-auth-url`],"config-client-id":e[`config-client-id`],"config-client-secret":e[`config-client-secret`],"config-customer-id":e[`config-customer-id`],"config-client-key":e[`config-client-key`],"config-access-client-id":e[`config-access-client-id`],"config-access-client-secret":e[`config-access-client-secret`],interval:e.interval,name:e.name,type:e.type,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/devices/posture/integration/${encodeURIComponent(String(e[`integration-id`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e[`config-api-url`]!==void 0&&s(a,[`config`,`api_url`],f(e[`config-api-url`],`config-api-url`,`text`)),e[`config-auth-url`]!==void 0&&s(a,[`config`,`auth_url`],f(e[`config-auth-url`],`config-auth-url`,`text`)),e[`config-client-id`]!==void 0&&s(a,[`config`,`client_id`],f(e[`config-client-id`],`config-client-id`,`text`)),e[`config-client-secret`]!==void 0&&s(a,[`config`,`client_secret`],f(e[`config-client-secret`],`config-client-secret`,`text`)),e[`config-customer-id`]!==void 0&&s(a,[`config`,`customer_id`],f(e[`config-customer-id`],`config-customer-id`,`text`)),e[`config-client-key`]!==void 0&&s(a,[`config`,`client_key`],f(e[`config-client-key`],`config-client-key`,`text`)),e[`config-access-client-id`]!==void 0&&s(a,[`config`,`access_client_id`],f(e[`config-access-client-id`],`config-access-client-id`,`text`)),e[`config-access-client-secret`]!==void 0&&s(a,[`config`,`access_client_secret`],f(e[`config-access-client-secret`],`config-access-client-secret`,`text`)),e.interval!==void 0&&s(a,[`interval`],f(e.interval,`interval`,`text`)),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),e.type!==void 0&&s(a,[`type`],f(e.type,`type`,`text`)),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/devices/posture/integration/${encodeURIComponent(String(e[`integration-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}};function Es(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ds={command:`get <integration-id>`,describe:`Fetches details for a single device posture integration.`,builder:Es,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices posture integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/posture/integration/${e[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(e[`integration-id`]))}`,pathParams:{"integration-id":String(e[`integration-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.posture.integrations.get(e[`integration-id`],n)),{successLabel:`Loaded`})}};function Os(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ks={command:`list`,describe:`Fetches the list of device posture integrations for an account.`,builder:Os,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices posture integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/posture/integration`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.posture.integrations.list(n)),{successLabel:`Loaded`})}},As={command:`integrations`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(xs).command(Cs).command(Ts).command(Ds).command(ks).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function js(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ms={command:`list`,describe:`Fetches device posture rules for a Zero Trust account.`,builder:js,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices posture list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/posture`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.posture.list(n)),{successLabel:`Loaded`})}};function Ns(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`The description of the device posture rule.`}).option(`expiration`,{type:`string`,description:`Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.`}).option(`input-exists`,{type:`boolean`,description:`Whether or not file exists.`}).option(`input-operating-system`,{type:`string`,description:`Operating system.`,choices:[`windows`,`linux`,`mac`,`android`,`ios`,`chromeos`]}).option(`input-path`,{type:`string`,description:`File path.`}).option(`input-sha256`,{type:`string`,description:`SHA-256.`}).option(`input-thumbprint`,{type:`string`,description:`Signing certificate thumbprint.`}).option(`input-id`,{type:`string`,description:`List ID.`}).option(`input-domain`,{type:`string`,description:`Domain.`}).option(`input-operator`,{type:`string`,description:`Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-os-distro-name`,{type:`string`,description:`Operating System Distribution Name (linux only).`}).option(`input-os-distro-revision`,{type:`string`,description:`Version of OS Distribution (linux only).`}).option(`input-os-version-extra`,{type:`string`,description:`Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.`}).option(`input-version`,{type:`string`,description:`Version of OS.`}).option(`input-enabled`,{type:`boolean`,description:`Enabled.`}).option(`input-check-disks`,{type:`string`,array:!0,description:`List of volume names to be checked for encryption.`}).option(`input-require-all`,{type:`boolean`,description:`Whether to check all disks for encryption.`}).option(`input-certificate-id`,{type:`string`,description:`UUID of Cloudflare managed certificate.`}).option(`input-cn`,{type:`string`,description:`Common Name that is protected by the certificate.`}).option(`input-check-private-key`,{type:`boolean`,description:`Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.`}).option(`input-extended-key-usage`,{type:`string`,array:!0,description:`List of values indicating purposes for which the certificate public key can be used.`}).option(`input-locations-paths`,{type:`string`,array:!0,description:`List of paths to check for client certificate on linux.`}).option(`input-locations-trust-stores`,{type:`string`,array:!0,description:`List of trust stores to check for client certificate.`}).option(`input-subject-alternative-names`,{type:`string`,array:!0,description:`List of certificate Subject Alternative Names.`}).option(`input-update-window-days`,{type:`number`,description:`Number of days that the antivirus should be updated within.`}).option(`input-compliance-status`,{type:`string`,description:`Compliance Status.`,choices:[`compliant`,`noncompliant`,`unknown`,`notapplicable`,`ingraceperiod`,`error`]}).option(`input-connection-id`,{type:`string`,description:`Posture Integration ID.`}).option(`input-last-seen`,{type:`string`,description:`For more details on last seen, please refer to the Crowdstrike documentation.`}).option(`input-os`,{type:`string`,description:`Os Version.`}).option(`input-overall`,{type:`string`,description:`Overall.`}).option(`input-sensor-config`,{type:`string`,description:`SensorConfig.`}).option(`input-state`,{type:`string`,description:`For more details on state, please refer to the Crowdstrike documentation.`,choices:[`online`,`offline`,`unknown`]}).option(`input-version-operator`,{type:`string`,description:`Version Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-auth-state`,{type:`string`,array:!0,description:`The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.`}).option(`input-count-operator`,{type:`string`,description:`Count Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-issue-count`,{type:`string`,description:`The Number of Issues.`}).option(`input-eid-last-seen`,{type:`string`,description:`For more details on eid last seen, refer to the Tanium documentation.`}).option(`input-risk-level`,{type:`string`,description:`For more details on risk level, refer to the Tanium documentation.`,choices:[`low`,`medium`,`high`,`critical`]}).option(`input-score-operator`,{type:`string`,description:`Score Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-total-score`,{type:`number`,description:`For more details on total score, refer to the Tanium documentation.`}).option(`input-active-threats`,{type:`number`,description:`The Number of active threats.`}).option(`input-infected`,{type:`boolean`,description:`Whether device is infected.`}).option(`input-is-active`,{type:`boolean`,description:`Whether device is active.`}).option(`input-network-status`,{type:`string`,description:`Network status of device.`,choices:[`connected`,`disconnected`,`disconnecting`,`connecting`]}).option(`input-operational-state`,{type:`string`,description:`Agent operational state.`,choices:[`na`,`partially_disabled`,`auto_fully_disabled`,`fully_disabled`,`auto_partially_disabled`,`disabled_error`,`db_corruption`]}).option(`input-score`,{type:`number`,description:`A value between 0-100 assigned to devices set by the 3rd party posture provider.`}).option(`name`,{type:`string`,description:`The name of the device posture rule.`}).option(`schedule`,{type:`string`,description:"Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`."}).option(`type`,{type:`string`,description:`The type of device posture rule.`,choices:[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`input-exists`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operating-system`,`input-id.input-check-disks.input-require-all.input-certificate-id.input-cn.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-operator.input-os.input-overall.input-sensor-config.input-state.input-version.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-path`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sha256`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-thumbprint`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-id`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-domain`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operator`,[`input-exists`,`input-path`,`input-sha256`,`input-thumbprint`,`input-operating-system`,`input-id`,`input-domain`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`,`input-compliance-status`,`input-connection-id`,`input-auth-state`,`input-count-operator`,`input-issue-count`]).conflicts(`input-os-distro-name`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-distro-revision`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-version-extra`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-version`,[`input-operating-system`,`input-operator`]).conflicts(`input-enabled`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-enabled`,[`input-operating-system`]).conflicts(`input-check-disks`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-require-all`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-certificate-id`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-cn`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-cn`,[`input-certificate-id`]).conflicts(`input-check-private-key`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-check-private-key`,[`input-certificate-id`,`input-operating-system`]).conflicts(`input-extended-key-usage`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-paths`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-trust-stores`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-subject-alternative-names`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-update-window-days`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-compliance-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-connection-id`,[`input-exists`,`input-operating-system`,`input-path`,`input-sha256`,`input-thumbprint`,`input-id`,`input-domain`,`input-operator`,`input-os-distro-name`,`input-os-distro-revision`,`input-os-version-extra`,`input-version`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`]).conflicts(`input-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-overall`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sensor-config`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-auth-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-count-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-issue-count`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-eid-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-risk-level`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-score-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-total-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-active-threats`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-infected`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-is-active`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-network-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-operational-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state`.split(`.`)).implies(`input-score`,[`input-connection-id`,`input-operator`])}const Ps={command:`update <rule-id>`,describe:`Updates a device posture rule.`,builder:Ns,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices posture update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/posture/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`json`,body:{description:e.description,expiration:e.expiration,"input-exists":e[`input-exists`],"input-operating-system":e[`input-operating-system`],"input-path":e[`input-path`],"input-sha256":e[`input-sha256`],"input-thumbprint":e[`input-thumbprint`],"input-id":e[`input-id`],"input-domain":e[`input-domain`],"input-operator":e[`input-operator`],"input-os-distro-name":e[`input-os-distro-name`],"input-os-distro-revision":e[`input-os-distro-revision`],"input-os-version-extra":e[`input-os-version-extra`],"input-version":e[`input-version`],"input-enabled":e[`input-enabled`],"input-check-disks":e[`input-check-disks`],"input-require-all":e[`input-require-all`],"input-certificate-id":e[`input-certificate-id`],"input-cn":e[`input-cn`],"input-check-private-key":e[`input-check-private-key`],"input-extended-key-usage":e[`input-extended-key-usage`],"input-locations-paths":e[`input-locations-paths`],"input-locations-trust-stores":e[`input-locations-trust-stores`],"input-subject-alternative-names":e[`input-subject-alternative-names`],"input-update-window-days":e[`input-update-window-days`],"input-compliance-status":e[`input-compliance-status`],"input-connection-id":e[`input-connection-id`],"input-last-seen":e[`input-last-seen`],"input-os":e[`input-os`],"input-overall":e[`input-overall`],"input-sensor-config":e[`input-sensor-config`],"input-state":e[`input-state`],"input-version-operator":e[`input-version-operator`],"input-auth-state":e[`input-auth-state`],"input-count-operator":e[`input-count-operator`],"input-issue-count":e[`input-issue-count`],"input-eid-last-seen":e[`input-eid-last-seen`],"input-risk-level":e[`input-risk-level`],"input-score-operator":e[`input-score-operator`],"input-total-score":e[`input-total-score`],"input-active-threats":e[`input-active-threats`],"input-infected":e[`input-infected`],"input-is-active":e[`input-is-active`],"input-network-status":e[`input-network-status`],"input-operational-state":e[`input-operational-state`],"input-score":e[`input-score`],name:e.name,schedule:e.schedule,type:e.type,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${p}/devices/posture/${encodeURIComponent(String(e[`rule-id`]))}`,{body:t})),{successLabel:`Updated`});return}e.name===void 0&&(e.name=await t(`name`,`The name of the device posture rule.`)),e.type===void 0&&(e.type=await a(`type`,`The type of device posture rule.`,[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]));let h={};e.description!==void 0&&s(h,[`description`],f(e.description,`description`,`text`)),e.expiration!==void 0&&s(h,[`expiration`],f(e.expiration,`expiration`,`text`)),e[`input-exists`]!==void 0&&s(h,[`input`,`exists`],e[`input-exists`]),e[`input-operating-system`]!==void 0&&s(h,[`input`,`operating_system`],f(e[`input-operating-system`],`input-operating-system`,`text`)),e[`input-path`]!==void 0&&s(h,[`input`,`path`],f(e[`input-path`],`input-path`,`text`)),e[`input-sha256`]!==void 0&&s(h,[`input`,`sha256`],f(e[`input-sha256`],`input-sha256`,`text`)),e[`input-thumbprint`]!==void 0&&s(h,[`input`,`thumbprint`],f(e[`input-thumbprint`],`input-thumbprint`,`text`)),e[`input-id`]!==void 0&&s(h,[`input`,`id`],f(e[`input-id`],`input-id`,`text`)),e[`input-domain`]!==void 0&&s(h,[`input`,`domain`],f(e[`input-domain`],`input-domain`,`text`)),e[`input-operator`]!==void 0&&s(h,[`input`,`operator`],f(e[`input-operator`],`input-operator`,`text`)),e[`input-os-distro-name`]!==void 0&&s(h,[`input`,`os_distro_name`],f(e[`input-os-distro-name`],`input-os-distro-name`,`text`)),e[`input-os-distro-revision`]!==void 0&&s(h,[`input`,`os_distro_revision`],f(e[`input-os-distro-revision`],`input-os-distro-revision`,`text`)),e[`input-os-version-extra`]!==void 0&&s(h,[`input`,`os_version_extra`],f(e[`input-os-version-extra`],`input-os-version-extra`,`text`)),e[`input-version`]!==void 0&&s(h,[`input`,`version`],f(e[`input-version`],`input-version`,`text`)),e[`input-enabled`]!==void 0&&s(h,[`input`,`enabled`],e[`input-enabled`]),e[`input-check-disks`]!==void 0&&s(h,[`input`,`checkDisks`],e[`input-check-disks`]),e[`input-require-all`]!==void 0&&s(h,[`input`,`requireAll`],e[`input-require-all`]),e[`input-certificate-id`]!==void 0&&s(h,[`input`,`certificate_id`],f(e[`input-certificate-id`],`input-certificate-id`,`text`)),e[`input-cn`]!==void 0&&s(h,[`input`,`cn`],f(e[`input-cn`],`input-cn`,`text`)),e[`input-check-private-key`]!==void 0&&s(h,[`input`,`check_private_key`],e[`input-check-private-key`]),e[`input-extended-key-usage`]!==void 0&&s(h,[`input`,`extended_key_usage`],e[`input-extended-key-usage`]),e[`input-locations-paths`]!==void 0&&s(h,[`input`,`locations`,`paths`],e[`input-locations-paths`]),e[`input-locations-trust-stores`]!==void 0&&s(h,[`input`,`locations`,`trust_stores`],e[`input-locations-trust-stores`]),e[`input-subject-alternative-names`]!==void 0&&s(h,[`input`,`subject_alternative_names`],e[`input-subject-alternative-names`]),e[`input-update-window-days`]!==void 0&&s(h,[`input`,`update_window_days`],e[`input-update-window-days`]),e[`input-compliance-status`]!==void 0&&s(h,[`input`,`compliance_status`],f(e[`input-compliance-status`],`input-compliance-status`,`text`)),e[`input-connection-id`]!==void 0&&s(h,[`input`,`connection_id`],f(e[`input-connection-id`],`input-connection-id`,`text`)),e[`input-last-seen`]!==void 0&&s(h,[`input`,`last_seen`],f(e[`input-last-seen`],`input-last-seen`,`text`)),e[`input-os`]!==void 0&&s(h,[`input`,`os`],f(e[`input-os`],`input-os`,`text`)),e[`input-overall`]!==void 0&&s(h,[`input`,`overall`],f(e[`input-overall`],`input-overall`,`text`)),e[`input-sensor-config`]!==void 0&&s(h,[`input`,`sensor_config`],f(e[`input-sensor-config`],`input-sensor-config`,`text`)),e[`input-state`]!==void 0&&s(h,[`input`,`state`],f(e[`input-state`],`input-state`,`text`)),e[`input-version-operator`]!==void 0&&s(h,[`input`,`versionOperator`],f(e[`input-version-operator`],`input-version-operator`,`text`)),e[`input-auth-state`]!==void 0&&s(h,[`input`,`auth_state`],e[`input-auth-state`]),e[`input-count-operator`]!==void 0&&s(h,[`input`,`countOperator`],f(e[`input-count-operator`],`input-count-operator`,`text`)),e[`input-issue-count`]!==void 0&&s(h,[`input`,`issue_count`],f(e[`input-issue-count`],`input-issue-count`,`text`)),e[`input-eid-last-seen`]!==void 0&&s(h,[`input`,`eid_last_seen`],f(e[`input-eid-last-seen`],`input-eid-last-seen`,`text`)),e[`input-risk-level`]!==void 0&&s(h,[`input`,`risk_level`],f(e[`input-risk-level`],`input-risk-level`,`text`)),e[`input-score-operator`]!==void 0&&s(h,[`input`,`scoreOperator`],f(e[`input-score-operator`],`input-score-operator`,`text`)),e[`input-total-score`]!==void 0&&s(h,[`input`,`total_score`],e[`input-total-score`]),e[`input-active-threats`]!==void 0&&s(h,[`input`,`active_threats`],e[`input-active-threats`]),e[`input-infected`]!==void 0&&s(h,[`input`,`infected`],e[`input-infected`]),e[`input-is-active`]!==void 0&&s(h,[`input`,`is_active`],e[`input-is-active`]),e[`input-network-status`]!==void 0&&s(h,[`input`,`network_status`],f(e[`input-network-status`],`input-network-status`,`text`)),e[`input-operational-state`]!==void 0&&s(h,[`input`,`operational_state`],f(e[`input-operational-state`],`input-operational-state`,`text`)),e[`input-score`]!==void 0&&s(h,[`input`,`score`],e[`input-score`]),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),e.schedule!==void 0&&s(h,[`schedule`],f(e.schedule,`schedule`,`text`)),e.type!==void 0&&s(h,[`type`],f(e.type,`type`,`text`)),l(await d(`Updating`,async()=>n.put(`/accounts/${p}/devices/posture/${encodeURIComponent(String(e[`rule-id`]))}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated`})}},Fs={command:`posture`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(hs).command(_s).command(ys).command(Ms).command(Ps).command(As).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Is(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ls={command:`bulk-delete`,describe:`Deletes a list of WARP registrations.`,builder:Is,handler:async t=>{let n={id:t.id};if(t.dryRun){u({command:`cf zero-trust devices registrations bulk-delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/registrations`,pathParams:{},query:n,bodyKind:`none`});return}let a=await i(t),s=t.local?m:await r(a);if(t.accountId=s,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>a.zeroTrust.devices.registrations.bulkDelete(s,n)),{successLabel:`Deleted`})}};function Rs(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const zs={command:`delete <registration-id>`,describe:`Deletes a WARP registration.`,builder:Rs,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust devices registrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/registrations/${t[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(t[`registration-id`]))}`,pathParams:{"registration-id":String(t[`registration-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.devices.registrations.delete(t[`registration-id`],a)),{successLabel:`Deleted`})}};function Bs(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the registration response. Supported values are: "policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vs={command:`get <registration-id>`,describe:`Fetches a single WARP registration.`,builder:Bs,handler:async e=>{let t={include:e.include};if(e.dryRun){u({command:`cf zero-trust devices registrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/registrations/${e[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(e[`registration-id`]))}`,pathParams:{"registration-id":String(e[`registration-id`]??``)},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.devices.registrations.get(e[`registration-id`],a,t)),{successLabel:`Loaded`})}};function Hs(e){return e.option(`user-id`,{type:`string`,description:`Filter by user ID.`}).option(`seen-after`,{type:`string`,description:`Filter by the last_seen timestamp - returns only registrations last seen after this timestamp.`}).option(`seen-before`,{type:`string`,description:`Filter by the last_seen timestamp - returns only registrations last seen before this timestamp.`}).option(`status`,{type:`string`,description:`Filter by registration status. Defaults to 'active'.`,choices:[`active`,`all`,`revoked`]}).option(`per-page`,{type:`number`,description:`The maximum number of devices to return in a single response.`}).option(`search`,{type:`string`,description:`Filter by registration details.`}).option(`sort-by`,{type:`string`,description:`The registration field to order results by.`,choices:[`id`,`user.name`,`user.email`,`last_seen_at`,`created_at`]}).option(`sort-order`,{type:`string`,description:`Sort direction.`,choices:[`asc`,`desc`]}).option(`cursor`,{type:`string`,description:`Opaque token indicating the starting position when requesting the next set of records. A cursor value can be obtained from the result_info.cursor field in the response.`}).option(`id`,{type:`string`,description:`Filter by registration ID.`}).option(`device-id`,{type:`string`,description:`Filter by WARP device ID.`}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the registration response. Supported values are: "policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Us={command:`list`,describe:`Lists WARP registrations.`,builder:Hs,handler:async e=>{let t={"user.id":e[`user-id`],seen_after:e[`seen-after`],seen_before:e[`seen-before`],status:e.status,per_page:e[`per-page`],search:e.search,sort_by:e[`sort-by`],sort_order:e[`sort-order`],cursor:e.cursor,id:e.id,"device.id":e[`device-id`],include:e.include};if(e.dryRun){u({command:`cf zero-trust devices registrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/registrations`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.devices.registrations.list(a,t)),{successLabel:`Loaded`})}};function Ws(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to revoke.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Gs={command:`revoke`,describe:`Revokes a list of WARP registrations.`,builder:Ws,handler:async t=>{let n={id:t.id};if(t.dryRun){u({command:`cf zero-trust devices registrations revoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/registrations/revoke`,pathParams:{},query:n,bodyKind:`none`});return}let a=await i(t),s=t.local?m:await r(a);if(t.accountId=s,!await e({force:!!t.force,message:`This operation revokes device registrations destructively.`})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>a.zeroTrust.devices.registrations.revoke(s,n)),{successLabel:`Deleted`})}};function Ks(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to unrevoke.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qs={command:`unrevoke`,describe:`Unrevokes a list of WARP registrations.`,builder:Ks,handler:async e=>{let t={id:e.id};if(e.dryRun){u({command:`cf zero-trust devices registrations unrevoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/registrations/unrevoke`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Creating`,async()=>n.zeroTrust.devices.registrations.unrevoke(a,t)),{successLabel:`Created`})}},Js={command:`registrations`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Ls).command(zs).command(Vs).command(Us).command(Gs).command(qs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ys(e){return e.option(`disconnect`,{type:`boolean`,description:`Disconnects all devices on the account using Global WARP override.`}).option(`justification`,{type:`string`,description:`Reasoning for setting the Global WARP override state. This will be surfaced in the audit log.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Xs={command:`create`,describe:`Sets the Global WARP override state.`,builder:Ys,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices resilience global-warp-override create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/resilience/disconnect`,pathParams:{},bodyKind:`json`,body:{disconnect:e.disconnect,justification:e.justification,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/devices/resilience/disconnect`,{body:r})),{successLabel:`Created`});return}if(e.disconnect===void 0)throw Error(`--disconnect is required (or pass --body with this field set).`);let a={};e.disconnect!==void 0&&s(a,[`disconnect`],e.disconnect),e.justification!==void 0&&s(a,[`justification`],f(e.justification,`justification`,`text`)),l(await d(`Creating`,async()=>t.post(`/accounts/${n}/devices/resilience/disconnect`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Created`})}};function Zs(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qs={command:`get`,describe:`Fetch the Global WARP override state.`,builder:Zs,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices resilience global-warp-override get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/resilience/disconnect`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.resilience.globalWarpOverride.get(n)),{successLabel:`Loaded`})}},$s={command:`global-warp-override`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Xs).command(Qs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ec={command:`resilience`,describe:`Operations for devices.resilience`,builder:e=>e.command($s).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function tc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`A list of Registration IDs to revoke.`})}const nc={command:`create`,describe:`Revokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/revoke instead.`,builder:tc,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust devices revoke create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/revoke`,pathParams:{},bodyKind:`json`,body:{body:t.body}});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force,message:`This operation revokes sessions for a batch of devices destructively.`})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body);l(await d(`Deleting`,async()=>n.post(`/accounts/${a}/devices/revoke`,{body:e})),{successLabel:`Deleted`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},rc={command:`revoke`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(nc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ic(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ac={command:`delete`,describe:`Resets the current device settings for a Zero Trust account.`,builder:ic,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust devices settings delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.devices.settings.delete(a)),{successLabel:`Deleted`})}};function oc(e){return e.option(`disable-for-time`,{type:`number`,description:`Sets the time limit, in seconds, that a user can use an override code to bypass WARP.`}).option(`external-emergency-signal-enabled`,{type:`boolean`,description:`Controls whether the external emergency disconnect feature is enabled.`}).option(`external-emergency-signal-fingerprint`,{type:`string`,description:`The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.`}).option(`external-emergency-signal-interval`,{type:`string`,description:`The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.`}).option(`external-emergency-signal-url`,{type:`string`,description:`The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.`}).option(`gateway-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on TCP.`}).option(`gateway-udp-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on UDP.`}).option(`root-certificate-installation-enabled`,{type:`boolean`,description:`Enable installation of cloudflare managed root certificate.`}).option(`use-zt-virtual-ip`,{type:`boolean`,description:`Enable using CGNAT virtual IPv4.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const sc={command:`edit`,describe:`Patches the current device settings for a Zero Trust account.`,builder:oc,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`json`,body:{"disable-for-time":e[`disable-for-time`],"external-emergency-signal-enabled":e[`external-emergency-signal-enabled`],"external-emergency-signal-fingerprint":e[`external-emergency-signal-fingerprint`],"external-emergency-signal-interval":e[`external-emergency-signal-interval`],"external-emergency-signal-url":e[`external-emergency-signal-url`],"gateway-proxy-enabled":e[`gateway-proxy-enabled`],"gateway-udp-proxy-enabled":e[`gateway-udp-proxy-enabled`],"root-certificate-installation-enabled":e[`root-certificate-installation-enabled`],"use-zt-virtual-ip":e[`use-zt-virtual-ip`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/devices/settings`,{body:r})),{successLabel:`Updated`});return}let a={};e[`disable-for-time`]!==void 0&&s(a,[`disable_for_time`],e[`disable-for-time`]),e[`external-emergency-signal-enabled`]!==void 0&&s(a,[`external_emergency_signal_enabled`],e[`external-emergency-signal-enabled`]),e[`external-emergency-signal-fingerprint`]!==void 0&&s(a,[`external_emergency_signal_fingerprint`],f(e[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`)),e[`external-emergency-signal-interval`]!==void 0&&s(a,[`external_emergency_signal_interval`],f(e[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`)),e[`external-emergency-signal-url`]!==void 0&&s(a,[`external_emergency_signal_url`],f(e[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`)),e[`gateway-proxy-enabled`]!==void 0&&s(a,[`gateway_proxy_enabled`],e[`gateway-proxy-enabled`]),e[`gateway-udp-proxy-enabled`]!==void 0&&s(a,[`gateway_udp_proxy_enabled`],e[`gateway-udp-proxy-enabled`]),e[`root-certificate-installation-enabled`]!==void 0&&s(a,[`root_certificate_installation_enabled`],e[`root-certificate-installation-enabled`]),e[`use-zt-virtual-ip`]!==void 0&&s(a,[`use_zt_virtual_ip`],e[`use-zt-virtual-ip`]),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/devices/settings`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}};function cc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lc={command:`get`,describe:`Describes the current device settings for a Zero Trust account.`,builder:cc,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.devices.settings.get(n)),{successLabel:`Loaded`})}};function uc(e){return e.option(`disable-for-time`,{type:`number`,description:`Sets the time limit, in seconds, that a user can use an override code to bypass WARP.`}).option(`external-emergency-signal-enabled`,{type:`boolean`,description:`Controls whether the external emergency disconnect feature is enabled.`}).option(`external-emergency-signal-fingerprint`,{type:`string`,description:`The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.`}).option(`external-emergency-signal-interval`,{type:`string`,description:`The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.`}).option(`external-emergency-signal-url`,{type:`string`,description:`The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.`}).option(`gateway-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on TCP.`}).option(`gateway-udp-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on UDP.`}).option(`root-certificate-installation-enabled`,{type:`boolean`,description:`Enable installation of cloudflare managed root certificate.`}).option(`use-zt-virtual-ip`,{type:`boolean`,description:`Enable using CGNAT virtual IPv4.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const dc={command:`update`,describe:`Updates the current device settings for a Zero Trust account.`,builder:uc,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`json`,body:{"disable-for-time":e[`disable-for-time`],"external-emergency-signal-enabled":e[`external-emergency-signal-enabled`],"external-emergency-signal-fingerprint":e[`external-emergency-signal-fingerprint`],"external-emergency-signal-interval":e[`external-emergency-signal-interval`],"external-emergency-signal-url":e[`external-emergency-signal-url`],"gateway-proxy-enabled":e[`gateway-proxy-enabled`],"gateway-udp-proxy-enabled":e[`gateway-udp-proxy-enabled`],"root-certificate-installation-enabled":e[`root-certificate-installation-enabled`],"use-zt-virtual-ip":e[`use-zt-virtual-ip`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/devices/settings`,{body:r})),{successLabel:`Updated`});return}let a={};e[`disable-for-time`]!==void 0&&s(a,[`disable_for_time`],e[`disable-for-time`]),e[`external-emergency-signal-enabled`]!==void 0&&s(a,[`external_emergency_signal_enabled`],e[`external-emergency-signal-enabled`]),e[`external-emergency-signal-fingerprint`]!==void 0&&s(a,[`external_emergency_signal_fingerprint`],f(e[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`)),e[`external-emergency-signal-interval`]!==void 0&&s(a,[`external_emergency_signal_interval`],f(e[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`)),e[`external-emergency-signal-url`]!==void 0&&s(a,[`external_emergency_signal_url`],f(e[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`)),e[`gateway-proxy-enabled`]!==void 0&&s(a,[`gateway_proxy_enabled`],e[`gateway-proxy-enabled`]),e[`gateway-udp-proxy-enabled`]!==void 0&&s(a,[`gateway_udp_proxy_enabled`],e[`gateway-udp-proxy-enabled`]),e[`root-certificate-installation-enabled`]!==void 0&&s(a,[`root_certificate_installation_enabled`],e[`root-certificate-installation-enabled`]),e[`use-zt-virtual-ip`]!==void 0&&s(a,[`use_zt_virtual_ip`],e[`use-zt-virtual-ip`]),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/devices/settings`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},fc={command:`settings`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(ac).command(sc).command(lc).command(dc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A list of Registration IDs to unrevoke.`})}const mc={command:`create`,describe:`Unrevokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/unrevoke instead.`,builder:pc,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust devices unrevoke create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/devices/unrevoke`,pathParams:{},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/devices/unrevoke`,{body:r})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},hc={command:`unrevoke`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(mc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},gc={command:`devices`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(za).command(Qa).command(na).command(ma).command(Ca).command(Pa).command(La).command(Xa).command(lo).command(ho).command(ps).command(Fs).command(Js).command(ec).command(rc).command(fc).command(hc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function _c(e){return e.option(`from`,{type:`string`,description:`Start time for connection period in ISO (RFC3339 - ISO 8601) format`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for connection period in ISO (RFC3339 - ISO 8601) format`,demandOption:!0}).option(`sort-by`,{type:`string`,description:`Type of usage that colos should be sorted by. If unspecified, returns all Cloudflare colos sorted alphabetically.`,choices:[`fleet-status-usage`,`application-tests-usage`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const vc={command:`list`,describe:`List Cloudflare colos that account's devices were connected to during a time period, sorted by usage starting from the most used colo. Colos without traffic are also returned and sorted alphabetically.`,builder:_c,handler:async e=>{let t={from:e.from,to:e.to,sortBy:e[`sort-by`]};if(e.dryRun){u({command:`cf zero-trust dex colos list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/colos`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.dex.colos.list(a,t)),{successLabel:`Loaded`})}},yc={command:`colos`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(vc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xc={command:`create`,describe:`Initiate commands for up to 10 devices per account`,builder:bc,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dex commands create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/commands`,pathParams:{},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/dex/commands`,{body:r})),{successLabel:`Created`});return}l(await d(`Creating`,async()=>t.zeroTrust.dex.commands.create(n)),{successLabel:`Created`})}};function Sc(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of items per page`,demandOption:!0}).option(`search`,{type:`string`,description:`Filter devices by name or email`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cc={command:`list`,describe:`List devices with WARP client support for remote captures which have been connected in the last 1 hour.`,builder:Sc,handler:async e=>{let t={page:e.page,per_page:e[`per-page`],search:e.search};if(e.dryRun){u({command:`cf zero-trust dex commands devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/commands/devices`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.dex.commands.devices.list(a,t)),{successLabel:`Loaded`})}},wc={command:`devices`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(Cc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Tc(e){return e.positional(`filename`,{type:`string`,description:"The name of the file to be downloaded, including the `.zip` extension",demandOption:!0}).option(`command-id`,{type:`string`,description:`Unique identifier for command`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`text`,{type:`boolean`,description:`Decode the response body as UTF-8 text instead of writing raw bytes`,default:!1})}const Ec={command:`get <filename>`,describe:`Downloads artifacts for an executed command. Bulk downloads are not supported`,builder:Tc,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dex commands downloads get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/commands/${e[`command-id`]==null?`<command-id>`:encodeURIComponent(String(e[`command-id`]))}/downloads/${e.filename==null?`<filename>`:encodeURIComponent(String(e.filename))}`,pathParams:{"command-id":String(e[`command-id`]??``),filename:String(e.filename??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n;let a=await d(`Loading`,async()=>g(`/accounts/${n}/dex/commands/${encodeURIComponent(String(e[`command-id`]))}/downloads/${encodeURIComponent(String(e.filename))}`,{method:`GET`,localEndpoint:e.local?e.localEndpoint:void 0}));h(e.text===!0?a.toString(`utf-8`):a)}},Dc={command:`downloads`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(Ec).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Oc(e){return e.option(`page`,{type:`number`,description:`Page number for pagination`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format`}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format`}).option(`device-id`,{type:`string`,description:`Unique identifier for a device`}).option(`user-email`,{type:`string`,description:`Email tied to the device`}).option(`command-type`,{type:`string`,description:`Optionally filter executed commands by command type`}).option(`status`,{type:`string`,description:`Optionally filter executed commands by status`,choices:[`PENDING_EXEC`,`PENDING_UPLOAD`,`SUCCESS`,`FAILED`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const kc={command:`list`,describe:`Retrieves a paginated list of commands issued to devices under the specified account, optionally filtered by time range, device, or other parameters`,builder:Oc,handler:async e=>{let t={page:e.page,per_page:e[`per-page`],from:e.from,to:e.to,device_id:e[`device-id`],user_email:e[`user-email`],command_type:e[`command-type`],status:e.status};if(e.dryRun){u({command:`cf zero-trust dex commands list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/commands`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.dex.commands.list(a,t)),{successLabel:`Loaded`})}};function Ac(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const jc={command:`get`,describe:`Retrieves the current quota usage and limits for device commands within a specific account, including the time when the quota will reset`,builder:Ac,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dex commands quota get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/commands/quota`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dex.commands.quota.get(n)),{successLabel:`Loaded`})}},Mc={command:`quota`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(jc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Nc={command:`commands`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(xc).command(kc).command(wc).command(Dc).command(Mc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Pc(e){return e.option(`to`,{type:`string`,description:`Time range end in ISO format`,demandOption:!0}).option(`from`,{type:`string`,description:`Time range beginning in ISO format`,demandOption:!0}).option(`page`,{type:`string`,description:`Page number`,demandOption:!0}).option(`per-page`,{type:`string`,description:`Number of results per page`,demandOption:!0}).option(`sort-by`,{type:`string`,description:`Dimension to sort results by`,choices:[`colo`,`device_id`,`mode`,`platform`,`status`,`timestamp`,`version`]}).option(`colo`,{type:`string`,description:`Cloudflare colo`}).option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID v4`}).option(`mode`,{type:`string`,description:`The mode under which the WARP client is run`}).option(`status`,{type:`string`,description:`Network status`}).option(`platform`,{type:`string`,description:`Operating system`}).option(`version`,{type:`string`,description:`WARP client version`}).option(`source`,{type:`string`,description:"Source:\n  * `hourly` - device details aggregated hourly, up to 7 days prior\n  * `last_seen` - device details, up to 60 minutes prior. Time windows exceeding 60 minutes will be rejected from June 1st, 2026. Please use 'hourly' or 'raw' instead for longer time ranges.\n  * `raw` - device details, up to 7 days prior",choices:[`last_seen`,`hourly`,`raw`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fc={command:`list`,describe:`List details for devices using WARP`,builder:Pc,handler:async e=>{let t={to:e.to,from:e.from,page:e.page,per_page:e[`per-page`],sort_by:e[`sort-by`],colo:e.colo,device_id:e[`device-id`],mode:e.mode,status:e.status,platform:e.platform,version:e.version,source:e.source};if(e.dryRun){u({command:`cf zero-trust dex fleet-status devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/fleet-status/devices`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.dex.fleetStatus.devices.list(a,t)),{successLabel:`Loaded`})}},Ic={command:`devices`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(Fc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Lc(e){return e.option(`since-minutes`,{type:`string`,description:`Number of minutes before current time`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Rc={command:`live`,describe:`List details for live (up to 60 minutes) devices using WARP`,builder:Lc,handler:async e=>{let t={since_minutes:e[`since-minutes`]};if(e.dryRun){u({command:`cf zero-trust dex fleet-status live`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/fleet-status/live`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.dex.fleetStatus.live(a,t)),{successLabel:`Loaded`})}};function zc(e){return e.option(`to`,{type:`string`,description:`Time range end in ISO format`,demandOption:!0}).option(`from`,{type:`string`,description:`Time range beginning in ISO format`,demandOption:!0}).option(`colo`,{type:`string`,description:`Cloudflare colo`}).option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID v4`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bc={command:`over-time`,describe:`List details for devices using WARP, up to 7 days`,builder:zc,handler:async e=>{let t={to:e.to,from:e.from,colo:e.colo,device_id:e[`device-id`]};if(e.dryRun){u({command:`cf zero-trust dex fleet-status over-time`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/fleet-status/over-time`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.dex.fleetStatus.overTime(a,t)),{successLabel:`Loaded`})}},Vc={command:`fleet-status`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(Rc).command(Bc).command(Ic).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Hc(e){return e.positional(`test-id`,{type:`string`,description:`unique identifier for a specific test`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Uc={command:`get <test-id>`,describe:`Get test details and aggregate performance metrics for an http test for a given time period between 1 hour and 7 days.`,builder:Hc,handler:async e=>{let t={deviceId:e[`device-id`],from:e.from,to:e.to,interval:e.interval,colo:e.colo};if(e.dryRun){u({command:`cf zero-trust dex http-tests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/http-tests/${e[`test-id`]==null?`<test-id>`:encodeURIComponent(String(e[`test-id`]))}`,pathParams:{"test-id":String(e[`test-id`]??``)},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.dex.httpTests.get(a,e[`test-id`],t)),{successLabel:`Loaded`})}};function Wc(e){return e.positional(`test-id`,{type:`string`,description:`unique identifier for a specific test`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format`,demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gc={command:`get <test-id>`,describe:`Get percentiles for an http test for a given time period between 1 hour and 7 days.`,builder:Wc,handler:async e=>{let t={deviceId:e[`device-id`],from:e.from,to:e.to,colo:e.colo};if(e.dryRun){u({command:`cf zero-trust dex http-tests percentiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/http-tests/${e[`test-id`]==null?`<test-id>`:encodeURIComponent(String(e[`test-id`]))}/percentiles`,pathParams:{"test-id":String(e[`test-id`]??``)},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.dex.httpTests.percentiles.get(a,e[`test-id`],t)),{successLabel:`Loaded`})}},Kc={command:`percentiles`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(Gc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},qc={command:`http-tests`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(Uc).command(Kc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Jc(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`match`,{type:`string`,description:`The wirefilter expression to match.`}).option(`name`,{type:`string`,description:`The name of the Rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Yc={command:`create`,describe:`Create a DEX Rule`,builder:Jc,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dex rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/rules`,pathParams:{},bodyKind:`json`,body:{description:e.description,match:e.match,name:e.name,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dex/rules`,{body:t})),{successLabel:`Created`});return}e.match===void 0&&(e.match=await t(`match`,`The wirefilter expression to match.`)),e.name===void 0&&(e.name=await t(`name`,`The name of the Rule.`));let p={};e.description!==void 0&&s(p,[`description`],f(e.description,`description`,`text`)),e.match!==void 0&&s(p,[`match`],f(e.match,`match`,`text`)),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dex/rules`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function Xc(e){return e.positional(`rule-id`,{type:`string`,description:`unique identifier of the rule`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Zc={command:`delete <rule-id>`,describe:`Delete a DEX Rule`,builder:Xc,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust dex rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/rules/${t[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(t[`rule-id`]))}`,pathParams:{"rule-id":String(t[`rule-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.dex.rules.delete(a,t[`rule-id`])),{successLabel:`Deleted`})}};function Qc(e){return e.positional(`rule-id`,{type:`string`,description:`unique identifier of the rule`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $c={command:`get <rule-id>`,describe:`Get details for a DEX Rule`,builder:Qc,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dex rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dex.rules.get(n,e[`rule-id`])),{successLabel:`Loaded`})}};function el(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of items per page`,demandOption:!0}).option(`sort-order`,{type:`string`,description:`Sort direction for sort_by property`,choices:[`ASC`,`DESC`]}).option(`sort-by`,{type:`string`,description:`Which property to sort results by`,choices:[`name`,`created_at`,`updated_at`]}).option(`name`,{type:`string`,description:`Filter results by rule name`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const tl={command:`list`,describe:`List DEX Rules`,builder:el,handler:async e=>{let t={page:e.page,per_page:e[`per-page`],sort_order:e[`sort-order`],sort_by:e[`sort-by`],name:e.name};if(e.dryRun){u({command:`cf zero-trust dex rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/rules`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.dex.rules.list(a,t)),{successLabel:`Loaded`})}};function nl(e){return e.positional(`rule-id`,{type:`string`,description:`unique identifier of the rule`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`match`,{type:`string`,description:`The wirefilter expression to match.`}).option(`name`,{type:`string`,description:`The name of the Rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const rl={command:`update <rule-id>`,describe:`Update a DEX Rule`,builder:nl,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dex rules update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`json`,body:{description:e.description,match:e.match,name:e.name,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/dex/rules/${encodeURIComponent(String(e[`rule-id`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e.description!==void 0&&s(a,[`description`],f(e.description,`description`,`text`)),e.match!==void 0&&s(a,[`match`],f(e.match,`match`,`text`)),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/dex/rules/${encodeURIComponent(String(e[`rule-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},il={command:`rules`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(Yc).command(Zc).command($c).command(tl).command(rl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function al(e){return e.option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`test-name`,{type:`string`,description:`Optionally filter results by test name`}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`registration-id`,{type:`string`,description:`Optionally filter results to a specific device registration. Must be used in combination with a single deviceId.`}).option(`page`,{type:`number`,description:`Page number of paginated results`}).option(`per-page`,{type:`number`,description:`Number of items per page`}).option(`kind`,{type:`string`,description:`Filter by test type`,choices:[`http`,`traceroute`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ol={command:`list`,describe:`List DEX tests with overview metrics`,builder:al,handler:async e=>{let t={colo:e.colo,testName:e[`test-name`],deviceId:e[`device-id`],registration_id:e[`registration-id`],page:e.page,per_page:e[`per-page`],kind:e.kind};if(e.dryRun){u({command:`cf zero-trust dex tests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/tests/overview`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.dex.tests.list(a,t)),{successLabel:`Loaded`})}};function sl(e){return e.option(`test-name`,{type:`string`,description:`Optionally filter results by test name`}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const cl={command:`list`,describe:`Returns unique count of devices that have run synthetic application monitoring tests in the past 7 days.`,builder:sl,handler:async e=>{let t={testName:e[`test-name`],deviceId:e[`device-id`]};if(e.dryRun){u({command:`cf zero-trust dex tests unique-devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/tests/unique-devices`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.dex.tests.uniqueDevices.list(a,t)),{successLabel:`Loaded`})}},ll={command:`unique-devices`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(cl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ul={command:`tests`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(ol).command(ll).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function dl(e){return e.positional(`test-result-id`,{type:`string`,description:`unique identifier for a specific traceroute test`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fl={command:`get <test-result-id>`,describe:`Get a breakdown of hops and performance metrics for a specific traceroute test run`,builder:dl,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dex traceroute-test-results network-path get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/traceroute-test-results/${e[`test-result-id`]==null?`<test-result-id>`:encodeURIComponent(String(e[`test-result-id`]))}/network-path`,pathParams:{"test-result-id":String(e[`test-result-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dex.tracerouteTestResults.networkPath.get(n,e[`test-result-id`])),{successLabel:`Loaded`})}},pl={command:`network-path`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(fl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ml={command:`traceroute-test-results`,describe:`Operations for dex.traceroute-test-results`,builder:e=>e.command(pl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function hl(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gl={command:`get <test-id>`,describe:`Get test details and aggregate performance metrics for an traceroute test for a given time period between 1 hour and 7 days.`,builder:hl,handler:async e=>{let t={deviceId:e[`device-id`],from:e.from,to:e.to,interval:e.interval,colo:e.colo};if(e.dryRun){u({command:`cf zero-trust dex traceroute-tests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/traceroute-tests/${e[`test-id`]==null?`<test-id>`:encodeURIComponent(String(e[`test-id`]))}`,pathParams:{"test-id":String(e[`test-id`]??``)},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.dex.tracerouteTests.get(a,e[`test-id`],t)),{successLabel:`Loaded`})}};function _l(e){return e.positional(`test-id`,{type:`string`,description:`unique identifier for a specific test`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Device to filter tracroute result runs to`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const vl={command:`network-path <test-id>`,describe:`Get a breakdown of metrics by hop for individual traceroute test runs`,builder:_l,handler:async e=>{let t={deviceId:e[`device-id`],from:e.from,to:e.to,interval:e.interval};if(e.dryRun){u({command:`cf zero-trust dex traceroute-tests network-path`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/traceroute-tests/${e[`test-id`]==null?`<test-id>`:encodeURIComponent(String(e[`test-id`]))}/network-path`,pathParams:{"test-id":String(e[`test-id`]??``)},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.dex.tracerouteTests.networkPath(a,e[`test-id`],t)),{successLabel:`Loaded`})}};function yl(e){return e.positional(`test-id`,{type:`string`,description:`unique identifier for a specific test`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format`,demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const bl={command:`percentiles <test-id>`,describe:`Get percentiles for a traceroute test for a given time period between 1 hour and 7 days.`,builder:yl,handler:async e=>{let t={deviceId:e[`device-id`],from:e.from,to:e.to,colo:e.colo};if(e.dryRun){u({command:`cf zero-trust dex traceroute-tests percentiles`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/traceroute-tests/${e[`test-id`]==null?`<test-id>`:encodeURIComponent(String(e[`test-id`]))}/percentiles`,pathParams:{"test-id":String(e[`test-id`]??``)},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.dex.tracerouteTests.percentiles(a,e[`test-id`],t)),{successLabel:`Loaded`})}},xl={command:`traceroute-tests`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(gl).command(vl).command(bl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Sl(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of items per page`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format`,demandOption:!0}).option(`type`,{type:`string`,description:`Filter events by type 'config' or 'toggle'`,choices:[`config`,`toggle`]}).option(`toggle`,{type:`string`,description:`Filter events by type toggle value. Applicable to type='toggle' events only.`,choices:[`on`,`off`]}).option(`config-name`,{type:`string`,description:`Filter events by WARP configuration name changed from or to. Applicable to type='config' events only.`}).option(`account-name`,{type:`string`,description:`Filter events by account name.`}).option(`sort-order`,{type:`string`,description:`Sort response by event timestamp.`,choices:[`ASC`,`DESC`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cl={command:`get`,describe:`List WARP configuration and enablement toggle change events by device.`,builder:Sl,handler:async e=>{let t={page:e.page,per_page:e[`per-page`],from:e.from,to:e.to,type:e.type,toggle:e.toggle,config_name:e[`config-name`],account_name:e[`account-name`],sort_order:e[`sort-order`]};if(e.dryRun){u({command:`cf zero-trust dex warp-change-events get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dex/warp-change-events`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.dex.warpChangeEvents.get(a,t)),{successLabel:`Loaded`})}},wl={command:`warp-change-events`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(Cl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Tl={command:`dex`,describe:`Operations for dex`,builder:e=>e.command(yc).command(Nc).command(Vc).command(qc).command(il).command(ul).command(ml).command(xl).command(wl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function El(e){return e.option(`case-sensitive`,{type:`boolean`,description:`Only applies to custom word lists.
+Determines if the words should be matched in a case-sensitive manner
+Cannot be set to false if \`secret\` is true or undefined`}).option(`description`,{type:`string`,description:`The description of the dataset.`}).option(`encoding-version`,{type:`number`,description:`Dataset encoding version
+
+Non-secret custom word lists with no header are always version 1.
+Secret EDM lists with no header are version 1.
+Multicolumn CSV with headers are version 2.
+Omitting this field provides the default value 0, which is interpreted
+the same as 1.`}).option(`name`,{type:`string`,description:`The name field`}).option(`secret`,{type:`boolean`,description:`Generate a secret dataset.
+
+If true, the response will include a secret to use with the EDM encoder.
+If false, the response has no secret and the dataset is uploaded in plaintext.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset description.`})}const Dl={command:`create`,describe:`Creates a new DLP (Data Loss Prevention) dataset for storing custom detection patterns. Datasets can contain exact match data, word lists, or EDM (Exact Data Match) configurations.`,builder:El,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp datasets create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/datasets`,pathParams:{},bodyKind:`json`,body:{"case-sensitive":e[`case-sensitive`],description:e.description,"encoding-version":e[`encoding-version`],name:e.name,secret:e.secret,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/datasets`,{body:t})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await t(`name`,`The name field`));let p={};e[`case-sensitive`]!==void 0&&s(p,[`case_sensitive`],e[`case-sensitive`]),e.description!==void 0&&s(p,[`description`],f(e.description,`description`,`text`)),e[`encoding-version`]!==void 0&&s(p,[`encoding_version`],e[`encoding-version`]),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),e.secret!==void 0&&s(p,[`secret`],e.secret),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/datasets`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function Ol(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const kl={command:`delete <dataset-id>`,describe:`This deletes all versions of the dataset.`,builder:Ol,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust dlp datasets delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/datasets/${t[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(t[`dataset-id`]))}`,pathParams:{"dataset-id":String(t[`dataset-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.dlp.datasets.delete(a,t[`dataset-id`])),{successLabel:`Deleted`})}};function Al(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const jl={command:`get <dataset-id>`,describe:`Retrieves detailed information about a specific DLP dataset, including its type, status, and entry count.`,builder:Al,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp datasets get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}`,pathParams:{"dataset-id":String(e[`dataset-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.datasets.get(n,e[`dataset-id`])),{successLabel:`Loaded`})}};function Ml(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Nl={command:`list`,describe:`Lists all DLP datasets configured for the account, including custom word lists and EDM datasets.`,builder:Ml,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp datasets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/datasets`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.datasets.list(n)),{successLabel:`Loaded`})}};function Pl(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`case-sensitive`,{type:`boolean`,description:`Determines if the words should be matched in a case-sensitive manner.
+
+Only required for custom word lists.`}).option(`description`,{type:`string`,description:`The description of the dataset.`}).option(`name`,{type:`string`,description:`The name of the dataset, must be unique.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset description.`})}const Fl={command:`update <dataset-id>`,describe:`Updates the configuration of an existing DLP dataset, such as its name, description, or detection settings.`,builder:Pl,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp datasets update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}`,pathParams:{"dataset-id":String(e[`dataset-id`]??``)},bodyKind:`json`,body:{"case-sensitive":e[`case-sensitive`],description:e.description,name:e.name,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/datasets/${encodeURIComponent(String(e[`dataset-id`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e[`case-sensitive`]!==void 0&&s(a,[`case_sensitive`],e[`case-sensitive`]),e.description!==void 0&&s(a,[`description`],f(e.description,`description`,`text`)),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/datasets/${encodeURIComponent(String(e[`dataset-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}};function Il(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ll={command:`create <dataset-id>`,describe:`Creates a new version of a DLP dataset, allowing you to stage changes before activation. Used for single-column EDM and custom word lists.`,builder:Il,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp datasets upload create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}/upload`,pathParams:{"dataset-id":String(e[`dataset-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Creating`,async()=>t.zeroTrust.dlp.datasets.upload.create(n,e[`dataset-id`])),{successLabel:`Created`})}};function Rl(e){return e.positional(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset. For custom wordlists this contains UTF-8 patterns separated by newline characters.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const zl={command:`edit <version>`,describe:`This is used for single-column EDMv1 and Custom Word Lists. The EDM format can only be created in the Cloudflare dashboard. For other clients, this operation can only be used for non-secret Custom Word Lists. The body must be a UTF-8 encoded, newline (NL or CRNL) separated list of words to be matched.`,builder:Rl,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp datasets upload edit`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}/upload/${e.version==null?`<version>`:encodeURIComponent(String(e.version))}`,pathParams:{"dataset-id":String(e[`dataset-id`]??``),version:String(e.version??``)},bodyKind:`octet-stream`,body:{body:e.body,file:e.file}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.file){let r=p(e.file);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/dlp/datasets/${encodeURIComponent(String(e[`dataset-id`]))}/upload/${encodeURIComponent(String(e.version))}`,{body:r,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(e.body){let r=f(e.body,`body`,`binary`);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/dlp/datasets/${encodeURIComponent(String(e[`dataset-id`]))}/upload/${encodeURIComponent(String(e.version))}`,{body:r,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Bl={command:`upload`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Ll).command(zl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Vl(e){return e.positional(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`array of new columns to create for this dataset version.`})}const Hl={command:`create <version>`,describe:`This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. The columns in the response appear in the same order as in the request.`,builder:Vl,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp datasets versions create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}/versions/${e.version==null?`<version>`:encodeURIComponent(String(e.version))}`,pathParams:{"dataset-id":String(e[`dataset-id`]??``),version:String(e.version??``)},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/dlp/datasets/${encodeURIComponent(String(e[`dataset-id`]))}/versions/${encodeURIComponent(String(e.version))}`,{body:r})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Ul(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset content.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Wl={command:`create <entry-id>`,describe:`This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard.`,builder:Ul,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp datasets versions entries create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}/versions/${e.version==null?`<version>`:encodeURIComponent(String(e.version))}/entries/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"dataset-id":String(e[`dataset-id`]??``),version:String(e.version??``),"entry-id":String(e[`entry-id`]??``)},bodyKind:`octet-stream`,body:{body:e.body,file:e.file}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.file){let r=p(e.file);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/dlp/datasets/${encodeURIComponent(String(e[`dataset-id`]))}/versions/${encodeURIComponent(String(e.version))}/entries/${encodeURIComponent(String(e[`entry-id`]))}`,{body:r,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(e.body){let r=f(e.body,`body`,`binary`);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/dlp/datasets/${encodeURIComponent(String(e[`dataset-id`]))}/versions/${encodeURIComponent(String(e.version))}/entries/${encodeURIComponent(String(e[`entry-id`]))}`,{body:r,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Gl={command:`entries`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Wl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Kl={command:`versions`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Hl).command(Gl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ql={command:`datasets`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Dl).command(kl).command(jl).command(Nl).command(Fl).command(Bl).command(Kl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Jl(e){return e.option(`auth-requirements-allowed-microsoft-organizations`,{type:`string`,array:!0,description:`The auth_requirements.allowed_microsoft_organizations field`}).option(`auth-requirements-type`,{type:`string`,description:`The auth_requirements.type field`,choices:[`Org`,`NoAuth`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Account mapping.`})}const Yl={command:`create`,describe:`Creates a mapping between a Cloudflare account and an email provider for DLP email scanning integration.`,builder:Jl,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp email account-mapping create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/email/account_mapping`,pathParams:{},bodyKind:`json`,body:{"auth-requirements-allowed-microsoft-organizations":e[`auth-requirements-allowed-microsoft-organizations`],"auth-requirements-type":e[`auth-requirements-type`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/dlp/email/account_mapping`,{body:r})),{successLabel:`Created`});return}e[`auth-requirements-type`]===void 0&&(e[`auth-requirements-type`]=await a(`auth-requirements-type`,`The auth_requirements.type field`,[`Org`,`NoAuth`]));let p={};e[`auth-requirements-allowed-microsoft-organizations`]!==void 0&&s(p,[`auth_requirements`,`allowed_microsoft_organizations`],e[`auth-requirements-allowed-microsoft-organizations`]),e[`auth-requirements-type`]!==void 0&&s(p,[`auth_requirements`,`type`],f(e[`auth-requirements-type`],`auth-requirements-type`,`text`)),l(await d(`Creating`,async()=>t.post(`/accounts/${n}/dlp/email/account_mapping`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function Xl(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zl={command:`get`,describe:`Retrieves the email provider mapping configuration for DLP email scanning.`,builder:Xl,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp email account-mapping get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/email/account_mapping`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.email.accountMapping.get(n)),{successLabel:`Loaded`})}},Ql={command:`account-mapping`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Yl).command(Zl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $l(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule priorities.`})}const eu={command:`bulk-edit`,describe:`Reorders DLP email scanning rules by updating their priority values. Higher priority rules are evaluated first.`,builder:$l,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp email rules bulk-edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/dlp/email/rules`,{body:r})),{successLabel:`Updated`});return}l(await d(`Updating`,async()=>t.zeroTrust.dlp.email.rules.bulkEdit(n)),{successLabel:`Updated`})}};function tu(e){return e.option(`action-action`,{type:`string`,description:`The action.action field`,choices:[`Block`]}).option(`action-message`,{type:`string`,description:`The action.message field`}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule description.`})}const nu={command:`create`,describe:`Creates a new DLP email scanning rule that defines what content patterns to detect in email messages and what actions to take.`,builder:tu,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp email rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`json`,body:{"action-action":e[`action-action`],"action-message":e[`action-message`],description:e.description,enabled:e.enabled,name:e.name,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${p}/dlp/email/rules`,{body:t})),{successLabel:`Created`});return}if(e[`action-action`]===void 0&&(e[`action-action`]=await a(`action-action`,`The action.action field`,[`Block`])),e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);e.name===void 0&&(e.name=await t(`name`,`The name field`));let h={};e[`action-action`]!==void 0&&s(h,[`action`,`action`],f(e[`action-action`],`action-action`,`text`)),e[`action-message`]!==void 0&&s(h,[`action`,`message`],f(e[`action-message`],`action-message`,`text`)),e.description!==void 0&&s(h,[`description`],f(e.description,`description`,`text`)),e.enabled!==void 0&&s(h,[`enabled`],e.enabled),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${p}/dlp/email/rules`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created`})}};function ru(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const iu={command:`delete <rule-id>`,describe:`Removes a DLP email scanning rule. The rule will no longer be applied to email messages.`,builder:ru,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust dlp email rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/email/rules/${t[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(t[`rule-id`]))}`,pathParams:{"rule-id":String(t[`rule-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.dlp.email.rules.delete(a,t[`rule-id`])),{successLabel:`Deleted`})}};function au(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ou={command:`get <rule-id>`,describe:`Gets detailed configuration for a specific DLP email scanning rule, including detection patterns and actions.`,builder:au,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp email rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/email/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.email.rules.get(n,e[`rule-id`])),{successLabel:`Loaded`})}};function su(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const cu={command:`list`,describe:`Lists all email scanner rules for an account.`,builder:su,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp email rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.email.rules.list(n)),{successLabel:`Loaded`})}};function $(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`action-action`,{type:`string`,description:`The action.action field`,choices:[`Block`]}).option(`action-message`,{type:`string`,description:`The action.message field`}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule description.`})}const lu={command:`update <rule-id>`,describe:`Modifies an existing DLP email scanning rule, updating detection patterns, conditions, or actions.`,builder:$,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp email rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/email/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`json`,body:{"action-action":e[`action-action`],"action-message":e[`action-message`],description:e.description,enabled:e.enabled,name:e.name,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${p}/dlp/email/rules/${encodeURIComponent(String(e[`rule-id`]))}`,{body:t})),{successLabel:`Updated`});return}if(e[`action-action`]===void 0&&(e[`action-action`]=await a(`action-action`,`The action.action field`,[`Block`])),e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);e.name===void 0&&(e.name=await t(`name`,`The name field`));let h={};e[`action-action`]!==void 0&&s(h,[`action`,`action`],f(e[`action-action`],`action-action`,`text`)),e[`action-message`]!==void 0&&s(h,[`action`,`message`],f(e[`action-message`],`action-message`,`text`)),e.description!==void 0&&s(h,[`description`],f(e.description,`description`,`text`)),e.enabled!==void 0&&s(h,[`enabled`],e.enabled),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),l(await d(`Updating`,async()=>n.put(`/accounts/${p}/dlp/email/rules/${encodeURIComponent(String(e[`rule-id`]))}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated`})}},uu={command:`rules`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(eu).command(nu).command(iu).command(ou).command(cu).command(lu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},du={command:`email`,describe:`Operations for dlp.email`,builder:e=>e.command(Ql).command(uu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function fu(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new entry to create.`})}const pu={command:`create`,describe:`Creates a DLP custom entry.`,builder:fu,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp entries create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`json`,body:{description:e.description,enabled:e.enabled,name:e.name,"pattern-regex":e[`pattern-regex`],"profile-id":e[`profile-id`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/entries`,{body:t})),{successLabel:`Created`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);e.name===void 0&&(e.name=await t(`name`,`The name field`)),e[`pattern-regex`]===void 0&&(e[`pattern-regex`]=await t(`pattern-regex`,`The pattern.regex field`));let p={};e.description!==void 0&&s(p,[`description`],f(e.description,`description`,`text`)),e.enabled!==void 0&&s(p,[`enabled`],e.enabled),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),e[`pattern-regex`]!==void 0&&s(p,[`pattern`,`regex`],f(e[`pattern-regex`],`pattern-regex`,`text`)),e[`profile-id`]!==void 0&&s(p,[`profile_id`],f(e[`profile-id`],`profile-id`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/entries`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function mu(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new entry to create.`})}const hu={command:`create`,describe:`Creates a DLP custom entry.`,builder:mu,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp entries custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`json`,body:{description:e.description,enabled:e.enabled,name:e.name,"pattern-regex":e[`pattern-regex`],"profile-id":e[`profile-id`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/entries`,{body:t})),{successLabel:`Created`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);e.name===void 0&&(e.name=await t(`name`,`The name field`)),e[`pattern-regex`]===void 0&&(e[`pattern-regex`]=await t(`pattern-regex`,`The pattern.regex field`));let p={};e.description!==void 0&&s(p,[`description`],f(e.description,`description`,`text`)),e.enabled!==void 0&&s(p,[`enabled`],e.enabled),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),e[`pattern-regex`]!==void 0&&s(p,[`pattern`,`regex`],f(e[`pattern-regex`],`pattern-regex`,`text`)),e[`profile-id`]!==void 0&&s(p,[`profile_id`],f(e[`profile-id`],`profile-id`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/entries`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function gu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const _u={command:`delete <entry-id>`,describe:`Deletes a DLP custom entry.`,builder:gu,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust dlp entries custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries/${t[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(t[`entry-id`]))}`,pathParams:{"entry-id":String(t[`entry-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.dlp.entries.custom.delete(a,t[`entry-id`])),{successLabel:`Deleted`})}};function vu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yu={command:`get <entry-id>`,describe:`Fetches a DLP entry by ID.`,builder:vu,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp entries custom get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.entries.custom.get(n,e[`entry-id`])),{successLabel:`Loaded`})}};function bu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xu={command:`list`,describe:`Lists all DLP entries in an account.`,builder:bu,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp entries custom list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.entries.custom.list(n)),{successLabel:`Loaded`})}};function Su(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the entry.`})}const Cu={command:`update <entry-id>`,describe:`Updates a DLP custom entry.`,builder:Su,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp entries custom update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries/custom/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`json`,body:{description:e.description,name:e.name,"pattern-regex":e[`pattern-regex`],enabled:e.enabled,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${a}/dlp/entries/custom/${encodeURIComponent(String(e[`entry-id`]))}`,{body:t})),{successLabel:`Updated`});return}if(e.name===void 0&&(e.name=await t(`name`,`The name field`)),e[`pattern-regex`]===void 0&&(e[`pattern-regex`]=await t(`pattern-regex`,`The pattern.regex field`)),e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let p={};e.description!==void 0&&s(p,[`description`],f(e.description,`description`,`text`)),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),e[`pattern-regex`]!==void 0&&s(p,[`pattern`,`regex`],f(e[`pattern-regex`],`pattern-regex`,`text`)),e.enabled!==void 0&&s(p,[`enabled`],e.enabled),l(await d(`Updating`,async()=>n.put(`/accounts/${a}/dlp/entries/custom/${encodeURIComponent(String(e[`entry-id`]))}`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated`})}},wu={command:`custom`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(hu).command(_u).command(yu).command(xu).command(Cu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Tu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Eu={command:`delete <entry-id>`,describe:`Deletes a DLP custom entry.`,builder:Tu,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust dlp entries delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries/${t[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(t[`entry-id`]))}`,pathParams:{"entry-id":String(t[`entry-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.dlp.entries.delete(a,t[`entry-id`])),{successLabel:`Deleted`})}};function Du(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ou={command:`get <entry-id>`,describe:`Fetches a DLP entry by ID.`,builder:Du,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp entries get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.entries.get(n,e[`entry-id`])),{successLabel:`Loaded`})}};function ku(e){return e.option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`entry-id`,{type:`string`,description:`The entry_id field`}).option(`profile-id`,{type:`string`,description:`This field is not used as the owning profile.
+For predefined entries it is already set to a predefined profile.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`This endpoint will update an existing integration entry. It is not possible to create new integration entries.`})}const Au={command:`create`,describe:`Integration entries can't be created, this will update an existing integration entry. This is needed for our generated terraform API.`,builder:ku,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp entries integration create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries/integration`,pathParams:{},bodyKind:`json`,body:{enabled:e.enabled,"entry-id":e[`entry-id`],"profile-id":e[`profile-id`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/entries/integration`,{body:t})),{successLabel:`Created`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);e[`entry-id`]===void 0&&(e[`entry-id`]=await t(`entry-id`,`The entry_id field`));let p={};e.enabled!==void 0&&s(p,[`enabled`],e.enabled),e[`entry-id`]!==void 0&&s(p,[`entry_id`],f(e[`entry-id`],`entry-id`,`text`)),e[`profile-id`]!==void 0&&s(p,[`profile_id`],f(e[`profile-id`],`profile-id`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/entries/integration`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function ju(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Mu={command:`delete <entry-id>`,describe:`This is a no-op as integration entires can't be deleted but is needed for our generated terraform API.`,builder:ju,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust dlp entries integration delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries/integration/${t[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(t[`entry-id`]))}`,pathParams:{"entry-id":String(t[`entry-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.dlp.entries.integration.delete(a,t[`entry-id`])),{successLabel:`Deleted`})}};function Nu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pu={command:`get <entry-id>`,describe:`Fetches a DLP entry by ID.`,builder:Nu,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp entries integration get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.entries.integration.get(n,e[`entry-id`])),{successLabel:`Loaded`})}};function Fu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Iu={command:`list`,describe:`Lists all DLP entries in an account.`,builder:Fu,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp entries integration list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.entries.integration.list(n)),{successLabel:`Loaded`})}};function Lu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Enable or disable integration entry in owning profile.`})}const Ru={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:Lu,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp entries integration update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries/integration/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`json`,body:{enabled:e.enabled,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/entries/integration/${encodeURIComponent(String(e[`entry-id`]))}`,{body:r})),{successLabel:`Updated`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let a={};e.enabled!==void 0&&s(a,[`enabled`],e.enabled),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/entries/integration/${encodeURIComponent(String(e[`entry-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},zu={command:`integration`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Au).command(Mu).command(Pu).command(Iu).command(Ru).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vu={command:`list`,describe:`Lists all DLP entries in an account.`,builder:Bu,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp entries list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.entries.list(n)),{successLabel:`Loaded`})}};function Hu(e){return e.option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`entry-id`,{type:`string`,description:`The entry_id field`}).option(`profile-id`,{type:`string`,description:`This field is not used as the owning profile.
+For predefined entries it is already set to a predefined profile.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`This endpoint will update an existing predefined entry. It is not possible to create new predefined entries.`})}const Uu={command:`create`,describe:`Predefined entries can't be created, this will update an existing predefined entry. This is needed for our generated terraform API.`,builder:Hu,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp entries predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries/predefined`,pathParams:{},bodyKind:`json`,body:{enabled:e.enabled,"entry-id":e[`entry-id`],"profile-id":e[`profile-id`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/entries/predefined`,{body:t})),{successLabel:`Created`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);e[`entry-id`]===void 0&&(e[`entry-id`]=await t(`entry-id`,`The entry_id field`));let p={};e.enabled!==void 0&&s(p,[`enabled`],e.enabled),e[`entry-id`]!==void 0&&s(p,[`entry_id`],f(e[`entry-id`],`entry-id`,`text`)),e[`profile-id`]!==void 0&&s(p,[`profile_id`],f(e[`profile-id`],`profile-id`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/entries/predefined`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function Wu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Gu={command:`delete <entry-id>`,describe:`This is a no-op as predefined entires can't be deleted but is needed for our generated terraform API.`,builder:Wu,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust dlp entries predefined delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries/predefined/${t[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(t[`entry-id`]))}`,pathParams:{"entry-id":String(t[`entry-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.dlp.entries.predefined.delete(a,t[`entry-id`])),{successLabel:`Deleted`})}};function Ku(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qu={command:`get <entry-id>`,describe:`Fetches a DLP entry by ID.`,builder:Ku,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp entries predefined get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.entries.predefined.get(n,e[`entry-id`])),{successLabel:`Loaded`})}};function Ju(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yu={command:`list`,describe:`Lists all DLP entries in an account.`,builder:Ju,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp entries predefined list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.entries.predefined.list(n)),{successLabel:`Loaded`})}};function Xu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Settings to enable or disable predefined entry in owning profile.`})}const Zu={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:Xu,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp entries predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries/predefined/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`json`,body:{enabled:e.enabled,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/entries/predefined/${encodeURIComponent(String(e[`entry-id`]))}`,{body:r})),{successLabel:`Updated`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let a={};e.enabled!==void 0&&s(a,[`enabled`],e.enabled),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/entries/predefined/${encodeURIComponent(String(e[`entry-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},Qu={command:`predefined`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Uu).command(Gu).command(qu).command(Yu).command(Zu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $u(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the entry.`})}const ed={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:$u,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp entries update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/entries/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`json`,body:{enabled:e.enabled,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/entries/${encodeURIComponent(String(e[`entry-id`]))}`,{body:r})),{successLabel:`Updated`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let a={};e.enabled!==void 0&&s(a,[`enabled`],e.enabled),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/entries/${encodeURIComponent(String(e[`entry-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},td={command:`entries`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(pu).command(Eu).command(Ou).command(Vu).command(ed).command(wu).command(zu).command(Qu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function nd(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const rd={command:`list`,describe:`Retrieves current DLP usage limits and quotas for the account, including maximum allowed counts and current usage for custom entries, dataset cells, and document fingerprints.`,builder:nd,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp limits list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/limits`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.limits.list(n)),{successLabel:`Loaded`})}},id={command:`limits`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(rd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ad(e){return e.option(`max-match-bytes`,{type:`number`,description:"Maximum number of bytes that the regular expression can match.\n\nIf this is `null` then there is no limit on the length. Patterns can use\n`*` and `+`. Otherwise repeats should use a range `{m,n}` to restrict\npatterns to the length. If this field is missing, then a default length\nlimit is used.\n\nNote that the length is specified in bytes. Since regular expressions\nuse UTF-8 the pattern `.` can match up to 4 bytes. Hence `.{1,256}`\nhas a maximum length of 1024 bytes."}).option(`regex`,{type:`string`,description:`The regex field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Validation query.`})}const od={command:`validate`,describe:"Validates whether this pattern is a valid regular expression. Rejects it if the regular expression is too complex or can match an unbounded-length string. The regex will be rejected if it uses `*` or `+`. Bound the maximum number of characters that can be matched using a range, e.g. `{1,100}`.",builder:ad,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp patterns validate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/patterns/validate`,pathParams:{},bodyKind:`json`,body:{"max-match-bytes":e[`max-match-bytes`],regex:e.regex,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/patterns/validate`,{body:t})),{successLabel:`Created`});return}e.regex===void 0&&(e.regex=await t(`regex`,`The regex field`));let p={};e[`max-match-bytes`]!==void 0&&s(p,[`max_match_bytes`],e[`max-match-bytes`]),e.regex!==void 0&&s(p,[`regex`],f(e.regex,`regex`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/patterns/validate`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}},sd={command:`patterns`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(od).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cd(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ld={command:`get`,describe:`Gets the current payload logging configuration for DLP, showing whether matched content is being logged.`,builder:cd,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp payload-logs get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/payload_log`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.payloadLogs.get(n)),{successLabel:`Loaded`})}};function ud(e){return e.option(`public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
+
+- Set to null or empty string to disable payload logging.
+- Set to a non-empty base64 string to enable payload logging with the given key.
+
+For customers with configurable payload masking feature rolled out:
+- If the field is missing, the existing setting will be kept. Note that this is different from setting to null or empty string.
+
+For all other customers:
+- If the field is missing, the existing setting will be cleared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`New payload log settings.`})}const dd={command:`update`,describe:`Enables or disables payload logging for DLP matches. When enabled, matched content is stored for review.`,builder:ud,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp payload-logs update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/payload_log`,pathParams:{},bodyKind:`json`,body:{"public-key":e[`public-key`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/payload_log`,{body:r})),{successLabel:`Updated`});return}let a={};e[`public-key`]!==void 0&&s(a,[`public_key`],f(e[`public-key`],`public-key`,`text`)),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/payload_log`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},fd={command:`payload-logs`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(ld).command(dd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pd(e){return e.option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`Related DLP policies will trigger when the match count exceeds the number set.`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`data-classes`,{type:`string`,array:!0,description:`Data class IDs to associate with the profile.`}).option(`data-tags`,{type:`string`,array:!0,description:`Data tag IDs to associate with the profile.`}).option(`description`,{type:`string`,description:`The description of the profile.`}).option(`name`,{type:`string`,description:`The name field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new profile to create.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const md={command:`create`,describe:`Creates a DLP custom profile.`,builder:pd,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp profiles custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/profiles/custom`,pathParams:{},bodyKind:`json`,body:{"ai-context-enabled":e[`ai-context-enabled`],"allowed-match-count":e[`allowed-match-count`],"confidence-threshold":e[`confidence-threshold`],"context-awareness-enabled":e[`context-awareness-enabled`],"context-awareness-skip-files":e[`context-awareness-skip-files`],"data-classes":e[`data-classes`],"data-tags":e[`data-tags`],description:e.description,name:e.name,"ocr-enabled":e[`ocr-enabled`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/profiles/custom`,{body:t})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await t(`name`,`The name field`));let p={};e[`ai-context-enabled`]!==void 0&&s(p,[`ai_context_enabled`],e[`ai-context-enabled`]),e[`allowed-match-count`]!==void 0&&s(p,[`allowed_match_count`],e[`allowed-match-count`]),e[`confidence-threshold`]!==void 0&&s(p,[`confidence_threshold`],f(e[`confidence-threshold`],`confidence-threshold`,`text`)),e[`context-awareness-enabled`]!==void 0&&s(p,[`context_awareness`,`enabled`],e[`context-awareness-enabled`]),e[`context-awareness-skip-files`]!==void 0&&s(p,[`context_awareness`,`skip`,`files`],e[`context-awareness-skip-files`]),e[`data-classes`]!==void 0&&s(p,[`data_classes`],e[`data-classes`]),e[`data-tags`]!==void 0&&s(p,[`data_tags`],e[`data-tags`]),e.description!==void 0&&s(p,[`description`],f(e.description,`description`,`text`)),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),e[`ocr-enabled`]!==void 0&&s(p,[`ocr_enabled`],e[`ocr-enabled`]),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/profiles/custom`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function hd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const gd={command:`delete <profile-id>`,describe:`Deletes a DLP custom profile.`,builder:hd,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust dlp profiles custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/profiles/custom/${t[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(t[`profile-id`]))}`,pathParams:{"profile-id":String(t[`profile-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.dlp.profiles.custom.delete(a,t[`profile-id`])),{successLabel:`Deleted`})}};function _d(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const vd={command:`get <profile-id>`,describe:`Fetches a custom DLP profile by id.`,builder:_d,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp profiles custom get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/profiles/custom/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.profiles.custom.get(n,e[`profile-id`])),{successLabel:`Loaded`})}};function yd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`data-classes`,{type:`string`,array:!0,description:`Data class IDs to associate with the profile. If omitted, existing associations are unchanged.`}).option(`data-tags`,{type:`string`,array:!0,description:`Data tag IDs to associate with the profile. If omitted, existing associations are unchanged.`}).option(`description`,{type:`string`,description:`The description of the profile.`}).option(`name`,{type:`string`,description:`The name field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the profile.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const bd={command:`update <profile-id>`,describe:`Updates a DLP custom profile.`,builder:yd,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp profiles custom update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/profiles/custom/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`json`,body:{"ai-context-enabled":e[`ai-context-enabled`],"allowed-match-count":e[`allowed-match-count`],"confidence-threshold":e[`confidence-threshold`],"context-awareness-enabled":e[`context-awareness-enabled`],"context-awareness-skip-files":e[`context-awareness-skip-files`],"data-classes":e[`data-classes`],"data-tags":e[`data-tags`],description:e.description,name:e.name,"ocr-enabled":e[`ocr-enabled`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${a}/dlp/profiles/custom/${encodeURIComponent(String(e[`profile-id`]))}`,{body:t})),{successLabel:`Updated`});return}e.name===void 0&&(e.name=await t(`name`,`The name field`));let p={};e[`ai-context-enabled`]!==void 0&&s(p,[`ai_context_enabled`],e[`ai-context-enabled`]),e[`allowed-match-count`]!==void 0&&s(p,[`allowed_match_count`],e[`allowed-match-count`]),e[`confidence-threshold`]!==void 0&&s(p,[`confidence_threshold`],f(e[`confidence-threshold`],`confidence-threshold`,`text`)),e[`context-awareness-enabled`]!==void 0&&s(p,[`context_awareness`,`enabled`],e[`context-awareness-enabled`]),e[`context-awareness-skip-files`]!==void 0&&s(p,[`context_awareness`,`skip`,`files`],e[`context-awareness-skip-files`]),e[`data-classes`]!==void 0&&s(p,[`data_classes`],e[`data-classes`]),e[`data-tags`]!==void 0&&s(p,[`data_tags`],e[`data-tags`]),e.description!==void 0&&s(p,[`description`],f(e.description,`description`,`text`)),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),e[`ocr-enabled`]!==void 0&&s(p,[`ocr_enabled`],e[`ocr-enabled`]),l(await d(`Updating`,async()=>n.put(`/accounts/${a}/dlp/profiles/custom/${encodeURIComponent(String(e[`profile-id`]))}`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated`})}},xd={command:`custom`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(md).command(gd).command(vd).command(bd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Sd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cd={command:`get <profile-id>`,describe:`Fetches a DLP profile by ID.`,builder:Sd,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp profiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/profiles/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.profiles.get(n,e[`profile-id`])),{successLabel:`Loaded`})}};function wd(e){return e.option(`all`,{type:`boolean`,description:`Return all profiles, including those that current account does not have access to.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Td={command:`list`,describe:`Lists all DLP profiles in an account.`,builder:wd,handler:async e=>{let t={all:e.all};if(e.dryRun){u({command:`cf zero-trust dlp profiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/profiles`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.dlp.profiles.list(a,t)),{successLabel:`Loaded`})}};function Ed(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`enabled-entries`,{type:`string`,array:!0,description:`The enabled_entries field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Predefined profiles can not be created. This endpoint will only update an existing predefined profiles settings.`})}const Dd={command:`create <profile-id>`,describe:"This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Creates a DLP predefined profile. Only supports enabling/disabling entries.",builder:Ed,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp profiles predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/profiles/predefined/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}/config`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`json`,body:{"ai-context-enabled":e[`ai-context-enabled`],"allowed-match-count":e[`allowed-match-count`],"confidence-threshold":e[`confidence-threshold`],"enabled-entries":e[`enabled-entries`],"ocr-enabled":e[`ocr-enabled`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/dlp/profiles/predefined/${encodeURIComponent(String(e[`profile-id`]))}/config`,{body:r})),{successLabel:`Created`});return}let a={};e[`ai-context-enabled`]!==void 0&&s(a,[`ai_context_enabled`],e[`ai-context-enabled`]),e[`allowed-match-count`]!==void 0&&s(a,[`allowed_match_count`],e[`allowed-match-count`]),e[`confidence-threshold`]!==void 0&&s(a,[`confidence_threshold`],f(e[`confidence-threshold`],`confidence-threshold`,`text`)),e[`enabled-entries`]!==void 0&&s(a,[`enabled_entries`],e[`enabled-entries`]),e[`ocr-enabled`]!==void 0&&s(a,[`ocr_enabled`],e[`ocr-enabled`]),l(await d(`Creating`,async()=>t.post(`/accounts/${n}/dlp/profiles/predefined/${encodeURIComponent(String(e[`profile-id`]))}/config`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Created`})}};function Od(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const kd={command:`delete <profile-id>`,describe:`This is a no-op as predefined profiles can't be deleted but is needed for our generated terraform API.`,builder:Od,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust dlp profiles predefined delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/profiles/predefined/${t[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(t[`profile-id`]))}`,pathParams:{"profile-id":String(t[`profile-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.dlp.profiles.predefined.delete(a,t[`profile-id`])),{successLabel:`Deleted`})}};function Ad(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const jd={command:`get <profile-id>`,describe:"This is similar to `get_predefined` but only returns entries that are enabled. This is needed for our terraform API Fetches a predefined DLP profile by id.",builder:Ad,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp profiles predefined get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/profiles/predefined/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}/config`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.dlp.profiles.predefined.get(n,e[`profile-id`])),{successLabel:`Loaded`})}};function Md(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`enabled-entries`,{type:`string`,array:!0,description:`The enabled_entries field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the predefined profile.`})}const Nd={command:`update <profile-id>`,describe:"This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Updates a DLP predefined profile. Only supports enabling/disabling entries.",builder:Md,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust dlp profiles predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/profiles/predefined/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}/config`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`json`,body:{"ai-context-enabled":e[`ai-context-enabled`],"allowed-match-count":e[`allowed-match-count`],"confidence-threshold":e[`confidence-threshold`],"enabled-entries":e[`enabled-entries`],"ocr-enabled":e[`ocr-enabled`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/profiles/predefined/${encodeURIComponent(String(e[`profile-id`]))}/config`,{body:r})),{successLabel:`Updated`});return}let a={};e[`ai-context-enabled`]!==void 0&&s(a,[`ai_context_enabled`],e[`ai-context-enabled`]),e[`allowed-match-count`]!==void 0&&s(a,[`allowed_match_count`],e[`allowed-match-count`]),e[`confidence-threshold`]!==void 0&&s(a,[`confidence_threshold`],f(e[`confidence-threshold`],`confidence-threshold`,`text`)),e[`enabled-entries`]!==void 0&&s(a,[`enabled_entries`],e[`enabled-entries`]),e[`ocr-enabled`]!==void 0&&s(a,[`ocr_enabled`],e[`ocr-enabled`]),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/profiles/predefined/${encodeURIComponent(String(e[`profile-id`]))}/config`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},Pd={command:`predefined`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Dd).command(kd).command(jd).command(Nd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Fd={command:`profiles`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Cd).command(Td).command(xd).command(Pd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Id={command:`dlp`,describe:`Operations for dlp`,builder:e=>e.command(ql).command(du).command(td).command(id).command(sd).command(fd).command(Fd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ld(e){return e.option(`description`,{type:`string`,description:`The description field`,default:``}).option(`match-percent`,{type:`number`,description:`The match_percent field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new document fingerprint.`})}const Rd={command:`fingerprints`,describe:`Creates a new document fingerprint for DLP scanning. Document fingerprints detect documents that are structurally similar to the uploaded sample.`,builder:Ld,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust document-fingerprints create document fingerprints`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/document_fingerprints`,pathParams:{},bodyKind:`json`,body:{description:e.description,"match-percent":e[`match-percent`],name:e.name,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/document_fingerprints`,{body:t})),{successLabel:`Created`});return}if(e[`match-percent`]===void 0)throw Error(`--match-percent is required (or pass --body with this field set).`);e.name===void 0&&(e.name=await t(`name`,`The name field`));let p={};e.description!==void 0&&s(p,[`description`],f(e.description,`description`,`text`)),e[`match-percent`]!==void 0&&s(p,[`match_percent`],e[`match-percent`]),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/document_fingerprints`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}},zd={command:`document`,describe:`Document Fingerprints operations`,builder:e=>e.command(Rd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bd(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`match-percent`,{type:`number`,description:`The match_percent field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the document fingerprint to update.`})}const Vd={command:`v2 <document-fingerprint-id>`,describe:`Updates metadata for an existing document fingerprint, such as its name or description.`,builder:Bd,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust document-fingerprints create v2`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/document_fingerprints/${e[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(e[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(e[`document-fingerprint-id`]??``)},bodyKind:`json`,body:{description:e.description,"match-percent":e[`match-percent`],name:e.name,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/dlp/document_fingerprints/${encodeURIComponent(String(e[`document-fingerprint-id`]))}`,{body:r})),{successLabel:`Created`});return}let a={};e.description!==void 0&&s(a,[`description`],f(e.description,`description`,`text`)),e[`match-percent`]!==void 0&&s(a,[`match_percent`],e[`match-percent`]),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),l(await d(`Creating`,async()=>t.post(`/accounts/${n}/dlp/document_fingerprints/${encodeURIComponent(String(e[`document-fingerprint-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Created`})}},Hd={command:`create`,describe:`Document Fingerprints operations`,builder:e=>e.command(Vd).command(zd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ud(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Wd={command:`delete <document-fingerprint-id>`,describe:`Removes a document fingerprint from DLP configuration. Documents matching this fingerprint will no longer be detected.`,builder:Ud,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust document-fingerprints delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/document_fingerprints/${t[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(t[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(t[`document-fingerprint-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.documentFingerprints.delete(a,t[`document-fingerprint-id`])),{successLabel:`Deleted`})}};function Gd(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kd={command:`fingerprints <document-fingerprint-id>`,describe:`Retrieve data about a specific document fingerprint.`,builder:Gd,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust document-fingerprints get document fingerprints`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/document_fingerprints/${e[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(e[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(e[`document-fingerprint-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.documentFingerprints.get.document.fingerprints(n,e[`document-fingerprint-id`])),{successLabel:`Loaded`})}},qd={command:`document`,describe:`Document Fingerprints operations`,builder:e=>e.command(Kd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Jd(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yd={command:`all`,describe:`Lists all document fingerprints configured for DLP scanning in the account.`,builder:Jd,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust document-fingerprints get fingerprints all`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/document_fingerprints`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.documentFingerprints.get.fingerprints.all(n)),{successLabel:`Loaded`})}},Xd={command:`fingerprints`,describe:`Document Fingerprints operations`,builder:e=>e.command(Yd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Zd={command:`get`,describe:`Operations for document-fingerprints.get`,builder:e=>e.command(qd).command(Xd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qd(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`File used for document fingerprinting.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const $d={command:`update <document-fingerprint-id>`,describe:`Uploads a new document to create or update a fingerprint. The document structure is analyzed to enable detection of similar documents.`,builder:Qd,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust document-fingerprints update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/document_fingerprints/${e[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(e[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(e[`document-fingerprint-id`]??``)},bodyKind:`multipart`,body:{body:e.body,file:e.file}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.file!==void 0||e.body!==void 0){let r=new FormData;if(e.file){let t=p(e.file);r.append(`file`,new Blob([t]),e.file.split(/[\\/]/).filter(Boolean).pop())}else e.body!==void 0&&r.append(`file`,e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/document_fingerprints/${encodeURIComponent(String(e[`document-fingerprint-id`]))}`,{body:r})),{successLabel:`Updated`});return}if(e.body){let r=f(e.body,`body`,`binary`);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/document_fingerprints/${encodeURIComponent(String(e[`document-fingerprint-id`]))}`,{body:r,headers:{"Content-Type":`multipart/form-data`}})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},ef={command:`document-fingerprints`,describe:`Document Fingerprints operations`,builder:e=>e.command(Wd).command($d).command(Hd).command(Zd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function tf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const nf={command:`list`,describe:`List all application and application type mappings.`,builder:tf,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway app-types list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/app_types`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.appTypes.list(n)),{successLabel:`Loaded`})}},rf={command:`app-types`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(nf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function af(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const of={command:`get`,describe:`Retrieve all Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.`,builder:af,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway audit-ssh-settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/audit_ssh_settings`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.auditSshSettings.get(n)),{successLabel:`Loaded`})}};function sf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const cf={command:`rotate-seed`,describe:`Rotate the SSH account seed that generates the host key identity when connecting through the Cloudflare SSH Proxy.`,builder:sf,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway audit-ssh-settings rotate-seed`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/audit_ssh_settings/rotate_seed`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Creating`,async()=>t.zeroTrust.gateway.auditSshSettings.rotateSeed(n)),{successLabel:`Created`})}};function lf(e){return e.option(`public-key`,{type:`string`,description:`Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const uf={command:`update`,describe:`Update Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.`,builder:lf,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway audit-ssh-settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/audit_ssh_settings`,pathParams:{},bodyKind:`json`,body:{"public-key":e[`public-key`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${a}/gateway/audit_ssh_settings`,{body:t})),{successLabel:`Updated`});return}e[`public-key`]===void 0&&(e[`public-key`]=await t(`public-key`,`Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging.`));let p={};e[`public-key`]!==void 0&&s(p,[`public_key`],f(e[`public-key`],`public-key`,`text`)),l(await d(`Updating`,async()=>n.put(`/accounts/${a}/gateway/audit_ssh_settings`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated`})}},df={command:`audit-ssh-settings`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(of).command(cf).command(uf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ff(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pf={command:`list`,describe:`List all categories.`,builder:ff,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway categories list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/categories`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.categories.list(n)),{successLabel:`Loaded`})}},mf={command:`categories`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(pf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function hf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const gf={command:`activate <certificate-id>`,describe:`Bind a single Zero Trust certificate to the edge.`,builder:hf,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway certificates activate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}/activate`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/gateway/certificates/${encodeURIComponent(String(e[`certificate-id`]))}/activate`,{body:r})),{successLabel:`Created`});return}l(await d(`Creating`,async()=>t.zeroTrust.gateway.certificates.activate(e[`certificate-id`],n)),{successLabel:`Created`})}};function _f(e){return e.option(`validity-period-days`,{type:`number`,description:"Sets the certificate validity period in days (range: 1-10,950 days / ~30 years). Defaults to 1,825 days (5 years). **Important**: This field is only settable during the certificate creation.  Certificates becomes immutable after creation - use the `/activate` and `/deactivate` endpoints to manage certificate lifecycle."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const vf={command:`create`,describe:`Create a new Zero Trust certificate.`,builder:_f,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/certificates`,pathParams:{},bodyKind:`json`,body:{"validity-period-days":e[`validity-period-days`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/gateway/certificates`,{body:r})),{successLabel:`Created`});return}let a={};e[`validity-period-days`]!==void 0&&s(a,[`validity_period_days`],e[`validity-period-days`]),l(await d(`Creating`,async()=>t.post(`/accounts/${n}/gateway/certificates`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Created`})}};function yf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const bf={command:`deactivate <certificate-id>`,describe:`Unbind a single Zero Trust certificate from the edge.`,builder:yf,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway certificates deactivate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}/deactivate`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/gateway/certificates/${encodeURIComponent(String(e[`certificate-id`]))}/deactivate`,{body:r})),{successLabel:`Created`});return}l(await d(`Creating`,async()=>t.zeroTrust.gateway.certificates.deactivate(e[`certificate-id`],n)),{successLabel:`Created`})}};function xf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Sf={command:`delete <certificate-id>`,describe:`Delete a gateway-managed Zero Trust certificate. You must deactivate the certificate from the edge (inactive) before deleting it.`,builder:xf,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust gateway certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/certificates/${t[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(t[`certificate-id`]))}`,pathParams:{"certificate-id":String(t[`certificate-id`]??``)},bodyKind:`json`,body:{body:t.body}});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body);l(await d(`Deleting`,async()=>n.delete(`/accounts/${a}/gateway/certificates/${encodeURIComponent(String(t[`certificate-id`]))}`,{body:e})),{successLabel:`Deleted`});return}l(await d(`Deleting`,async()=>n.zeroTrust.gateway.certificates.delete(t[`certificate-id`],a)),{successLabel:`Deleted`})}};function Cf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wf={command:`get <certificate-id>`,describe:`Get a single Zero Trust certificate.`,builder:Cf,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.certificates.get(e[`certificate-id`],n)),{successLabel:`Loaded`})}};function Tf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ef={command:`list`,describe:`List all Zero Trust certificates for an account.`,builder:Tf,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/certificates`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.certificates.list(n)),{successLabel:`Loaded`})}},Df={command:`certificates`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(gf).command(vf).command(bf).command(Sf).command(wf).command(Ef).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Of(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const kf={command:`get`,describe:`Retrieve the current Zero Trust certificate configuration.`,builder:Of,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway configurations custom-certificate get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/configuration/custom_certificate`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.configurations.customCertificate.get(n)),{successLabel:`Loaded`})}},Af={command:`custom-certificate`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(kf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function jf(e){return e.option(`settings-activity-log-enabled`,{type:`boolean`,description:`Specify whether to log activity.`}).option(`settings-antivirus-enabled-download-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on downloads.`}).option(`settings-antivirus-enabled-upload-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on uploads.`}).option(`settings-antivirus-fail-closed`,{type:`boolean`,description:`Specify whether to block requests for unscannable files.`}).option(`settings-antivirus-notification-settings-enabled`,{type:`boolean`,description:`Specify whether to enable notifications.`}).option(`settings-antivirus-notification-settings-include-context`,{type:`boolean`,description:`Specify whether to include context information as query parameters.`}).option(`settings-antivirus-notification-settings-msg`,{type:`string`,description:`Specify the message to show in the notification.`}).option(`settings-antivirus-notification-settings-support-url`,{type:`string`,description:`Specify a URL that directs users to more information. If unset, the notification opens a block page.`}).option(`settings-block-page-background-color`,{type:`string`,description:"Specify the block page background color in `#rrggbb` format when the mode is customized_block_page."}).option(`settings-block-page-enabled`,{type:`boolean`,description:`Specify whether to enable the custom block page.`}).option(`settings-block-page-footer-text`,{type:`string`,description:`Specify the block page footer text when the mode is customized_block_page.`}).option(`settings-block-page-header-text`,{type:`string`,description:`Specify the block page header text when the mode is customized_block_page.`}).option(`settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to append context to target_uri as query parameters. This applies only when the mode is redirect_uri.`}).option(`settings-block-page-logo-path`,{type:`string`,description:`Specify the full URL to the logo file when the mode is customized_block_page.`}).option(`settings-block-page-mailto-address`,{type:`string`,description:`Specify the admin email for users to contact when the mode is customized_block_page.`}).option(`settings-block-page-mailto-subject`,{type:`string`,description:`Specify the subject line for emails created from the block page when the mode is customized_block_page.`}).option(`settings-block-page-mode`,{type:`string`,description:`Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.`,choices:[`customized_block_page`,`redirect_uri`]}).option(`settings-block-page-name`,{type:`string`,description:`Specify the block page title when the mode is customized_block_page.`}).option(`settings-block-page-suppress-footer`,{type:`boolean`,description:`Specify whether to suppress detailed information at the bottom of the block page when the mode is customized_block_page.`}).option(`settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to redirect users to when the mode is redirect_uri.`}).option(`settings-body-scanning-inspection-mode`,{type:`string`,description:"Specify the inspection mode as either `deep` or `shallow`.",choices:[`deep`,`shallow`]}).option(`settings-browser-isolation-non-identity-enabled`,{type:`boolean`,description:`Specify whether to enable non-identity onramp support for Browser Isolation.`}).option(`settings-browser-isolation-url-browser-isolation-enabled`,{type:`boolean`,description:`Specify whether to enable Clientless Browser Isolation.`}).option(`settings-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.`}).option(`settings-custom-certificate-enabled`,{type:`boolean`,description:`Specify whether to enable a custom certificate authority for signing Gateway traffic.`}).option(`settings-custom-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate (ID from MTLS certificate store).`}).option(`settings-extended-email-matching-enabled`,{type:`boolean`,description:`Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.`}).option(`settings-fips-tls`,{type:`boolean`,description:`Enforce cipher suites and TLS versions compliant with FIPS 140-2.`}).option(`settings-host-selector-enabled`,{type:`boolean`,description:`Specify whether to enable filtering via hosts for egress policies.`}).option(`settings-inspection-mode`,{type:`string`,description:`Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.`,choices:[`static`,`dynamic`]}).option(`settings-protocol-detection-enabled`,{type:`boolean`,description:`Specify whether to detect protocols from the initial bytes of client traffic.`}).option(`settings-sandbox-enabled`,{type:`boolean`,description:`Specify whether to enable the sandbox.`}).option(`settings-sandbox-fallback-action`,{type:`string`,description:`Specify the action to take when the system cannot scan the file.`,choices:[`allow`,`block`]}).option(`settings-tls-decrypt-enabled`,{type:`boolean`,description:`Specify whether to inspect encrypted HTTP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Specify account settings.`}).check(e=>{if(`settings-activity-log-enabled.settings-antivirus-enabled-download-phase.settings-antivirus-enabled-upload-phase.settings-antivirus-fail-closed.settings-antivirus-notification-settings-enabled.settings-antivirus-notification-settings-include-context.settings-antivirus-notification-settings-msg.settings-antivirus-notification-settings-support-url.settings-block-page-background-color.settings-block-page-enabled.settings-block-page-footer-text.settings-block-page-header-text.settings-block-page-include-context.settings-block-page-logo-path.settings-block-page-mailto-address.settings-block-page-mailto-subject.settings-block-page-name.settings-block-page-suppress-footer.settings-block-page-target-uri.settings-body-scanning-inspection-mode.settings-browser-isolation-non-identity-enabled.settings-browser-isolation-url-browser-isolation-enabled.settings-certificate-id.settings-custom-certificate-enabled.settings-custom-certificate-id.settings-extended-email-matching-enabled.settings-fips-tls.settings-host-selector-enabled.settings-inspection-mode.settings-protocol-detection-enabled.settings-sandbox-enabled.settings-sandbox-fallback-action.settings-tls-decrypt-enabled`.split(`.`).some(t=>e[t]!==void 0)){let t=[`settings-certificate-id`,`settings-custom-certificate-enabled`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --settings-* flag is set`)}return!0})}const Mf={command:`edit`,describe:"Update (PATCH) a single subcollection of settings such as `antivirus`, `tls_decrypt`, `activity_log`, `block_page`, `browser_isolation`, `fips`, `body_scanning`, or `certificate` without updating the entire configuration object. This endpoint returns an error if any settings collection lacks proper configuration.",builder:jf,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway configurations edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`json`,body:{"settings-activity-log-enabled":e[`settings-activity-log-enabled`],"settings-antivirus-enabled-download-phase":e[`settings-antivirus-enabled-download-phase`],"settings-antivirus-enabled-upload-phase":e[`settings-antivirus-enabled-upload-phase`],"settings-antivirus-fail-closed":e[`settings-antivirus-fail-closed`],"settings-antivirus-notification-settings-enabled":e[`settings-antivirus-notification-settings-enabled`],"settings-antivirus-notification-settings-include-context":e[`settings-antivirus-notification-settings-include-context`],"settings-antivirus-notification-settings-msg":e[`settings-antivirus-notification-settings-msg`],"settings-antivirus-notification-settings-support-url":e[`settings-antivirus-notification-settings-support-url`],"settings-block-page-background-color":e[`settings-block-page-background-color`],"settings-block-page-enabled":e[`settings-block-page-enabled`],"settings-block-page-footer-text":e[`settings-block-page-footer-text`],"settings-block-page-header-text":e[`settings-block-page-header-text`],"settings-block-page-include-context":e[`settings-block-page-include-context`],"settings-block-page-logo-path":e[`settings-block-page-logo-path`],"settings-block-page-mailto-address":e[`settings-block-page-mailto-address`],"settings-block-page-mailto-subject":e[`settings-block-page-mailto-subject`],"settings-block-page-mode":e[`settings-block-page-mode`],"settings-block-page-name":e[`settings-block-page-name`],"settings-block-page-suppress-footer":e[`settings-block-page-suppress-footer`],"settings-block-page-target-uri":e[`settings-block-page-target-uri`],"settings-body-scanning-inspection-mode":e[`settings-body-scanning-inspection-mode`],"settings-browser-isolation-non-identity-enabled":e[`settings-browser-isolation-non-identity-enabled`],"settings-browser-isolation-url-browser-isolation-enabled":e[`settings-browser-isolation-url-browser-isolation-enabled`],"settings-certificate-id":e[`settings-certificate-id`],"settings-custom-certificate-enabled":e[`settings-custom-certificate-enabled`],"settings-custom-certificate-id":e[`settings-custom-certificate-id`],"settings-extended-email-matching-enabled":e[`settings-extended-email-matching-enabled`],"settings-fips-tls":e[`settings-fips-tls`],"settings-host-selector-enabled":e[`settings-host-selector-enabled`],"settings-inspection-mode":e[`settings-inspection-mode`],"settings-protocol-detection-enabled":e[`settings-protocol-detection-enabled`],"settings-sandbox-enabled":e[`settings-sandbox-enabled`],"settings-sandbox-fallback-action":e[`settings-sandbox-fallback-action`],"settings-tls-decrypt-enabled":e[`settings-tls-decrypt-enabled`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/gateway/configuration`,{body:r})),{successLabel:`Updated`});return}let a={};e[`settings-activity-log-enabled`]!==void 0&&s(a,[`settings`,`activity_log`,`enabled`],e[`settings-activity-log-enabled`]),e[`settings-antivirus-enabled-download-phase`]!==void 0&&s(a,[`settings`,`antivirus`,`enabled_download_phase`],e[`settings-antivirus-enabled-download-phase`]),e[`settings-antivirus-enabled-upload-phase`]!==void 0&&s(a,[`settings`,`antivirus`,`enabled_upload_phase`],e[`settings-antivirus-enabled-upload-phase`]),e[`settings-antivirus-fail-closed`]!==void 0&&s(a,[`settings`,`antivirus`,`fail_closed`],e[`settings-antivirus-fail-closed`]),e[`settings-antivirus-notification-settings-enabled`]!==void 0&&s(a,[`settings`,`antivirus`,`notification_settings`,`enabled`],e[`settings-antivirus-notification-settings-enabled`]),e[`settings-antivirus-notification-settings-include-context`]!==void 0&&s(a,[`settings`,`antivirus`,`notification_settings`,`include_context`],e[`settings-antivirus-notification-settings-include-context`]),e[`settings-antivirus-notification-settings-msg`]!==void 0&&s(a,[`settings`,`antivirus`,`notification_settings`,`msg`],f(e[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`)),e[`settings-antivirus-notification-settings-support-url`]!==void 0&&s(a,[`settings`,`antivirus`,`notification_settings`,`support_url`],f(e[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)),e[`settings-block-page-background-color`]!==void 0&&s(a,[`settings`,`block_page`,`background_color`],f(e[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`)),e[`settings-block-page-enabled`]!==void 0&&s(a,[`settings`,`block_page`,`enabled`],e[`settings-block-page-enabled`]),e[`settings-block-page-footer-text`]!==void 0&&s(a,[`settings`,`block_page`,`footer_text`],f(e[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`)),e[`settings-block-page-header-text`]!==void 0&&s(a,[`settings`,`block_page`,`header_text`],f(e[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`)),e[`settings-block-page-include-context`]!==void 0&&s(a,[`settings`,`block_page`,`include_context`],e[`settings-block-page-include-context`]),e[`settings-block-page-logo-path`]!==void 0&&s(a,[`settings`,`block_page`,`logo_path`],f(e[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`)),e[`settings-block-page-mailto-address`]!==void 0&&s(a,[`settings`,`block_page`,`mailto_address`],f(e[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`)),e[`settings-block-page-mailto-subject`]!==void 0&&s(a,[`settings`,`block_page`,`mailto_subject`],f(e[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`)),e[`settings-block-page-mode`]!==void 0&&s(a,[`settings`,`block_page`,`mode`],f(e[`settings-block-page-mode`],`settings-block-page-mode`,`text`)),e[`settings-block-page-name`]!==void 0&&s(a,[`settings`,`block_page`,`name`],f(e[`settings-block-page-name`],`settings-block-page-name`,`text`)),e[`settings-block-page-suppress-footer`]!==void 0&&s(a,[`settings`,`block_page`,`suppress_footer`],e[`settings-block-page-suppress-footer`]),e[`settings-block-page-target-uri`]!==void 0&&s(a,[`settings`,`block_page`,`target_uri`],f(e[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)),e[`settings-body-scanning-inspection-mode`]!==void 0&&s(a,[`settings`,`body_scanning`,`inspection_mode`],f(e[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)),e[`settings-browser-isolation-non-identity-enabled`]!==void 0&&s(a,[`settings`,`browser_isolation`,`non_identity_enabled`],e[`settings-browser-isolation-non-identity-enabled`]),e[`settings-browser-isolation-url-browser-isolation-enabled`]!==void 0&&s(a,[`settings`,`browser_isolation`,`url_browser_isolation_enabled`],e[`settings-browser-isolation-url-browser-isolation-enabled`]),e[`settings-certificate-id`]!==void 0&&s(a,[`settings`,`certificate`,`id`],f(e[`settings-certificate-id`],`settings-certificate-id`,`text`)),e[`settings-custom-certificate-enabled`]!==void 0&&s(a,[`settings`,`custom_certificate`,`enabled`],e[`settings-custom-certificate-enabled`]),e[`settings-custom-certificate-id`]!==void 0&&s(a,[`settings`,`custom_certificate`,`id`],f(e[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)),e[`settings-extended-email-matching-enabled`]!==void 0&&s(a,[`settings`,`extended_email_matching`,`enabled`],e[`settings-extended-email-matching-enabled`]),e[`settings-fips-tls`]!==void 0&&s(a,[`settings`,`fips`,`tls`],e[`settings-fips-tls`]),e[`settings-host-selector-enabled`]!==void 0&&s(a,[`settings`,`host_selector`,`enabled`],e[`settings-host-selector-enabled`]),e[`settings-inspection-mode`]!==void 0&&s(a,[`settings`,`inspection`,`mode`],f(e[`settings-inspection-mode`],`settings-inspection-mode`,`text`)),e[`settings-protocol-detection-enabled`]!==void 0&&s(a,[`settings`,`protocol_detection`,`enabled`],e[`settings-protocol-detection-enabled`]),e[`settings-sandbox-enabled`]!==void 0&&s(a,[`settings`,`sandbox`,`enabled`],e[`settings-sandbox-enabled`]),e[`settings-sandbox-fallback-action`]!==void 0&&s(a,[`settings`,`sandbox`,`fallback_action`],f(e[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)),e[`settings-tls-decrypt-enabled`]!==void 0&&s(a,[`settings`,`tls_decrypt`,`enabled`],e[`settings-tls-decrypt-enabled`]),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/gateway/configuration`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}};function Nf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pf={command:`get`,describe:`Retrieve the current Zero Trust account configuration.`,builder:Nf,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway configurations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.configurations.get(n)),{successLabel:`Loaded`})}};function Ff(e){return e.option(`settings-activity-log-enabled`,{type:`boolean`,description:`Specify whether to log activity.`}).option(`settings-antivirus-enabled-download-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on downloads.`}).option(`settings-antivirus-enabled-upload-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on uploads.`}).option(`settings-antivirus-fail-closed`,{type:`boolean`,description:`Specify whether to block requests for unscannable files.`}).option(`settings-antivirus-notification-settings-enabled`,{type:`boolean`,description:`Specify whether to enable notifications.`}).option(`settings-antivirus-notification-settings-include-context`,{type:`boolean`,description:`Specify whether to include context information as query parameters.`}).option(`settings-antivirus-notification-settings-msg`,{type:`string`,description:`Specify the message to show in the notification.`}).option(`settings-antivirus-notification-settings-support-url`,{type:`string`,description:`Specify a URL that directs users to more information. If unset, the notification opens a block page.`}).option(`settings-block-page-background-color`,{type:`string`,description:"Specify the block page background color in `#rrggbb` format when the mode is customized_block_page."}).option(`settings-block-page-enabled`,{type:`boolean`,description:`Specify whether to enable the custom block page.`}).option(`settings-block-page-footer-text`,{type:`string`,description:`Specify the block page footer text when the mode is customized_block_page.`}).option(`settings-block-page-header-text`,{type:`string`,description:`Specify the block page header text when the mode is customized_block_page.`}).option(`settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to append context to target_uri as query parameters. This applies only when the mode is redirect_uri.`}).option(`settings-block-page-logo-path`,{type:`string`,description:`Specify the full URL to the logo file when the mode is customized_block_page.`}).option(`settings-block-page-mailto-address`,{type:`string`,description:`Specify the admin email for users to contact when the mode is customized_block_page.`}).option(`settings-block-page-mailto-subject`,{type:`string`,description:`Specify the subject line for emails created from the block page when the mode is customized_block_page.`}).option(`settings-block-page-mode`,{type:`string`,description:`Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.`,choices:[`customized_block_page`,`redirect_uri`]}).option(`settings-block-page-name`,{type:`string`,description:`Specify the block page title when the mode is customized_block_page.`}).option(`settings-block-page-suppress-footer`,{type:`boolean`,description:`Specify whether to suppress detailed information at the bottom of the block page when the mode is customized_block_page.`}).option(`settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to redirect users to when the mode is redirect_uri.`}).option(`settings-body-scanning-inspection-mode`,{type:`string`,description:"Specify the inspection mode as either `deep` or `shallow`.",choices:[`deep`,`shallow`]}).option(`settings-browser-isolation-non-identity-enabled`,{type:`boolean`,description:`Specify whether to enable non-identity onramp support for Browser Isolation.`}).option(`settings-browser-isolation-url-browser-isolation-enabled`,{type:`boolean`,description:`Specify whether to enable Clientless Browser Isolation.`}).option(`settings-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.`}).option(`settings-custom-certificate-enabled`,{type:`boolean`,description:`Specify whether to enable a custom certificate authority for signing Gateway traffic.`}).option(`settings-custom-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate (ID from MTLS certificate store).`}).option(`settings-extended-email-matching-enabled`,{type:`boolean`,description:`Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.`}).option(`settings-fips-tls`,{type:`boolean`,description:`Enforce cipher suites and TLS versions compliant with FIPS 140-2.`}).option(`settings-host-selector-enabled`,{type:`boolean`,description:`Specify whether to enable filtering via hosts for egress policies.`}).option(`settings-inspection-mode`,{type:`string`,description:`Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.`,choices:[`static`,`dynamic`]}).option(`settings-protocol-detection-enabled`,{type:`boolean`,description:`Specify whether to detect protocols from the initial bytes of client traffic.`}).option(`settings-sandbox-enabled`,{type:`boolean`,description:`Specify whether to enable the sandbox.`}).option(`settings-sandbox-fallback-action`,{type:`string`,description:`Specify the action to take when the system cannot scan the file.`,choices:[`allow`,`block`]}).option(`settings-tls-decrypt-enabled`,{type:`boolean`,description:`Specify whether to inspect encrypted HTTP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Specify account settings.`}).check(e=>{if(`settings-activity-log-enabled.settings-antivirus-enabled-download-phase.settings-antivirus-enabled-upload-phase.settings-antivirus-fail-closed.settings-antivirus-notification-settings-enabled.settings-antivirus-notification-settings-include-context.settings-antivirus-notification-settings-msg.settings-antivirus-notification-settings-support-url.settings-block-page-background-color.settings-block-page-enabled.settings-block-page-footer-text.settings-block-page-header-text.settings-block-page-include-context.settings-block-page-logo-path.settings-block-page-mailto-address.settings-block-page-mailto-subject.settings-block-page-name.settings-block-page-suppress-footer.settings-block-page-target-uri.settings-body-scanning-inspection-mode.settings-browser-isolation-non-identity-enabled.settings-browser-isolation-url-browser-isolation-enabled.settings-certificate-id.settings-custom-certificate-enabled.settings-custom-certificate-id.settings-extended-email-matching-enabled.settings-fips-tls.settings-host-selector-enabled.settings-inspection-mode.settings-protocol-detection-enabled.settings-sandbox-enabled.settings-sandbox-fallback-action.settings-tls-decrypt-enabled`.split(`.`).some(t=>e[t]!==void 0)){let t=[`settings-certificate-id`,`settings-custom-certificate-enabled`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --settings-* flag is set`)}return!0})}const If={command:`update`,describe:`Update the current Zero Trust account configuration.`,builder:Ff,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway configurations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`json`,body:{"settings-activity-log-enabled":e[`settings-activity-log-enabled`],"settings-antivirus-enabled-download-phase":e[`settings-antivirus-enabled-download-phase`],"settings-antivirus-enabled-upload-phase":e[`settings-antivirus-enabled-upload-phase`],"settings-antivirus-fail-closed":e[`settings-antivirus-fail-closed`],"settings-antivirus-notification-settings-enabled":e[`settings-antivirus-notification-settings-enabled`],"settings-antivirus-notification-settings-include-context":e[`settings-antivirus-notification-settings-include-context`],"settings-antivirus-notification-settings-msg":e[`settings-antivirus-notification-settings-msg`],"settings-antivirus-notification-settings-support-url":e[`settings-antivirus-notification-settings-support-url`],"settings-block-page-background-color":e[`settings-block-page-background-color`],"settings-block-page-enabled":e[`settings-block-page-enabled`],"settings-block-page-footer-text":e[`settings-block-page-footer-text`],"settings-block-page-header-text":e[`settings-block-page-header-text`],"settings-block-page-include-context":e[`settings-block-page-include-context`],"settings-block-page-logo-path":e[`settings-block-page-logo-path`],"settings-block-page-mailto-address":e[`settings-block-page-mailto-address`],"settings-block-page-mailto-subject":e[`settings-block-page-mailto-subject`],"settings-block-page-mode":e[`settings-block-page-mode`],"settings-block-page-name":e[`settings-block-page-name`],"settings-block-page-suppress-footer":e[`settings-block-page-suppress-footer`],"settings-block-page-target-uri":e[`settings-block-page-target-uri`],"settings-body-scanning-inspection-mode":e[`settings-body-scanning-inspection-mode`],"settings-browser-isolation-non-identity-enabled":e[`settings-browser-isolation-non-identity-enabled`],"settings-browser-isolation-url-browser-isolation-enabled":e[`settings-browser-isolation-url-browser-isolation-enabled`],"settings-certificate-id":e[`settings-certificate-id`],"settings-custom-certificate-enabled":e[`settings-custom-certificate-enabled`],"settings-custom-certificate-id":e[`settings-custom-certificate-id`],"settings-extended-email-matching-enabled":e[`settings-extended-email-matching-enabled`],"settings-fips-tls":e[`settings-fips-tls`],"settings-host-selector-enabled":e[`settings-host-selector-enabled`],"settings-inspection-mode":e[`settings-inspection-mode`],"settings-protocol-detection-enabled":e[`settings-protocol-detection-enabled`],"settings-sandbox-enabled":e[`settings-sandbox-enabled`],"settings-sandbox-fallback-action":e[`settings-sandbox-fallback-action`],"settings-tls-decrypt-enabled":e[`settings-tls-decrypt-enabled`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/gateway/configuration`,{body:r})),{successLabel:`Updated`});return}let a={};e[`settings-activity-log-enabled`]!==void 0&&s(a,[`settings`,`activity_log`,`enabled`],e[`settings-activity-log-enabled`]),e[`settings-antivirus-enabled-download-phase`]!==void 0&&s(a,[`settings`,`antivirus`,`enabled_download_phase`],e[`settings-antivirus-enabled-download-phase`]),e[`settings-antivirus-enabled-upload-phase`]!==void 0&&s(a,[`settings`,`antivirus`,`enabled_upload_phase`],e[`settings-antivirus-enabled-upload-phase`]),e[`settings-antivirus-fail-closed`]!==void 0&&s(a,[`settings`,`antivirus`,`fail_closed`],e[`settings-antivirus-fail-closed`]),e[`settings-antivirus-notification-settings-enabled`]!==void 0&&s(a,[`settings`,`antivirus`,`notification_settings`,`enabled`],e[`settings-antivirus-notification-settings-enabled`]),e[`settings-antivirus-notification-settings-include-context`]!==void 0&&s(a,[`settings`,`antivirus`,`notification_settings`,`include_context`],e[`settings-antivirus-notification-settings-include-context`]),e[`settings-antivirus-notification-settings-msg`]!==void 0&&s(a,[`settings`,`antivirus`,`notification_settings`,`msg`],f(e[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`)),e[`settings-antivirus-notification-settings-support-url`]!==void 0&&s(a,[`settings`,`antivirus`,`notification_settings`,`support_url`],f(e[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)),e[`settings-block-page-background-color`]!==void 0&&s(a,[`settings`,`block_page`,`background_color`],f(e[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`)),e[`settings-block-page-enabled`]!==void 0&&s(a,[`settings`,`block_page`,`enabled`],e[`settings-block-page-enabled`]),e[`settings-block-page-footer-text`]!==void 0&&s(a,[`settings`,`block_page`,`footer_text`],f(e[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`)),e[`settings-block-page-header-text`]!==void 0&&s(a,[`settings`,`block_page`,`header_text`],f(e[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`)),e[`settings-block-page-include-context`]!==void 0&&s(a,[`settings`,`block_page`,`include_context`],e[`settings-block-page-include-context`]),e[`settings-block-page-logo-path`]!==void 0&&s(a,[`settings`,`block_page`,`logo_path`],f(e[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`)),e[`settings-block-page-mailto-address`]!==void 0&&s(a,[`settings`,`block_page`,`mailto_address`],f(e[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`)),e[`settings-block-page-mailto-subject`]!==void 0&&s(a,[`settings`,`block_page`,`mailto_subject`],f(e[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`)),e[`settings-block-page-mode`]!==void 0&&s(a,[`settings`,`block_page`,`mode`],f(e[`settings-block-page-mode`],`settings-block-page-mode`,`text`)),e[`settings-block-page-name`]!==void 0&&s(a,[`settings`,`block_page`,`name`],f(e[`settings-block-page-name`],`settings-block-page-name`,`text`)),e[`settings-block-page-suppress-footer`]!==void 0&&s(a,[`settings`,`block_page`,`suppress_footer`],e[`settings-block-page-suppress-footer`]),e[`settings-block-page-target-uri`]!==void 0&&s(a,[`settings`,`block_page`,`target_uri`],f(e[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)),e[`settings-body-scanning-inspection-mode`]!==void 0&&s(a,[`settings`,`body_scanning`,`inspection_mode`],f(e[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)),e[`settings-browser-isolation-non-identity-enabled`]!==void 0&&s(a,[`settings`,`browser_isolation`,`non_identity_enabled`],e[`settings-browser-isolation-non-identity-enabled`]),e[`settings-browser-isolation-url-browser-isolation-enabled`]!==void 0&&s(a,[`settings`,`browser_isolation`,`url_browser_isolation_enabled`],e[`settings-browser-isolation-url-browser-isolation-enabled`]),e[`settings-certificate-id`]!==void 0&&s(a,[`settings`,`certificate`,`id`],f(e[`settings-certificate-id`],`settings-certificate-id`,`text`)),e[`settings-custom-certificate-enabled`]!==void 0&&s(a,[`settings`,`custom_certificate`,`enabled`],e[`settings-custom-certificate-enabled`]),e[`settings-custom-certificate-id`]!==void 0&&s(a,[`settings`,`custom_certificate`,`id`],f(e[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)),e[`settings-extended-email-matching-enabled`]!==void 0&&s(a,[`settings`,`extended_email_matching`,`enabled`],e[`settings-extended-email-matching-enabled`]),e[`settings-fips-tls`]!==void 0&&s(a,[`settings`,`fips`,`tls`],e[`settings-fips-tls`]),e[`settings-host-selector-enabled`]!==void 0&&s(a,[`settings`,`host_selector`,`enabled`],e[`settings-host-selector-enabled`]),e[`settings-inspection-mode`]!==void 0&&s(a,[`settings`,`inspection`,`mode`],f(e[`settings-inspection-mode`],`settings-inspection-mode`,`text`)),e[`settings-protocol-detection-enabled`]!==void 0&&s(a,[`settings`,`protocol_detection`,`enabled`],e[`settings-protocol-detection-enabled`]),e[`settings-sandbox-enabled`]!==void 0&&s(a,[`settings`,`sandbox`,`enabled`],e[`settings-sandbox-enabled`]),e[`settings-sandbox-fallback-action`]!==void 0&&s(a,[`settings`,`sandbox`,`fallback_action`],f(e[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)),e[`settings-tls-decrypt-enabled`]!==void 0&&s(a,[`settings`,`tls_decrypt`,`enabled`],e[`settings-tls-decrypt-enabled`]),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/gateway/configuration`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},Lf={command:`configurations`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(Mf).command(Pf).command(If).command(Af).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Rf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zf={command:`create`,describe:`Create a Zero Trust account for an existing Cloudflare account.`,builder:Rf,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Creating`,async()=>t.zeroTrust.gateway.create(n)),{successLabel:`Created`})}};function Bf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vf={command:`list`,describe:`Retrieve information about the current Zero Trust account.`,builder:Bf,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.list(n)),{successLabel:`Loaded`})}};function Hf(e){return e.option(`description`,{type:`string`,description:`Provide the list description.`}).option(`name`,{type:`string`,description:`Specify the list name.`}).option(`type`,{type:`string`,description:`Specify the list type.`,choices:[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Uf={command:`create`,describe:`Creates a new Zero Trust list.`,builder:Hf,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway lists create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/lists`,pathParams:{},bodyKind:`json`,body:{description:e.description,name:e.name,type:e.type,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${p}/gateway/lists`,{body:t})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await t(`name`,`Specify the list name.`)),e.type===void 0&&(e.type=await a(`type`,`Specify the list type.`,[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]));let h={};e.description!==void 0&&s(h,[`description`],f(e.description,`description`,`text`)),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),e.type!==void 0&&s(h,[`type`],f(e.type,`type`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${p}/gateway/lists`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created`})}};function Wf(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Gf={command:`delete <list-id>`,describe:`Deletes a Zero Trust list.`,builder:Wf,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust gateway lists delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/lists/${t[`list-id`]==null?`<list-id>`:encodeURIComponent(String(t[`list-id`]))}`,pathParams:{"list-id":String(t[`list-id`]??``)},bodyKind:`json`,body:{body:t.body}});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body);l(await d(`Deleting`,async()=>n.delete(`/accounts/${a}/gateway/lists/${encodeURIComponent(String(t[`list-id`]))}`,{body:e})),{successLabel:`Deleted`});return}l(await d(`Deleting`,async()=>n.zeroTrust.gateway.lists.delete(t[`list-id`],a)),{successLabel:`Deleted`})}};function Kf(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`remove`,{type:`string`,array:!0,description:`Lists of item values you want to remove.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const qf={command:`edit <list-id>`,describe:`Appends or removes an item from a configured Zero Trust list.`,builder:Kf,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway lists edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/lists/${e[`list-id`]==null?`<list-id>`:encodeURIComponent(String(e[`list-id`]))}`,pathParams:{"list-id":String(e[`list-id`]??``)},bodyKind:`json`,body:{remove:e.remove,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/gateway/lists/${encodeURIComponent(String(e[`list-id`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e.remove!==void 0&&s(a,[`remove`],e.remove),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/gateway/lists/${encodeURIComponent(String(e[`list-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}};function Jf(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yf={command:`get <list-id>`,describe:`Fetch a single Zero Trust list.`,builder:Jf,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway lists get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/lists/${e[`list-id`]==null?`<list-id>`:encodeURIComponent(String(e[`list-id`]))}`,pathParams:{"list-id":String(e[`list-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.lists.get(e[`list-id`],n)),{successLabel:`Loaded`})}};function Xf(e){return e.option(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zf={command:`list`,describe:`Fetch all items in a single Zero Trust list.`,builder:Xf,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway lists items list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/lists/${e[`list-id`]==null?`<list-id>`:encodeURIComponent(String(e[`list-id`]))}/items`,pathParams:{"list-id":String(e[`list-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.lists.items.list(e[`list-id`],n)),{successLabel:`Loaded`})}},Qf={command:`items`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(Zf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $f(e){return e.option(`type`,{type:`string`,description:`Specify the list type.`,choices:[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ep={command:`list`,describe:`Fetch all Zero Trust lists for an account.`,builder:$f,handler:async e=>{let t={type:e.type};if(e.dryRun){u({command:`cf zero-trust gateway lists list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/lists`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.gateway.lists.list(a,t)),{successLabel:`Loaded`})}};function tp(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`Provide the list description.`}).option(`name`,{type:`string`,description:`Specify the list name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const np={command:`update <list-id>`,describe:`Updates a configured Zero Trust list. Skips updating list items if not included in the payload. A non empty list items will overwrite the existing list.`,builder:tp,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway lists update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/lists/${e[`list-id`]==null?`<list-id>`:encodeURIComponent(String(e[`list-id`]))}`,pathParams:{"list-id":String(e[`list-id`]??``)},bodyKind:`json`,body:{description:e.description,name:e.name,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${a}/gateway/lists/${encodeURIComponent(String(e[`list-id`]))}`,{body:t})),{successLabel:`Updated`});return}e.name===void 0&&(e.name=await t(`name`,`Specify the list name.`));let p={};e.description!==void 0&&s(p,[`description`],f(e.description,`description`,`text`)),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),l(await d(`Updating`,async()=>n.put(`/accounts/${a}/gateway/lists/${encodeURIComponent(String(e[`list-id`]))}`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated`})}},rp={command:`lists`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(Uf).command(Gf).command(qf).command(Yf).command(ep).command(np).command(Qf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ip(e){return e.option(`client-default`,{type:`boolean`,description:`Indicate whether this location is the default location.`,default:!1}).option(`dns-destination-ips-id`,{type:`string`,description:`Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.`}).option(`ecs-support`,{type:`boolean`,description:`Indicate whether the location must resolve EDNS queries.`,default:!1}).option(`endpoints-doh-enabled`,{type:`boolean`,description:`Indicate whether the DOH endpoint is enabled for this location.`}).option(`endpoints-doh-require-token`,{type:`boolean`,description:`Specify whether the DOH endpoint requires user identity authentication.`}).option(`endpoints-dot-enabled`,{type:`boolean`,description:`Indicate whether the DOT endpoint is enabled for this location.`}).option(`endpoints-ipv4-enabled`,{type:`boolean`,description:`Indicate whether the IPv4 endpoint is enabled for this location.`}).option(`endpoints-ipv6-enabled`,{type:`boolean`,description:`Indicate whether the IPV6 endpoint is enabled for this location.`}).option(`name`,{type:`string`,description:`Specify the location name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ap={command:`create`,describe:`Create a new Zero Trust Gateway location.`,builder:ip,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway locations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/locations`,pathParams:{},bodyKind:`json`,body:{"client-default":e[`client-default`],"dns-destination-ips-id":e[`dns-destination-ips-id`],"ecs-support":e[`ecs-support`],"endpoints-doh-enabled":e[`endpoints-doh-enabled`],"endpoints-doh-require-token":e[`endpoints-doh-require-token`],"endpoints-dot-enabled":e[`endpoints-dot-enabled`],"endpoints-ipv4-enabled":e[`endpoints-ipv4-enabled`],"endpoints-ipv6-enabled":e[`endpoints-ipv6-enabled`],name:e.name,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/gateway/locations`,{body:t})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await t(`name`,`Specify the location name.`));let p={};e[`client-default`]!==void 0&&s(p,[`client_default`],e[`client-default`]),e[`dns-destination-ips-id`]!==void 0&&s(p,[`dns_destination_ips_id`],f(e[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`)),e[`ecs-support`]!==void 0&&s(p,[`ecs_support`],e[`ecs-support`]),e[`endpoints-doh-enabled`]!==void 0&&s(p,[`endpoints`,`doh`,`enabled`],e[`endpoints-doh-enabled`]),e[`endpoints-doh-require-token`]!==void 0&&s(p,[`endpoints`,`doh`,`require_token`],e[`endpoints-doh-require-token`]),e[`endpoints-dot-enabled`]!==void 0&&s(p,[`endpoints`,`dot`,`enabled`],e[`endpoints-dot-enabled`]),e[`endpoints-ipv4-enabled`]!==void 0&&s(p,[`endpoints`,`ipv4`,`enabled`],e[`endpoints-ipv4-enabled`]),e[`endpoints-ipv6-enabled`]!==void 0&&s(p,[`endpoints`,`ipv6`,`enabled`],e[`endpoints-ipv6-enabled`]),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/gateway/locations`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function op(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const sp={command:`delete <location-id>`,describe:`Delete a configured Zero Trust Gateway location.`,builder:op,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust gateway locations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/locations/${t[`location-id`]==null?`<location-id>`:encodeURIComponent(String(t[`location-id`]))}`,pathParams:{"location-id":String(t[`location-id`]??``)},bodyKind:`json`,body:{body:t.body}});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body);l(await d(`Deleting`,async()=>n.delete(`/accounts/${a}/gateway/locations/${encodeURIComponent(String(t[`location-id`]))}`,{body:e})),{successLabel:`Deleted`});return}l(await d(`Deleting`,async()=>n.zeroTrust.gateway.locations.delete(t[`location-id`],a)),{successLabel:`Deleted`})}};function cp(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lp={command:`get <location-id>`,describe:`Get a single Zero Trust Gateway location.`,builder:cp,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway locations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/locations/${e[`location-id`]==null?`<location-id>`:encodeURIComponent(String(e[`location-id`]))}`,pathParams:{"location-id":String(e[`location-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.locations.get(e[`location-id`],n)),{successLabel:`Loaded`})}};function up(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dp={command:`list`,describe:`List Zero Trust Gateway locations for an account.`,builder:up,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway locations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/locations`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.locations.list(n)),{successLabel:`Loaded`})}};function fp(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`client-default`,{type:`boolean`,description:`Indicate whether this location is the default location.`}).option(`dns-destination-ips-id`,{type:`string`,description:`Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.`}).option(`ecs-support`,{type:`boolean`,description:`Indicate whether the location must resolve EDNS queries.`}).option(`endpoints-doh-enabled`,{type:`boolean`,description:`Indicate whether the DOH endpoint is enabled for this location.`}).option(`endpoints-doh-require-token`,{type:`boolean`,description:`Specify whether the DOH endpoint requires user identity authentication.`}).option(`endpoints-dot-enabled`,{type:`boolean`,description:`Indicate whether the DOT endpoint is enabled for this location.`}).option(`endpoints-ipv4-enabled`,{type:`boolean`,description:`Indicate whether the IPv4 endpoint is enabled for this location.`}).option(`endpoints-ipv6-enabled`,{type:`boolean`,description:`Indicate whether the IPV6 endpoint is enabled for this location.`}).option(`name`,{type:`string`,description:`Specify the location name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pp={command:`update <location-id>`,describe:`Update a configured Zero Trust Gateway location.`,builder:fp,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway locations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/locations/${e[`location-id`]==null?`<location-id>`:encodeURIComponent(String(e[`location-id`]))}`,pathParams:{"location-id":String(e[`location-id`]??``)},bodyKind:`json`,body:{"client-default":e[`client-default`],"dns-destination-ips-id":e[`dns-destination-ips-id`],"ecs-support":e[`ecs-support`],"endpoints-doh-enabled":e[`endpoints-doh-enabled`],"endpoints-doh-require-token":e[`endpoints-doh-require-token`],"endpoints-dot-enabled":e[`endpoints-dot-enabled`],"endpoints-ipv4-enabled":e[`endpoints-ipv4-enabled`],"endpoints-ipv6-enabled":e[`endpoints-ipv6-enabled`],name:e.name,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${a}/gateway/locations/${encodeURIComponent(String(e[`location-id`]))}`,{body:t})),{successLabel:`Updated`});return}e.name===void 0&&(e.name=await t(`name`,`Specify the location name.`));let p={};e[`client-default`]!==void 0&&s(p,[`client_default`],e[`client-default`]),e[`dns-destination-ips-id`]!==void 0&&s(p,[`dns_destination_ips_id`],f(e[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`)),e[`ecs-support`]!==void 0&&s(p,[`ecs_support`],e[`ecs-support`]),e[`endpoints-doh-enabled`]!==void 0&&s(p,[`endpoints`,`doh`,`enabled`],e[`endpoints-doh-enabled`]),e[`endpoints-doh-require-token`]!==void 0&&s(p,[`endpoints`,`doh`,`require_token`],e[`endpoints-doh-require-token`]),e[`endpoints-dot-enabled`]!==void 0&&s(p,[`endpoints`,`dot`,`enabled`],e[`endpoints-dot-enabled`]),e[`endpoints-ipv4-enabled`]!==void 0&&s(p,[`endpoints`,`ipv4`,`enabled`],e[`endpoints-ipv4-enabled`]),e[`endpoints-ipv6-enabled`]!==void 0&&s(p,[`endpoints`,`ipv6`,`enabled`],e[`endpoints-ipv6-enabled`]),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),l(await d(`Updating`,async()=>n.put(`/accounts/${a}/gateway/locations/${encodeURIComponent(String(e[`location-id`]))}`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated`})}},mp={command:`locations`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(ap).command(sp).command(lp).command(dp).command(pp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function hp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gp={command:`get`,describe:`Retrieve the current logging settings for the Zero Trust account.`,builder:hp,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway logging get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/logging`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.logging.get(n)),{successLabel:`Loaded`})}};function _p(e){return e.option(`redact-pii`,{type:`boolean`,description:`Indicate whether to redact personally identifiable information from activity logging (PII fields include source IP, user email, user ID, device ID, URL, referrer, and user agent).`}).option(`settings-by-rule-type-dns-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-dns-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`settings-by-rule-type-http-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-http-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`settings-by-rule-type-l4-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-l4-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const vp={command:`update`,describe:`Update logging settings for the current Zero Trust account.`,builder:_p,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway logging update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/logging`,pathParams:{},bodyKind:`json`,body:{"redact-pii":e[`redact-pii`],"settings-by-rule-type-dns-log-all":e[`settings-by-rule-type-dns-log-all`],"settings-by-rule-type-dns-log-blocks":e[`settings-by-rule-type-dns-log-blocks`],"settings-by-rule-type-http-log-all":e[`settings-by-rule-type-http-log-all`],"settings-by-rule-type-http-log-blocks":e[`settings-by-rule-type-http-log-blocks`],"settings-by-rule-type-l4-log-all":e[`settings-by-rule-type-l4-log-all`],"settings-by-rule-type-l4-log-blocks":e[`settings-by-rule-type-l4-log-blocks`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/gateway/logging`,{body:r})),{successLabel:`Updated`});return}let a={};e[`redact-pii`]!==void 0&&s(a,[`redact_pii`],e[`redact-pii`]),e[`settings-by-rule-type-dns-log-all`]!==void 0&&s(a,[`settings_by_rule_type`,`dns`,`log_all`],e[`settings-by-rule-type-dns-log-all`]),e[`settings-by-rule-type-dns-log-blocks`]!==void 0&&s(a,[`settings_by_rule_type`,`dns`,`log_blocks`],e[`settings-by-rule-type-dns-log-blocks`]),e[`settings-by-rule-type-http-log-all`]!==void 0&&s(a,[`settings_by_rule_type`,`http`,`log_all`],e[`settings-by-rule-type-http-log-all`]),e[`settings-by-rule-type-http-log-blocks`]!==void 0&&s(a,[`settings_by_rule_type`,`http`,`log_blocks`],e[`settings-by-rule-type-http-log-blocks`]),e[`settings-by-rule-type-l4-log-all`]!==void 0&&s(a,[`settings_by_rule_type`,`l4`,`log_all`],e[`settings-by-rule-type-l4-log-all`]),e[`settings-by-rule-type-l4-log-blocks`]!==void 0&&s(a,[`settings_by_rule_type`,`l4`,`log_blocks`],e[`settings-by-rule-type-l4-log-blocks`]),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/gateway/logging`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},yp={command:`logging`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(gp).command(vp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bp(e){return e.option(`contents`,{type:`string`,description:`Actual contents of the PAC file`}).option(`description`,{type:`string`,description:`Detailed description of the PAC file.`}).option(`name`,{type:`string`,description:`Name of the PAC file.`}).option(`slug`,{type:`string`,description:`URL-friendly version of the PAC file name. If not provided, it will be auto-generated`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xp={command:`create`,describe:`Create a new Zero Trust Gateway PAC file.`,builder:bp,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway pacfiles create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/pacfiles`,pathParams:{},bodyKind:`json`,body:{contents:e.contents,description:e.description,name:e.name,slug:e.slug,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/gateway/pacfiles`,{body:t})),{successLabel:`Created`});return}e.contents===void 0&&(e.contents=await t(`contents`,`Actual contents of the PAC file`)),e.name===void 0&&(e.name=await t(`name`,`Name of the PAC file.`));let p={};e.contents!==void 0&&s(p,[`contents`],f(e.contents,`contents`,`text`)),e.description!==void 0&&s(p,[`description`],f(e.description,`description`,`text`)),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),e.slug!==void 0&&s(p,[`slug`],f(e.slug,`slug`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/gateway/pacfiles`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function Sp(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Cp={command:`delete <pacfile-id>`,describe:`Delete a configured Zero Trust Gateway PAC file.`,builder:Sp,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust gateway pacfiles delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/pacfiles/${t[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(t[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(t[`pacfile-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.gateway.pacfiles.delete(t[`pacfile-id`],a)),{successLabel:`Deleted`})}};function wp(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Tp={command:`get <pacfile-id>`,describe:`Get a single Zero Trust Gateway PAC file.`,builder:wp,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway pacfiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/pacfiles/${e[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(e[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(e[`pacfile-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.pacfiles.get(e[`pacfile-id`],n)),{successLabel:`Loaded`})}};function Ep(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dp={command:`list`,describe:`List all Zero Trust Gateway PAC files for an account.`,builder:Ep,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway pacfiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/pacfiles`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.pacfiles.list(n)),{successLabel:`Loaded`})}};function Op(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`contents`,{type:`string`,description:`Actual contents of the PAC file`}).option(`description`,{type:`string`,description:`Detailed description of the PAC file.`}).option(`name`,{type:`string`,description:`Name of the PAC file.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const kp={command:`update <pacfile-id>`,describe:`Update a configured Zero Trust Gateway PAC file.`,builder:Op,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway pacfiles update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/pacfiles/${e[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(e[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(e[`pacfile-id`]??``)},bodyKind:`json`,body:{contents:e.contents,description:e.description,name:e.name,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${a}/gateway/pacfiles/${encodeURIComponent(String(e[`pacfile-id`]))}`,{body:t})),{successLabel:`Updated`});return}e.contents===void 0&&(e.contents=await t(`contents`,`Actual contents of the PAC file`)),e.description===void 0&&(e.description=await t(`description`,`Detailed description of the PAC file.`)),e.name===void 0&&(e.name=await t(`name`,`Name of the PAC file.`));let p={};e.contents!==void 0&&s(p,[`contents`],f(e.contents,`contents`,`text`)),e.description!==void 0&&s(p,[`description`],f(e.description,`description`,`text`)),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),l(await d(`Updating`,async()=>n.put(`/accounts/${a}/gateway/pacfiles/${encodeURIComponent(String(e[`pacfile-id`]))}`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated`})}},Ap={command:`pacfiles`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(xp).command(Cp).command(Tp).command(Dp).command(kp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function jp(e){return e.option(`kind`,{type:`string`,description:`The proxy endpoint kind.`,choices:[`ip`,`identity`],default:`ip`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Mp={command:`create`,describe:`Create a new Zero Trust Gateway proxy endpoint.`,builder:jp,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway proxy-endpoints create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/proxy_endpoints`,pathParams:{},bodyKind:`json`,body:{kind:e.kind,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/gateway/proxy_endpoints`,{body:t})),{successLabel:`Created`});return}e.kind===`identity`&&e.kind===void 0&&(e.kind=await t(`kind`,`The proxy endpoint kind.`,{question:`Enter value for --kind`}));let p={};e.kind!==void 0&&s(p,[`kind`],f(e.kind,`kind`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/gateway/proxy_endpoints`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function Np(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Pp={command:`delete <proxy-endpoint-id>`,describe:`Delete a configured Zero Trust Gateway proxy endpoint.`,builder:Np,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust gateway proxy-endpoints delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/proxy_endpoints/${t[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(t[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(t[`proxy-endpoint-id`]??``)},bodyKind:`json`,body:{body:t.body}});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body);l(await d(`Deleting`,async()=>n.delete(`/accounts/${a}/gateway/proxy_endpoints/${encodeURIComponent(String(t[`proxy-endpoint-id`]))}`,{body:e})),{successLabel:`Deleted`});return}l(await d(`Deleting`,async()=>n.zeroTrust.gateway.proxyEndpoints.delete(t[`proxy-endpoint-id`],a)),{successLabel:`Deleted`})}};function Fp(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`ips`,{type:`string`,array:!0,description:`Specify the list of CIDRs to restrict ingress connections.`}).option(`name`,{type:`string`,description:`Specify the name of the proxy endpoint.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ip={command:`edit <proxy-endpoint-id>`,describe:`Update a configured Zero Trust Gateway proxy endpoint.`,builder:Fp,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway proxy-endpoints edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/proxy_endpoints/${e[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(e[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(e[`proxy-endpoint-id`]??``)},bodyKind:`json`,body:{ips:e.ips,name:e.name,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/gateway/proxy_endpoints/${encodeURIComponent(String(e[`proxy-endpoint-id`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e.ips!==void 0&&s(a,[`ips`],e.ips),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/gateway/proxy_endpoints/${encodeURIComponent(String(e[`proxy-endpoint-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}};function Lp(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Rp={command:`get <proxy-endpoint-id>`,describe:`Get a single Zero Trust Gateway proxy endpoint.`,builder:Lp,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway proxy-endpoints get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/proxy_endpoints/${e[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(e[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(e[`proxy-endpoint-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.proxyEndpoints.get(e[`proxy-endpoint-id`],n)),{successLabel:`Loaded`})}};function zp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bp={command:`list`,describe:`List all Zero Trust Gateway proxy endpoints for an account.`,builder:zp,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway proxy-endpoints list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/proxy_endpoints`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.proxyEndpoints.list(n)),{successLabel:`Loaded`})}},Vp={command:`proxy-endpoints`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(Mp).command(Pp).command(Ip).command(Rp).command(Bp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Hp(e){return e.option(`action`,{type:`string`,description:"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",choices:[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`]}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`device-posture`,{type:`string`,description:`Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`,default:!1}).option(`expiration-duration`,{type:`number`,description:"Defines the default duration a policy active in minutes. Must set in order to use the `reset_expiration` endpoint on this rule."}).option(`filters`,{type:`string`,array:!0,description:`Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.`}).option(`identity`,{type:`string`,description:`Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`rule-settings-allow-child-bypass`,{type:`boolean`,description:`Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.`}).option(`rule-settings-audit-ssh-command-logging`,{type:`boolean`,description:`Enable SSH command logging.`}).option(`rule-settings-biso-admin-controls-copy`,{type:`string`,description:`Configure copy behavior. If set to remote_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dcp`,{type:`boolean`,description:'Set to false to enable copy-pasting. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dd`,{type:`boolean`,description:'Set to false to enable downloading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dk`,{type:`boolean`,description:'Set to false to enable keyboard usage. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-download`,{type:`string`,description:`Configure download behavior. When set to remote_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dp`,{type:`boolean`,description:'Set to false to enable printing. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-du`,{type:`boolean`,description:'Set to false to enable uploading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-keyboard`,{type:`string`,description:`Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-paste`,{type:`string`,description:`Configure paste behavior. If set to remote_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-printing`,{type:`string`,description:`Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-upload`,{type:`string`,description:`Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-version`,{type:`string`,description:`Indicate which version of the browser isolation controls should apply.`,choices:[`v1`,`v2`],default:`v1`}).option(`rule-settings-biso-admin-controls-wm-id`,{type:`string`,description:`Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser.`}).option(`rule-settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-block-page-enabled`,{type:`boolean`,description:"Enable the custom block page. Settable only for `dns` rules with action `block`."}).option(`rule-settings-block-reason`,{type:`string`,description:"Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`."}).option(`rule-settings-bypass-parent-rule`,{type:`boolean`,description:`Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.`}).option(`rule-settings-check-session-duration`,{type:`string`,description:`Sets the required session freshness threshold. The API returns a normalized version of this value.`}).option(`rule-settings-check-session-enforce`,{type:`boolean`,description:`Enable session enforcement.`}).option(`rule-settings-egress-ipv4`,{type:`string`,description:`Specify the IPv4 address to use for egress.`}).option(`rule-settings-egress-ipv4-fallback`,{type:`string`,description:`Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.`}).option(`rule-settings-egress-ipv6`,{type:`string`,description:`Specify the IPv6 range to use for egress.`}).option(`rule-settings-forensic-copy-enabled`,{type:`boolean`,description:`Enable sending the copy to storage.`}).option(`rule-settings-ignore-cname-category-matches`,{type:`boolean`,description:"Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-insecure-disable-dnssec-validation`,{type:`boolean`,description:"Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules."}).option(`rule-settings-ip-categories`,{type:`boolean`,description:"Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-ip-indicator-feeds`,{type:`boolean`,description:"Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-l4override-ip`,{type:`string`,description:`Defines the IPv4 or IPv6 address.`}).option(`rule-settings-l4override-port`,{type:`number`,description:`Defines a port number to use for TCP/UDP overrides.`}).option(`rule-settings-notification-settings-enabled`,{type:`boolean`,description:`Enable notification.`}).option(`rule-settings-notification-settings-include-context`,{type:`boolean`,description:`Indicates whether to pass the context information as query parameters.`}).option(`rule-settings-notification-settings-msg`,{type:`string`,description:`Customize the message shown in the notification.`}).option(`rule-settings-notification-settings-support-url`,{type:`string`,description:`Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.`}).option(`rule-settings-override-host`,{type:`string`,description:"Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-override-ips`,{type:`string`,array:!0,description:"Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-payload-log-enabled`,{type:`boolean`,description:`Enable DLP payload logging for this rule.`}).option(`rule-settings-quarantine-file-types`,{type:`string`,array:!0,description:`Specify the types of files to sandbox.`}).option(`rule-settings-redirect-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-redirect-preserve-path-and-query`,{type:`boolean`,description:`Specify whether to append the path and query parameters from the original request to target_uri.`}).option(`rule-settings-redirect-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-resolve-dns-internally-fallback`,{type:`string`,description:`Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.`,choices:[`none`,`public_dns`]}).option(`rule-settings-resolve-dns-internally-view-id`,{type:`string`,description:`Specify the internal DNS view identifier to pass to the internal DNS service.`}).option(`rule-settings-resolve-dns-through-cloudflare`,{type:`boolean`,description:"Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dns_resolver` rules."}).option(`rule-settings-untrusted-cert-action`,{type:`string`,description:`Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.`,choices:[`pass_through`,`block`,`error`]}).option(`schedule-fri`,{type:`string`,description:`Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-mon`,{type:`string`,description:`Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sat`,{type:`string`,description:`Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sun`,{type:`string`,description:`Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-thu`,{type:`string`,description:`Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-time-zone`,{type:`string`,description:`Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.`}).option(`schedule-tue`,{type:`string`,description:`Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-wed`,{type:`string`,description:`Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`traffic`,{type:`string`,description:`Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if(`rule-settings-allow-child-bypass.rule-settings-audit-ssh-command-logging.rule-settings-biso-admin-controls-copy.rule-settings-biso-admin-controls-dcp.rule-settings-biso-admin-controls-dd.rule-settings-biso-admin-controls-dk.rule-settings-biso-admin-controls-download.rule-settings-biso-admin-controls-dp.rule-settings-biso-admin-controls-du.rule-settings-biso-admin-controls-keyboard.rule-settings-biso-admin-controls-paste.rule-settings-biso-admin-controls-printing.rule-settings-biso-admin-controls-upload.rule-settings-biso-admin-controls-wm-id.rule-settings-block-page-include-context.rule-settings-block-page-target-uri.rule-settings-block-page-enabled.rule-settings-block-reason.rule-settings-bypass-parent-rule.rule-settings-check-session-duration.rule-settings-check-session-enforce.rule-settings-egress-ipv4.rule-settings-egress-ipv4-fallback.rule-settings-egress-ipv6.rule-settings-forensic-copy-enabled.rule-settings-ignore-cname-category-matches.rule-settings-insecure-disable-dnssec-validation.rule-settings-ip-categories.rule-settings-ip-indicator-feeds.rule-settings-l4override-ip.rule-settings-l4override-port.rule-settings-notification-settings-enabled.rule-settings-notification-settings-include-context.rule-settings-notification-settings-msg.rule-settings-notification-settings-support-url.rule-settings-override-host.rule-settings-override-ips.rule-settings-payload-log-enabled.rule-settings-quarantine-file-types.rule-settings-redirect-include-context.rule-settings-redirect-preserve-path-and-query.rule-settings-redirect-target-uri.rule-settings-resolve-dns-internally-fallback.rule-settings-resolve-dns-internally-view-id.rule-settings-resolve-dns-through-cloudflare.rule-settings-untrusted-cert-action`.split(`.`).some(t=>e[t]!==void 0)){let t=[`rule-settings-block-page-target-uri`,`rule-settings-redirect-target-uri`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --rule_settings-* flag is set`)}return!0})}const Up={command:`create`,describe:`Create a new Zero Trust Gateway rule.`,builder:Hp,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/rules`,pathParams:{},bodyKind:`json`,body:{action:e.action,description:e.description,"device-posture":e[`device-posture`],enabled:e.enabled,"expiration-duration":e[`expiration-duration`],filters:e.filters,identity:e.identity,name:e.name,precedence:e.precedence,"rule-settings-allow-child-bypass":e[`rule-settings-allow-child-bypass`],"rule-settings-audit-ssh-command-logging":e[`rule-settings-audit-ssh-command-logging`],"rule-settings-biso-admin-controls-copy":e[`rule-settings-biso-admin-controls-copy`],"rule-settings-biso-admin-controls-dcp":e[`rule-settings-biso-admin-controls-dcp`],"rule-settings-biso-admin-controls-dd":e[`rule-settings-biso-admin-controls-dd`],"rule-settings-biso-admin-controls-dk":e[`rule-settings-biso-admin-controls-dk`],"rule-settings-biso-admin-controls-download":e[`rule-settings-biso-admin-controls-download`],"rule-settings-biso-admin-controls-dp":e[`rule-settings-biso-admin-controls-dp`],"rule-settings-biso-admin-controls-du":e[`rule-settings-biso-admin-controls-du`],"rule-settings-biso-admin-controls-keyboard":e[`rule-settings-biso-admin-controls-keyboard`],"rule-settings-biso-admin-controls-paste":e[`rule-settings-biso-admin-controls-paste`],"rule-settings-biso-admin-controls-printing":e[`rule-settings-biso-admin-controls-printing`],"rule-settings-biso-admin-controls-upload":e[`rule-settings-biso-admin-controls-upload`],"rule-settings-biso-admin-controls-version":e[`rule-settings-biso-admin-controls-version`],"rule-settings-biso-admin-controls-wm-id":e[`rule-settings-biso-admin-controls-wm-id`],"rule-settings-block-page-include-context":e[`rule-settings-block-page-include-context`],"rule-settings-block-page-target-uri":e[`rule-settings-block-page-target-uri`],"rule-settings-block-page-enabled":e[`rule-settings-block-page-enabled`],"rule-settings-block-reason":e[`rule-settings-block-reason`],"rule-settings-bypass-parent-rule":e[`rule-settings-bypass-parent-rule`],"rule-settings-check-session-duration":e[`rule-settings-check-session-duration`],"rule-settings-check-session-enforce":e[`rule-settings-check-session-enforce`],"rule-settings-egress-ipv4":e[`rule-settings-egress-ipv4`],"rule-settings-egress-ipv4-fallback":e[`rule-settings-egress-ipv4-fallback`],"rule-settings-egress-ipv6":e[`rule-settings-egress-ipv6`],"rule-settings-forensic-copy-enabled":e[`rule-settings-forensic-copy-enabled`],"rule-settings-ignore-cname-category-matches":e[`rule-settings-ignore-cname-category-matches`],"rule-settings-insecure-disable-dnssec-validation":e[`rule-settings-insecure-disable-dnssec-validation`],"rule-settings-ip-categories":e[`rule-settings-ip-categories`],"rule-settings-ip-indicator-feeds":e[`rule-settings-ip-indicator-feeds`],"rule-settings-l4override-ip":e[`rule-settings-l4override-ip`],"rule-settings-l4override-port":e[`rule-settings-l4override-port`],"rule-settings-notification-settings-enabled":e[`rule-settings-notification-settings-enabled`],"rule-settings-notification-settings-include-context":e[`rule-settings-notification-settings-include-context`],"rule-settings-notification-settings-msg":e[`rule-settings-notification-settings-msg`],"rule-settings-notification-settings-support-url":e[`rule-settings-notification-settings-support-url`],"rule-settings-override-host":e[`rule-settings-override-host`],"rule-settings-override-ips":e[`rule-settings-override-ips`],"rule-settings-payload-log-enabled":e[`rule-settings-payload-log-enabled`],"rule-settings-quarantine-file-types":e[`rule-settings-quarantine-file-types`],"rule-settings-redirect-include-context":e[`rule-settings-redirect-include-context`],"rule-settings-redirect-preserve-path-and-query":e[`rule-settings-redirect-preserve-path-and-query`],"rule-settings-redirect-target-uri":e[`rule-settings-redirect-target-uri`],"rule-settings-resolve-dns-internally-fallback":e[`rule-settings-resolve-dns-internally-fallback`],"rule-settings-resolve-dns-internally-view-id":e[`rule-settings-resolve-dns-internally-view-id`],"rule-settings-resolve-dns-through-cloudflare":e[`rule-settings-resolve-dns-through-cloudflare`],"rule-settings-untrusted-cert-action":e[`rule-settings-untrusted-cert-action`],"schedule-fri":e[`schedule-fri`],"schedule-mon":e[`schedule-mon`],"schedule-sat":e[`schedule-sat`],"schedule-sun":e[`schedule-sun`],"schedule-thu":e[`schedule-thu`],"schedule-time-zone":e[`schedule-time-zone`],"schedule-tue":e[`schedule-tue`],"schedule-wed":e[`schedule-wed`],traffic:e.traffic,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${p}/gateway/rules`,{body:t})),{successLabel:`Created`});return}e.action===void 0&&(e.action=await a(`action`,"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`])),e.name===void 0&&(e.name=await t(`name`,`Specify the rule name.`));let h={};e.action!==void 0&&s(h,[`action`],f(e.action,`action`,`text`)),e.description!==void 0&&s(h,[`description`],f(e.description,`description`,`text`)),e[`device-posture`]!==void 0&&s(h,[`device_posture`],f(e[`device-posture`],`device-posture`,`text`)),e.enabled!==void 0&&s(h,[`enabled`],e.enabled),e[`expiration-duration`]!==void 0&&s(h,[`expiration`,`duration`],e[`expiration-duration`]),e.filters!==void 0&&s(h,[`filters`],e.filters),e.identity!==void 0&&s(h,[`identity`],f(e.identity,`identity`,`text`)),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),e.precedence!==void 0&&s(h,[`precedence`],e.precedence),e[`rule-settings-allow-child-bypass`]!==void 0&&s(h,[`rule_settings`,`allow_child_bypass`],e[`rule-settings-allow-child-bypass`]),e[`rule-settings-audit-ssh-command-logging`]!==void 0&&s(h,[`rule_settings`,`audit_ssh`,`command_logging`],e[`rule-settings-audit-ssh-command-logging`]),e[`rule-settings-biso-admin-controls-copy`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`copy`],f(e[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`)),e[`rule-settings-biso-admin-controls-dcp`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`dcp`],e[`rule-settings-biso-admin-controls-dcp`]),e[`rule-settings-biso-admin-controls-dd`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`dd`],e[`rule-settings-biso-admin-controls-dd`]),e[`rule-settings-biso-admin-controls-dk`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`dk`],e[`rule-settings-biso-admin-controls-dk`]),e[`rule-settings-biso-admin-controls-download`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`download`],f(e[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`)),e[`rule-settings-biso-admin-controls-dp`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`dp`],e[`rule-settings-biso-admin-controls-dp`]),e[`rule-settings-biso-admin-controls-du`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`du`],e[`rule-settings-biso-admin-controls-du`]),e[`rule-settings-biso-admin-controls-keyboard`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`keyboard`],f(e[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`)),e[`rule-settings-biso-admin-controls-paste`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`paste`],f(e[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`)),e[`rule-settings-biso-admin-controls-printing`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`printing`],f(e[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`)),e[`rule-settings-biso-admin-controls-upload`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`upload`],f(e[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`)),e[`rule-settings-biso-admin-controls-version`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`version`],f(e[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`)),e[`rule-settings-biso-admin-controls-wm-id`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`wm_id`],f(e[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)),e[`rule-settings-block-page-include-context`]!==void 0&&s(h,[`rule_settings`,`block_page`,`include_context`],e[`rule-settings-block-page-include-context`]),e[`rule-settings-block-page-target-uri`]!==void 0&&s(h,[`rule_settings`,`block_page`,`target_uri`],f(e[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)),e[`rule-settings-block-page-enabled`]!==void 0&&s(h,[`rule_settings`,`block_page_enabled`],e[`rule-settings-block-page-enabled`]),e[`rule-settings-block-reason`]!==void 0&&s(h,[`rule_settings`,`block_reason`],f(e[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`)),e[`rule-settings-bypass-parent-rule`]!==void 0&&s(h,[`rule_settings`,`bypass_parent_rule`],e[`rule-settings-bypass-parent-rule`]),e[`rule-settings-check-session-duration`]!==void 0&&s(h,[`rule_settings`,`check_session`,`duration`],f(e[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`)),e[`rule-settings-check-session-enforce`]!==void 0&&s(h,[`rule_settings`,`check_session`,`enforce`],e[`rule-settings-check-session-enforce`]),e[`rule-settings-egress-ipv4`]!==void 0&&s(h,[`rule_settings`,`egress`,`ipv4`],f(e[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`)),e[`rule-settings-egress-ipv4-fallback`]!==void 0&&s(h,[`rule_settings`,`egress`,`ipv4_fallback`],f(e[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`)),e[`rule-settings-egress-ipv6`]!==void 0&&s(h,[`rule_settings`,`egress`,`ipv6`],f(e[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)),e[`rule-settings-forensic-copy-enabled`]!==void 0&&s(h,[`rule_settings`,`forensic_copy`,`enabled`],e[`rule-settings-forensic-copy-enabled`]),e[`rule-settings-ignore-cname-category-matches`]!==void 0&&s(h,[`rule_settings`,`ignore_cname_category_matches`],e[`rule-settings-ignore-cname-category-matches`]),e[`rule-settings-insecure-disable-dnssec-validation`]!==void 0&&s(h,[`rule_settings`,`insecure_disable_dnssec_validation`],e[`rule-settings-insecure-disable-dnssec-validation`]),e[`rule-settings-ip-categories`]!==void 0&&s(h,[`rule_settings`,`ip_categories`],e[`rule-settings-ip-categories`]),e[`rule-settings-ip-indicator-feeds`]!==void 0&&s(h,[`rule_settings`,`ip_indicator_feeds`],e[`rule-settings-ip-indicator-feeds`]),e[`rule-settings-l4override-ip`]!==void 0&&s(h,[`rule_settings`,`l4override`,`ip`],f(e[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`)),e[`rule-settings-l4override-port`]!==void 0&&s(h,[`rule_settings`,`l4override`,`port`],e[`rule-settings-l4override-port`]),e[`rule-settings-notification-settings-enabled`]!==void 0&&s(h,[`rule_settings`,`notification_settings`,`enabled`],e[`rule-settings-notification-settings-enabled`]),e[`rule-settings-notification-settings-include-context`]!==void 0&&s(h,[`rule_settings`,`notification_settings`,`include_context`],e[`rule-settings-notification-settings-include-context`]),e[`rule-settings-notification-settings-msg`]!==void 0&&s(h,[`rule_settings`,`notification_settings`,`msg`],f(e[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`)),e[`rule-settings-notification-settings-support-url`]!==void 0&&s(h,[`rule_settings`,`notification_settings`,`support_url`],f(e[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)),e[`rule-settings-override-host`]!==void 0&&s(h,[`rule_settings`,`override_host`],f(e[`rule-settings-override-host`],`rule-settings-override-host`,`text`)),e[`rule-settings-override-ips`]!==void 0&&s(h,[`rule_settings`,`override_ips`],e[`rule-settings-override-ips`]),e[`rule-settings-payload-log-enabled`]!==void 0&&s(h,[`rule_settings`,`payload_log`,`enabled`],e[`rule-settings-payload-log-enabled`]),e[`rule-settings-quarantine-file-types`]!==void 0&&s(h,[`rule_settings`,`quarantine`,`file_types`],e[`rule-settings-quarantine-file-types`]),e[`rule-settings-redirect-include-context`]!==void 0&&s(h,[`rule_settings`,`redirect`,`include_context`],e[`rule-settings-redirect-include-context`]),e[`rule-settings-redirect-preserve-path-and-query`]!==void 0&&s(h,[`rule_settings`,`redirect`,`preserve_path_and_query`],e[`rule-settings-redirect-preserve-path-and-query`]),e[`rule-settings-redirect-target-uri`]!==void 0&&s(h,[`rule_settings`,`redirect`,`target_uri`],f(e[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)),e[`rule-settings-resolve-dns-internally-fallback`]!==void 0&&s(h,[`rule_settings`,`resolve_dns_internally`,`fallback`],f(e[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`)),e[`rule-settings-resolve-dns-internally-view-id`]!==void 0&&s(h,[`rule_settings`,`resolve_dns_internally`,`view_id`],f(e[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)),e[`rule-settings-resolve-dns-through-cloudflare`]!==void 0&&s(h,[`rule_settings`,`resolve_dns_through_cloudflare`],e[`rule-settings-resolve-dns-through-cloudflare`]),e[`rule-settings-untrusted-cert-action`]!==void 0&&s(h,[`rule_settings`,`untrusted_cert`,`action`],f(e[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)),e[`schedule-fri`]!==void 0&&s(h,[`schedule`,`fri`],f(e[`schedule-fri`],`schedule-fri`,`text`)),e[`schedule-mon`]!==void 0&&s(h,[`schedule`,`mon`],f(e[`schedule-mon`],`schedule-mon`,`text`)),e[`schedule-sat`]!==void 0&&s(h,[`schedule`,`sat`],f(e[`schedule-sat`],`schedule-sat`,`text`)),e[`schedule-sun`]!==void 0&&s(h,[`schedule`,`sun`],f(e[`schedule-sun`],`schedule-sun`,`text`)),e[`schedule-thu`]!==void 0&&s(h,[`schedule`,`thu`],f(e[`schedule-thu`],`schedule-thu`,`text`)),e[`schedule-time-zone`]!==void 0&&s(h,[`schedule`,`time_zone`],f(e[`schedule-time-zone`],`schedule-time-zone`,`text`)),e[`schedule-tue`]!==void 0&&s(h,[`schedule`,`tue`],f(e[`schedule-tue`],`schedule-tue`,`text`)),e[`schedule-wed`]!==void 0&&s(h,[`schedule`,`wed`],f(e[`schedule-wed`],`schedule-wed`,`text`)),e.traffic!==void 0&&s(h,[`traffic`],f(e.traffic,`traffic`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${p}/gateway/rules`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created`})}};function Wp(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Gp={command:`delete <rule-id>`,describe:`Delete a Zero Trust Gateway rule.`,builder:Wp,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust gateway rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/rules/${t[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(t[`rule-id`]))}`,pathParams:{"rule-id":String(t[`rule-id`]??``)},bodyKind:`json`,body:{body:t.body}});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body);l(await d(`Deleting`,async()=>n.delete(`/accounts/${a}/gateway/rules/${encodeURIComponent(String(t[`rule-id`]))}`,{body:e})),{successLabel:`Deleted`});return}l(await d(`Deleting`,async()=>n.zeroTrust.gateway.rules.delete(t[`rule-id`],a)),{successLabel:`Deleted`})}};function Kp(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qp={command:`get <rule-id>`,describe:`Get a single Zero Trust Gateway rule.`,builder:Kp,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.rules.get(e[`rule-id`],n)),{successLabel:`Loaded`})}};function Jp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yp={command:`list-tenant`,describe:`List Zero Trust Gateway rules for the parent account of an account in the MSP configuration.`,builder:Jp,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway rules list-tenant`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/rules/tenant`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.rules.listTenant(n)),{successLabel:`Loaded`})}};function Xp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zp={command:`list`,describe:`List Zero Trust Gateway rules for an account.`,builder:Xp,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/rules`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.gateway.rules.list(n)),{successLabel:`Loaded`})}};function Qp(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $p={command:`reset-expiration <rule-id>`,describe:"Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and it has a default duration. The Zero Trust Gateway Rule must have values for both `expiration.expires_at` and `expiration.duration`.",builder:Qp,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway rules reset-expiration`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}/reset_expiration`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Creating`,async()=>t.zeroTrust.gateway.rules.resetExpiration(e[`rule-id`],n)),{successLabel:`Created`})}};function em(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`action`,{type:`string`,description:"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",choices:[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`]}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`device-posture`,{type:`string`,description:`Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`}).option(`expiration-duration`,{type:`number`,description:"Defines the default duration a policy active in minutes. Must set in order to use the `reset_expiration` endpoint on this rule."}).option(`filters`,{type:`string`,array:!0,description:`Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.`}).option(`identity`,{type:`string`,description:`Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`rule-settings-allow-child-bypass`,{type:`boolean`,description:`Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.`}).option(`rule-settings-audit-ssh-command-logging`,{type:`boolean`,description:`Enable SSH command logging.`}).option(`rule-settings-biso-admin-controls-copy`,{type:`string`,description:`Configure copy behavior. If set to remote_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dcp`,{type:`boolean`,description:'Set to false to enable copy-pasting. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dd`,{type:`boolean`,description:'Set to false to enable downloading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dk`,{type:`boolean`,description:'Set to false to enable keyboard usage. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-download`,{type:`string`,description:`Configure download behavior. When set to remote_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dp`,{type:`boolean`,description:'Set to false to enable printing. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-du`,{type:`boolean`,description:'Set to false to enable uploading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-keyboard`,{type:`string`,description:`Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-paste`,{type:`string`,description:`Configure paste behavior. If set to remote_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-printing`,{type:`string`,description:`Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-upload`,{type:`string`,description:`Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-version`,{type:`string`,description:`Indicate which version of the browser isolation controls should apply.`,choices:[`v1`,`v2`]}).option(`rule-settings-biso-admin-controls-wm-id`,{type:`string`,description:`Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser.`}).option(`rule-settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-block-page-enabled`,{type:`boolean`,description:"Enable the custom block page. Settable only for `dns` rules with action `block`."}).option(`rule-settings-block-reason`,{type:`string`,description:"Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`."}).option(`rule-settings-bypass-parent-rule`,{type:`boolean`,description:`Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.`}).option(`rule-settings-check-session-duration`,{type:`string`,description:`Sets the required session freshness threshold. The API returns a normalized version of this value.`}).option(`rule-settings-check-session-enforce`,{type:`boolean`,description:`Enable session enforcement.`}).option(`rule-settings-egress-ipv4`,{type:`string`,description:`Specify the IPv4 address to use for egress.`}).option(`rule-settings-egress-ipv4-fallback`,{type:`string`,description:`Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.`}).option(`rule-settings-egress-ipv6`,{type:`string`,description:`Specify the IPv6 range to use for egress.`}).option(`rule-settings-forensic-copy-enabled`,{type:`boolean`,description:`Enable sending the copy to storage.`}).option(`rule-settings-ignore-cname-category-matches`,{type:`boolean`,description:"Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-insecure-disable-dnssec-validation`,{type:`boolean`,description:"Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules."}).option(`rule-settings-ip-categories`,{type:`boolean`,description:"Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-ip-indicator-feeds`,{type:`boolean`,description:"Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-l4override-ip`,{type:`string`,description:`Defines the IPv4 or IPv6 address.`}).option(`rule-settings-l4override-port`,{type:`number`,description:`Defines a port number to use for TCP/UDP overrides.`}).option(`rule-settings-notification-settings-enabled`,{type:`boolean`,description:`Enable notification.`}).option(`rule-settings-notification-settings-include-context`,{type:`boolean`,description:`Indicates whether to pass the context information as query parameters.`}).option(`rule-settings-notification-settings-msg`,{type:`string`,description:`Customize the message shown in the notification.`}).option(`rule-settings-notification-settings-support-url`,{type:`string`,description:`Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.`}).option(`rule-settings-override-host`,{type:`string`,description:"Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-override-ips`,{type:`string`,array:!0,description:"Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-payload-log-enabled`,{type:`boolean`,description:`Enable DLP payload logging for this rule.`}).option(`rule-settings-quarantine-file-types`,{type:`string`,array:!0,description:`Specify the types of files to sandbox.`}).option(`rule-settings-redirect-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-redirect-preserve-path-and-query`,{type:`boolean`,description:`Specify whether to append the path and query parameters from the original request to target_uri.`}).option(`rule-settings-redirect-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-resolve-dns-internally-fallback`,{type:`string`,description:`Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.`,choices:[`none`,`public_dns`]}).option(`rule-settings-resolve-dns-internally-view-id`,{type:`string`,description:`Specify the internal DNS view identifier to pass to the internal DNS service.`}).option(`rule-settings-resolve-dns-through-cloudflare`,{type:`boolean`,description:"Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dns_resolver` rules."}).option(`rule-settings-untrusted-cert-action`,{type:`string`,description:`Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.`,choices:[`pass_through`,`block`,`error`]}).option(`schedule-fri`,{type:`string`,description:`Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-mon`,{type:`string`,description:`Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sat`,{type:`string`,description:`Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sun`,{type:`string`,description:`Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-thu`,{type:`string`,description:`Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-time-zone`,{type:`string`,description:`Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.`}).option(`schedule-tue`,{type:`string`,description:`Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-wed`,{type:`string`,description:`Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`traffic`,{type:`string`,description:`Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if(`rule-settings-allow-child-bypass.rule-settings-audit-ssh-command-logging.rule-settings-biso-admin-controls-copy.rule-settings-biso-admin-controls-dcp.rule-settings-biso-admin-controls-dd.rule-settings-biso-admin-controls-dk.rule-settings-biso-admin-controls-download.rule-settings-biso-admin-controls-dp.rule-settings-biso-admin-controls-du.rule-settings-biso-admin-controls-keyboard.rule-settings-biso-admin-controls-paste.rule-settings-biso-admin-controls-printing.rule-settings-biso-admin-controls-upload.rule-settings-biso-admin-controls-wm-id.rule-settings-block-page-include-context.rule-settings-block-page-target-uri.rule-settings-block-page-enabled.rule-settings-block-reason.rule-settings-bypass-parent-rule.rule-settings-check-session-duration.rule-settings-check-session-enforce.rule-settings-egress-ipv4.rule-settings-egress-ipv4-fallback.rule-settings-egress-ipv6.rule-settings-forensic-copy-enabled.rule-settings-ignore-cname-category-matches.rule-settings-insecure-disable-dnssec-validation.rule-settings-ip-categories.rule-settings-ip-indicator-feeds.rule-settings-l4override-ip.rule-settings-l4override-port.rule-settings-notification-settings-enabled.rule-settings-notification-settings-include-context.rule-settings-notification-settings-msg.rule-settings-notification-settings-support-url.rule-settings-override-host.rule-settings-override-ips.rule-settings-payload-log-enabled.rule-settings-quarantine-file-types.rule-settings-redirect-include-context.rule-settings-redirect-preserve-path-and-query.rule-settings-redirect-target-uri.rule-settings-resolve-dns-internally-fallback.rule-settings-resolve-dns-internally-view-id.rule-settings-resolve-dns-through-cloudflare.rule-settings-untrusted-cert-action`.split(`.`).some(t=>e[t]!==void 0)){let t=[`rule-settings-block-page-target-uri`,`rule-settings-redirect-target-uri`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --rule_settings-* flag is set`)}return!0})}const tm={command:`update <rule-id>`,describe:`Update a configured Zero Trust Gateway rule.`,builder:em,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust gateway rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/gateway/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`json`,body:{action:e.action,description:e.description,"device-posture":e[`device-posture`],enabled:e.enabled,"expiration-duration":e[`expiration-duration`],filters:e.filters,identity:e.identity,name:e.name,precedence:e.precedence,"rule-settings-allow-child-bypass":e[`rule-settings-allow-child-bypass`],"rule-settings-audit-ssh-command-logging":e[`rule-settings-audit-ssh-command-logging`],"rule-settings-biso-admin-controls-copy":e[`rule-settings-biso-admin-controls-copy`],"rule-settings-biso-admin-controls-dcp":e[`rule-settings-biso-admin-controls-dcp`],"rule-settings-biso-admin-controls-dd":e[`rule-settings-biso-admin-controls-dd`],"rule-settings-biso-admin-controls-dk":e[`rule-settings-biso-admin-controls-dk`],"rule-settings-biso-admin-controls-download":e[`rule-settings-biso-admin-controls-download`],"rule-settings-biso-admin-controls-dp":e[`rule-settings-biso-admin-controls-dp`],"rule-settings-biso-admin-controls-du":e[`rule-settings-biso-admin-controls-du`],"rule-settings-biso-admin-controls-keyboard":e[`rule-settings-biso-admin-controls-keyboard`],"rule-settings-biso-admin-controls-paste":e[`rule-settings-biso-admin-controls-paste`],"rule-settings-biso-admin-controls-printing":e[`rule-settings-biso-admin-controls-printing`],"rule-settings-biso-admin-controls-upload":e[`rule-settings-biso-admin-controls-upload`],"rule-settings-biso-admin-controls-version":e[`rule-settings-biso-admin-controls-version`],"rule-settings-biso-admin-controls-wm-id":e[`rule-settings-biso-admin-controls-wm-id`],"rule-settings-block-page-include-context":e[`rule-settings-block-page-include-context`],"rule-settings-block-page-target-uri":e[`rule-settings-block-page-target-uri`],"rule-settings-block-page-enabled":e[`rule-settings-block-page-enabled`],"rule-settings-block-reason":e[`rule-settings-block-reason`],"rule-settings-bypass-parent-rule":e[`rule-settings-bypass-parent-rule`],"rule-settings-check-session-duration":e[`rule-settings-check-session-duration`],"rule-settings-check-session-enforce":e[`rule-settings-check-session-enforce`],"rule-settings-egress-ipv4":e[`rule-settings-egress-ipv4`],"rule-settings-egress-ipv4-fallback":e[`rule-settings-egress-ipv4-fallback`],"rule-settings-egress-ipv6":e[`rule-settings-egress-ipv6`],"rule-settings-forensic-copy-enabled":e[`rule-settings-forensic-copy-enabled`],"rule-settings-ignore-cname-category-matches":e[`rule-settings-ignore-cname-category-matches`],"rule-settings-insecure-disable-dnssec-validation":e[`rule-settings-insecure-disable-dnssec-validation`],"rule-settings-ip-categories":e[`rule-settings-ip-categories`],"rule-settings-ip-indicator-feeds":e[`rule-settings-ip-indicator-feeds`],"rule-settings-l4override-ip":e[`rule-settings-l4override-ip`],"rule-settings-l4override-port":e[`rule-settings-l4override-port`],"rule-settings-notification-settings-enabled":e[`rule-settings-notification-settings-enabled`],"rule-settings-notification-settings-include-context":e[`rule-settings-notification-settings-include-context`],"rule-settings-notification-settings-msg":e[`rule-settings-notification-settings-msg`],"rule-settings-notification-settings-support-url":e[`rule-settings-notification-settings-support-url`],"rule-settings-override-host":e[`rule-settings-override-host`],"rule-settings-override-ips":e[`rule-settings-override-ips`],"rule-settings-payload-log-enabled":e[`rule-settings-payload-log-enabled`],"rule-settings-quarantine-file-types":e[`rule-settings-quarantine-file-types`],"rule-settings-redirect-include-context":e[`rule-settings-redirect-include-context`],"rule-settings-redirect-preserve-path-and-query":e[`rule-settings-redirect-preserve-path-and-query`],"rule-settings-redirect-target-uri":e[`rule-settings-redirect-target-uri`],"rule-settings-resolve-dns-internally-fallback":e[`rule-settings-resolve-dns-internally-fallback`],"rule-settings-resolve-dns-internally-view-id":e[`rule-settings-resolve-dns-internally-view-id`],"rule-settings-resolve-dns-through-cloudflare":e[`rule-settings-resolve-dns-through-cloudflare`],"rule-settings-untrusted-cert-action":e[`rule-settings-untrusted-cert-action`],"schedule-fri":e[`schedule-fri`],"schedule-mon":e[`schedule-mon`],"schedule-sat":e[`schedule-sat`],"schedule-sun":e[`schedule-sun`],"schedule-thu":e[`schedule-thu`],"schedule-time-zone":e[`schedule-time-zone`],"schedule-tue":e[`schedule-tue`],"schedule-wed":e[`schedule-wed`],traffic:e.traffic,body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${p}/gateway/rules/${encodeURIComponent(String(e[`rule-id`]))}`,{body:t})),{successLabel:`Updated`});return}e.action===void 0&&(e.action=await a(`action`,"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`])),e.name===void 0&&(e.name=await t(`name`,`Specify the rule name.`));let h={};e.action!==void 0&&s(h,[`action`],f(e.action,`action`,`text`)),e.description!==void 0&&s(h,[`description`],f(e.description,`description`,`text`)),e[`device-posture`]!==void 0&&s(h,[`device_posture`],f(e[`device-posture`],`device-posture`,`text`)),e.enabled!==void 0&&s(h,[`enabled`],e.enabled),e[`expiration-duration`]!==void 0&&s(h,[`expiration`,`duration`],e[`expiration-duration`]),e.filters!==void 0&&s(h,[`filters`],e.filters),e.identity!==void 0&&s(h,[`identity`],f(e.identity,`identity`,`text`)),e.name!==void 0&&s(h,[`name`],f(e.name,`name`,`text`)),e.precedence!==void 0&&s(h,[`precedence`],e.precedence),e[`rule-settings-allow-child-bypass`]!==void 0&&s(h,[`rule_settings`,`allow_child_bypass`],e[`rule-settings-allow-child-bypass`]),e[`rule-settings-audit-ssh-command-logging`]!==void 0&&s(h,[`rule_settings`,`audit_ssh`,`command_logging`],e[`rule-settings-audit-ssh-command-logging`]),e[`rule-settings-biso-admin-controls-copy`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`copy`],f(e[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`)),e[`rule-settings-biso-admin-controls-dcp`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`dcp`],e[`rule-settings-biso-admin-controls-dcp`]),e[`rule-settings-biso-admin-controls-dd`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`dd`],e[`rule-settings-biso-admin-controls-dd`]),e[`rule-settings-biso-admin-controls-dk`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`dk`],e[`rule-settings-biso-admin-controls-dk`]),e[`rule-settings-biso-admin-controls-download`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`download`],f(e[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`)),e[`rule-settings-biso-admin-controls-dp`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`dp`],e[`rule-settings-biso-admin-controls-dp`]),e[`rule-settings-biso-admin-controls-du`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`du`],e[`rule-settings-biso-admin-controls-du`]),e[`rule-settings-biso-admin-controls-keyboard`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`keyboard`],f(e[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`)),e[`rule-settings-biso-admin-controls-paste`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`paste`],f(e[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`)),e[`rule-settings-biso-admin-controls-printing`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`printing`],f(e[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`)),e[`rule-settings-biso-admin-controls-upload`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`upload`],f(e[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`)),e[`rule-settings-biso-admin-controls-version`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`version`],f(e[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`)),e[`rule-settings-biso-admin-controls-wm-id`]!==void 0&&s(h,[`rule_settings`,`biso_admin_controls`,`wm_id`],f(e[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)),e[`rule-settings-block-page-include-context`]!==void 0&&s(h,[`rule_settings`,`block_page`,`include_context`],e[`rule-settings-block-page-include-context`]),e[`rule-settings-block-page-target-uri`]!==void 0&&s(h,[`rule_settings`,`block_page`,`target_uri`],f(e[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)),e[`rule-settings-block-page-enabled`]!==void 0&&s(h,[`rule_settings`,`block_page_enabled`],e[`rule-settings-block-page-enabled`]),e[`rule-settings-block-reason`]!==void 0&&s(h,[`rule_settings`,`block_reason`],f(e[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`)),e[`rule-settings-bypass-parent-rule`]!==void 0&&s(h,[`rule_settings`,`bypass_parent_rule`],e[`rule-settings-bypass-parent-rule`]),e[`rule-settings-check-session-duration`]!==void 0&&s(h,[`rule_settings`,`check_session`,`duration`],f(e[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`)),e[`rule-settings-check-session-enforce`]!==void 0&&s(h,[`rule_settings`,`check_session`,`enforce`],e[`rule-settings-check-session-enforce`]),e[`rule-settings-egress-ipv4`]!==void 0&&s(h,[`rule_settings`,`egress`,`ipv4`],f(e[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`)),e[`rule-settings-egress-ipv4-fallback`]!==void 0&&s(h,[`rule_settings`,`egress`,`ipv4_fallback`],f(e[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`)),e[`rule-settings-egress-ipv6`]!==void 0&&s(h,[`rule_settings`,`egress`,`ipv6`],f(e[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)),e[`rule-settings-forensic-copy-enabled`]!==void 0&&s(h,[`rule_settings`,`forensic_copy`,`enabled`],e[`rule-settings-forensic-copy-enabled`]),e[`rule-settings-ignore-cname-category-matches`]!==void 0&&s(h,[`rule_settings`,`ignore_cname_category_matches`],e[`rule-settings-ignore-cname-category-matches`]),e[`rule-settings-insecure-disable-dnssec-validation`]!==void 0&&s(h,[`rule_settings`,`insecure_disable_dnssec_validation`],e[`rule-settings-insecure-disable-dnssec-validation`]),e[`rule-settings-ip-categories`]!==void 0&&s(h,[`rule_settings`,`ip_categories`],e[`rule-settings-ip-categories`]),e[`rule-settings-ip-indicator-feeds`]!==void 0&&s(h,[`rule_settings`,`ip_indicator_feeds`],e[`rule-settings-ip-indicator-feeds`]),e[`rule-settings-l4override-ip`]!==void 0&&s(h,[`rule_settings`,`l4override`,`ip`],f(e[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`)),e[`rule-settings-l4override-port`]!==void 0&&s(h,[`rule_settings`,`l4override`,`port`],e[`rule-settings-l4override-port`]),e[`rule-settings-notification-settings-enabled`]!==void 0&&s(h,[`rule_settings`,`notification_settings`,`enabled`],e[`rule-settings-notification-settings-enabled`]),e[`rule-settings-notification-settings-include-context`]!==void 0&&s(h,[`rule_settings`,`notification_settings`,`include_context`],e[`rule-settings-notification-settings-include-context`]),e[`rule-settings-notification-settings-msg`]!==void 0&&s(h,[`rule_settings`,`notification_settings`,`msg`],f(e[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`)),e[`rule-settings-notification-settings-support-url`]!==void 0&&s(h,[`rule_settings`,`notification_settings`,`support_url`],f(e[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)),e[`rule-settings-override-host`]!==void 0&&s(h,[`rule_settings`,`override_host`],f(e[`rule-settings-override-host`],`rule-settings-override-host`,`text`)),e[`rule-settings-override-ips`]!==void 0&&s(h,[`rule_settings`,`override_ips`],e[`rule-settings-override-ips`]),e[`rule-settings-payload-log-enabled`]!==void 0&&s(h,[`rule_settings`,`payload_log`,`enabled`],e[`rule-settings-payload-log-enabled`]),e[`rule-settings-quarantine-file-types`]!==void 0&&s(h,[`rule_settings`,`quarantine`,`file_types`],e[`rule-settings-quarantine-file-types`]),e[`rule-settings-redirect-include-context`]!==void 0&&s(h,[`rule_settings`,`redirect`,`include_context`],e[`rule-settings-redirect-include-context`]),e[`rule-settings-redirect-preserve-path-and-query`]!==void 0&&s(h,[`rule_settings`,`redirect`,`preserve_path_and_query`],e[`rule-settings-redirect-preserve-path-and-query`]),e[`rule-settings-redirect-target-uri`]!==void 0&&s(h,[`rule_settings`,`redirect`,`target_uri`],f(e[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)),e[`rule-settings-resolve-dns-internally-fallback`]!==void 0&&s(h,[`rule_settings`,`resolve_dns_internally`,`fallback`],f(e[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`)),e[`rule-settings-resolve-dns-internally-view-id`]!==void 0&&s(h,[`rule_settings`,`resolve_dns_internally`,`view_id`],f(e[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)),e[`rule-settings-resolve-dns-through-cloudflare`]!==void 0&&s(h,[`rule_settings`,`resolve_dns_through_cloudflare`],e[`rule-settings-resolve-dns-through-cloudflare`]),e[`rule-settings-untrusted-cert-action`]!==void 0&&s(h,[`rule_settings`,`untrusted_cert`,`action`],f(e[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)),e[`schedule-fri`]!==void 0&&s(h,[`schedule`,`fri`],f(e[`schedule-fri`],`schedule-fri`,`text`)),e[`schedule-mon`]!==void 0&&s(h,[`schedule`,`mon`],f(e[`schedule-mon`],`schedule-mon`,`text`)),e[`schedule-sat`]!==void 0&&s(h,[`schedule`,`sat`],f(e[`schedule-sat`],`schedule-sat`,`text`)),e[`schedule-sun`]!==void 0&&s(h,[`schedule`,`sun`],f(e[`schedule-sun`],`schedule-sun`,`text`)),e[`schedule-thu`]!==void 0&&s(h,[`schedule`,`thu`],f(e[`schedule-thu`],`schedule-thu`,`text`)),e[`schedule-time-zone`]!==void 0&&s(h,[`schedule`,`time_zone`],f(e[`schedule-time-zone`],`schedule-time-zone`,`text`)),e[`schedule-tue`]!==void 0&&s(h,[`schedule`,`tue`],f(e[`schedule-tue`],`schedule-tue`,`text`)),e[`schedule-wed`]!==void 0&&s(h,[`schedule`,`wed`],f(e[`schedule-wed`],`schedule-wed`,`text`)),e.traffic!==void 0&&s(h,[`traffic`],f(e.traffic,`traffic`,`text`)),l(await d(`Updating`,async()=>n.put(`/accounts/${p}/gateway/rules/${encodeURIComponent(String(e[`rule-id`]))}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated`})}},nm={command:`rules`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(Up).command(Gp).command(qp).command(Zp).command(Yp).command($p).command(tm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},rm={command:`gateway`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(zf).command(Vf).command(rf).command(df).command(mf).command(Df).command(Lf).command(rp).command(mp).command(yp).command(Ap).command(Vp).command(nm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function im(e){return e.option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const am={command:`create`,describe:`Creates a new Access group.`,builder:im,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/groups`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{name:e.name,body:e.body}});return}let r=await i(e);if(e.zoneId=await n({zone:e.zone},r,{quiet:e.quiet}),e.body){let t=c(e.body);l(await d(`Creating`,async()=>r.post(`/zones/${e.zoneId}/access/groups`,{body:t})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await t(`name`,`The name of the Access group.`));let a={};e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),l(await d(`Creating`,async()=>r.post(`/zones/${e.zoneId}/access/groups`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Created`})}};function om(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const sm={command:`delete <group-id>`,describe:`Deletes an Access group.`,builder:om,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/groups/${t[`group-id`]==null?`<group-id>`:encodeURIComponent(String(t[`group-id`]))}`,pathParams:{"group-id":String(t[`group-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let r=await i(t),a=await n({zone:t.zone},r,{quiet:t.quiet});if(t.zoneId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>r.zeroTrust.groups.delete(t[`group-id`],a)),{successLabel:`Deleted`})}};function cm(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lm={command:`get <group-id>`,describe:`Fetches a single Access group.`,builder:cm,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.groups.get(e[`group-id`],r)),{successLabel:`Loaded`})}};function um(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dm={command:`list`,describe:`Lists all Access groups.`,builder:um,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/groups`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.groups.list(r)),{successLabel:`Loaded`})}};function fm(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pm={command:`update <group-id>`,describe:`Updates a configured Access group.`,builder:fm,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{name:e.name,body:e.body}});return}let r=await i(e);if(e.zoneId=await n({zone:e.zone},r,{quiet:e.quiet}),e.body){let t=c(e.body);l(await d(`Updating`,async()=>r.put(`/zones/${e.zoneId}/access/groups/${encodeURIComponent(String(e[`group-id`]))}`,{body:t})),{successLabel:`Updated`});return}e.name===void 0&&(e.name=await t(`name`,`The name of the Access group.`));let a={};e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),l(await d(`Updating`,async()=>r.put(`/zones/${e.zoneId}/access/groups/${encodeURIComponent(String(e[`group-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},mm={command:`groups`,describe:`Groups operations`,builder:e=>e.command(am).command(sm).command(lm).command(dm).command(pm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function hm(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const gm={command:`create`,describe:`Adds a new identity provider to Access.`,builder:hm,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust identity-providers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/identity_providers`,pathParams:{},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/access/identity_providers`,{body:r})),{successLabel:`Created`});return}l(await d(`Creating`,async()=>t.zeroTrust.identityProviders.create(n)),{successLabel:`Created`})}};function _m(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const vm={command:`delete <identity-provider-id>`,describe:`Deletes an identity provider from Access.`,builder:_m,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust identity-providers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/identity_providers/${t[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(t[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(t[`identity-provider-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.identityProviders.delete(t[`identity-provider-id`],a)),{successLabel:`Deleted`})}};function ym(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const bm={command:`get <identity-provider-id>`,describe:`Fetches a configured identity provider.`,builder:ym,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust identity-providers get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.identityProviders.get(e[`identity-provider-id`],n)),{successLabel:`Loaded`})}};function xm(e){return e.option(`scim-enabled`,{type:`string`,description:`Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sm={command:`list`,describe:`Lists all configured identity providers.`,builder:xm,handler:async e=>{let t={scim_enabled:e[`scim-enabled`],page:e.page,per_page:e[`per-page`]};if(e.dryRun){u({command:`cf zero-trust identity-providers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/identity_providers`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.identityProviders.list(a,t)),{successLabel:`Loaded`})}};function Cm(e){return e.option(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`cf-resource-id`,{type:`string`,description:`The unique Cloudflare-generated Id of the SCIM Group resource; also known as the "Id".`}).option(`idp-resource-id`,{type:`string`,description:`The IdP-generated Id of the SCIM Group resource; also known as the "external Id".`}).option(`name`,{type:`string`,description:`The display name of the SCIM Group resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wm={command:`list`,describe:`Lists SCIM Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:Cm,handler:async e=>{let t={cf_resource_id:e[`cf-resource-id`],idp_resource_id:e[`idp-resource-id`],name:e.name,page:e.page,per_page:e[`per-page`]};if(e.dryRun){u({command:`cf zero-trust identity-providers scim groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}/scim/groups`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``)},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.identityProviders.scim.groups.list(e[`identity-provider-id`],a,t)),{successLabel:`Loaded`})}},Tm={command:`groups`,describe:`Identity provider integrations (Okta, Azure AD, etc.) used to authenticate users in Access`,builder:e=>e.command(wm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Em(e){return e.option(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`cf-resource-id`,{type:`string`,description:`The unique Cloudflare-generated Id of the SCIM User resource; also known as the "Id".`}).option(`idp-resource-id`,{type:`string`,description:`The IdP-generated Id of the SCIM User resource; also known as the "external Id".`}).option(`username`,{type:`string`,description:`The username of the SCIM User resource.`}).option(`email`,{type:`string`,description:`The email address of the SCIM User resource.`}).option(`name`,{type:`string`,description:`The name of the SCIM User resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dm={command:`list`,describe:`Lists SCIM User resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:Em,handler:async e=>{let t={cf_resource_id:e[`cf-resource-id`],idp_resource_id:e[`idp-resource-id`],username:e.username,email:e.email,name:e.name,page:e.page,per_page:e[`per-page`]};if(e.dryRun){u({command:`cf zero-trust identity-providers scim users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}/scim/users`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``)},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.identityProviders.scim.users.list(e[`identity-provider-id`],a,t)),{successLabel:`Loaded`})}},Om={command:`users`,describe:`Identity provider integrations (Okta, Azure AD, etc.) used to authenticate users in Access`,builder:e=>e.command(Dm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},km={command:`scim`,describe:`Operations for identity-providers.scim`,builder:e=>e.command(Tm).command(Om).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Am(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const jm={command:`update <identity-provider-id>`,describe:`Updates a configured identity provider.`,builder:Am,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust identity-providers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``)},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/identity_providers/${encodeURIComponent(String(e[`identity-provider-id`]))}`,{body:r})),{successLabel:`Updated`});return}l(await d(`Updating`,async()=>t.zeroTrust.identityProviders.update(e[`identity-provider-id`],n)),{successLabel:`Updated`})}},Mm={command:`identity-providers`,describe:`Identity provider integrations (Okta, Azure AD, etc.) used to authenticate users in Access`,builder:e=>e.command(gm).command(vm).command(bm).command(Sm).command(jm).command(km).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Nm(e){return e.option(`comment`,{type:`string`,description:`An optional description of the hostname route.`}).option(`hostname`,{type:`string`,description:`The hostname of the route.`}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Pm={command:`create`,describe:`Create a hostname route.`,builder:Nm,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust networks hostname-routes create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zerotrust/routes/hostname`,pathParams:{},bodyKind:`json`,body:{comment:e.comment,hostname:e.hostname,"tunnel-id":e[`tunnel-id`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/zerotrust/routes/hostname`,{body:r})),{successLabel:`Created`});return}let a={};e.comment!==void 0&&s(a,[`comment`],f(e.comment,`comment`,`text`)),e.hostname!==void 0&&s(a,[`hostname`],f(e.hostname,`hostname`,`text`)),e[`tunnel-id`]!==void 0&&s(a,[`tunnel_id`],f(e[`tunnel-id`],`tunnel-id`,`text`)),l(await d(`Creating`,async()=>t.post(`/accounts/${n}/zerotrust/routes/hostname`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Created`})}};function Fm(e){return e.positional(`hostname-route-id`,{type:`string`,description:`The hostname route ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Im={command:`delete <hostname-route-id>`,describe:`Delete a hostname route.`,builder:Fm,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust networks hostname-routes delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zerotrust/routes/hostname/${t[`hostname-route-id`]==null?`<hostname-route-id>`:encodeURIComponent(String(t[`hostname-route-id`]))}`,pathParams:{"hostname-route-id":String(t[`hostname-route-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.networks.hostnameRoutes.delete(a,t[`hostname-route-id`])),{successLabel:`Deleted`})}};function Lm(e){return e.positional(`hostname-route-id`,{type:`string`,description:`The hostname route ID.`,demandOption:!0}).option(`comment`,{type:`string`,description:`An optional description of the hostname route.`}).option(`hostname`,{type:`string`,description:`The hostname of the route.`}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Rm={command:`edit <hostname-route-id>`,describe:`Updates a hostname route.`,builder:Lm,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust networks hostname-routes edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zerotrust/routes/hostname/${e[`hostname-route-id`]==null?`<hostname-route-id>`:encodeURIComponent(String(e[`hostname-route-id`]))}`,pathParams:{"hostname-route-id":String(e[`hostname-route-id`]??``)},bodyKind:`json`,body:{comment:e.comment,hostname:e.hostname,"tunnel-id":e[`tunnel-id`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/zerotrust/routes/hostname/${encodeURIComponent(String(e[`hostname-route-id`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e.comment!==void 0&&s(a,[`comment`],f(e.comment,`comment`,`text`)),e.hostname!==void 0&&s(a,[`hostname`],f(e.hostname,`hostname`,`text`)),e[`tunnel-id`]!==void 0&&s(a,[`tunnel_id`],f(e[`tunnel-id`],`tunnel-id`,`text`)),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/zerotrust/routes/hostname/${encodeURIComponent(String(e[`hostname-route-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}};function zm(e){return e.positional(`hostname-route-id`,{type:`string`,description:`The hostname route ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bm={command:`get <hostname-route-id>`,describe:`Get a hostname route.`,builder:zm,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust networks hostname-routes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zerotrust/routes/hostname/${e[`hostname-route-id`]==null?`<hostname-route-id>`:encodeURIComponent(String(e[`hostname-route-id`]))}`,pathParams:{"hostname-route-id":String(e[`hostname-route-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.networks.hostnameRoutes.get(n,e[`hostname-route-id`])),{successLabel:`Loaded`})}};function Vm(e){return e.option(`id`,{type:`string`,description:`The hostname route ID.`}).option(`hostname`,{type:`string`,description:`If set, only list hostname routes that contain a substring of the given value, the filter is case-insensitive.`}).option(`tunnel-id`,{type:`string`,description:`If set, only list hostname routes that point to a specific tunnel.`}).option(`comment`,{type:`string`,description:`If set, only list hostname routes with the given comment.`}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only return deleted hostname routes. If `false`, exclude deleted hostname routes."}).option(`per-page`,{type:`string`,description:`Number of results to display.`}).option(`page`,{type:`string`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Hm={command:`list`,describe:`Lists and filters hostname routes in an account.`,builder:Vm,handler:async e=>{let t={id:e.id,hostname:e.hostname,tunnel_id:e[`tunnel-id`],comment:e.comment,existed_at:e[`existed-at`],is_deleted:e[`is-deleted`],per_page:e[`per-page`],page:e.page};if(e.dryRun){u({command:`cf zero-trust networks hostname-routes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zerotrust/routes/hostname`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.networks.hostnameRoutes.list(a,t)),{successLabel:`Loaded`})}},Um={command:`hostname-routes`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(Pm).command(Im).command(Rm).command(Bm).command(Hm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Wm(e){return e.option(`comment`,{type:`string`,description:`Optional remark describing the route.`,default:``}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range connected by the route, in CIDR notation.`}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Gm={command:`create`,describe:`Routes a private network through a Cloudflare Tunnel.`,builder:Wm,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust networks routes create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/teamnet/routes`,pathParams:{},bodyKind:`json`,body:{comment:e.comment,network:e.network,"virtual-network-id":e[`virtual-network-id`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/teamnet/routes`,{body:t})),{successLabel:`Created`});return}e.network===void 0&&(e.network=await t(`network`,`The private IPv4 or IPv6 range connected by the route, in CIDR notation.`));let p={};e.comment!==void 0&&s(p,[`comment`],f(e.comment,`comment`,`text`)),e.network!==void 0&&s(p,[`network`],f(e.network,`network`,`text`)),e[`virtual-network-id`]!==void 0&&s(p,[`virtual_network_id`],f(e[`virtual-network-id`],`virtual-network-id`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/teamnet/routes`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function Km(e){return e.positional(`route-id`,{type:`string`,description:`UUID of the route.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const qm={command:`delete <route-id>`,describe:`Deletes a private network route from an account.`,builder:Km,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust networks routes delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/teamnet/routes/${t[`route-id`]==null?`<route-id>`:encodeURIComponent(String(t[`route-id`]))}`,pathParams:{"route-id":String(t[`route-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.networks.routes.delete(t[`route-id`],a)),{successLabel:`Deleted`})}};function Jm(e){return e.positional(`route-id`,{type:`string`,description:`UUID of the route.`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the route.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range connected by the route, in CIDR notation.`}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ym={command:`edit <route-id>`,describe:`Updates an existing private network route in an account. The fields that are meant to be updated should be provided in the body of the request.`,builder:Jm,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust networks routes edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/teamnet/routes/${e[`route-id`]==null?`<route-id>`:encodeURIComponent(String(e[`route-id`]))}`,pathParams:{"route-id":String(e[`route-id`]??``)},bodyKind:`json`,body:{comment:e.comment,network:e.network,"virtual-network-id":e[`virtual-network-id`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/teamnet/routes/${encodeURIComponent(String(e[`route-id`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e.comment!==void 0&&s(a,[`comment`],f(e.comment,`comment`,`text`)),e.network!==void 0&&s(a,[`network`],f(e.network,`network`,`text`)),e[`virtual-network-id`]!==void 0&&s(a,[`virtual_network_id`],f(e[`virtual-network-id`],`virtual-network-id`,`text`)),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/teamnet/routes/${encodeURIComponent(String(e[`route-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}};function Xm(e){return e.positional(`route-id`,{type:`string`,description:`UUID of the route.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zm={command:`get <route-id>`,describe:`Get a private network route in an account.`,builder:Xm,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust networks routes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/teamnet/routes/${e[`route-id`]==null?`<route-id>`:encodeURIComponent(String(e[`route-id`]))}`,pathParams:{"route-id":String(e[`route-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.networks.routes.get(n,e[`route-id`])),{successLabel:`Loaded`})}};function Qm(e){return e.positional(`ip`,{type:`string`,description:`Ip`,demandOption:!0}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`default-virtual-network-fallback`,{type:`boolean`,description:`When the virtual_network_id parameter is not provided the request filter will default search routes that are in the default virtual network for the account. If this parameter is set to false, the search will include routes that do not have a virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $m={command:`get <ip>`,describe:`Fetches routes that contain the given IP address.`,builder:Qm,handler:async e=>{let t={virtual_network_id:e[`virtual-network-id`],default_virtual_network_fallback:e[`default-virtual-network-fallback`]};if(e.dryRun){u({command:`cf zero-trust networks routes ips get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/teamnet/routes/ip/${e.ip==null?`<ip>`:encodeURIComponent(String(e.ip))}`,pathParams:{ip:String(e.ip??``)},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.networks.routes.ips.get(e.ip,a,t)),{successLabel:`Loaded`})}},eh={command:`ips`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command($m).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function th(e){return e.option(`comment`,{type:`string`,description:`Optional remark describing the route.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted routes. If `false`, exclude deleted routes. If empty, all routes will be included."}).option(`network-subset`,{type:`string`,description:`If set, only list routes that are contained within this IP range.`}).option(`network-superset`,{type:`string`,description:`If set, only list routes that contain this IP range.`}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`route-id`,{type:`string`,description:`UUID of the route.`}).option(`tun-types`,{type:`string`,description:`The types of tunnels to filter by, separated by commas.`}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`per-page`,{type:`string`,description:`Number of results to display.`}).option(`page`,{type:`string`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const nh={command:`list`,describe:`Lists and filters private network routes in an account.`,builder:th,handler:async e=>{let t={comment:e.comment,is_deleted:e[`is-deleted`],network_subset:e[`network-subset`],network_superset:e[`network-superset`],existed_at:e[`existed-at`],tunnel_id:e[`tunnel-id`],route_id:e[`route-id`],tun_types:e[`tun-types`],virtual_network_id:e[`virtual-network-id`],per_page:e[`per-page`],page:e.page};if(e.dryRun){u({command:`cf zero-trust networks routes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/teamnet/routes`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.networks.routes.list(a,t)),{successLabel:`Loaded`})}};function rh(e){return e.positional(`ip-network-encoded`,{type:`string`,description:`IP/CIDR range in URL-encoded format`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the route.`,default:``}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ih={command:`create <ip-network-encoded>`,describe:"Routes a private network through a Cloudflare Tunnel. The CIDR in `ip_network_encoded` must be written in URL-encoded format.",builder:rh,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust networks routes networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/teamnet/routes/network/${e[`ip-network-encoded`]==null?`<ip-network-encoded>`:encodeURIComponent(String(e[`ip-network-encoded`]))}`,pathParams:{"ip-network-encoded":String(e[`ip-network-encoded`]??``)},bodyKind:`json`,body:{comment:e.comment,"virtual-network-id":e[`virtual-network-id`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/teamnet/routes/network/${encodeURIComponent(String(e[`ip-network-encoded`]))}`,{body:r})),{successLabel:`Created`});return}let a={};e.comment!==void 0&&s(a,[`comment`],f(e.comment,`comment`,`text`)),e[`virtual-network-id`]!==void 0&&s(a,[`virtual_network_id`],f(e[`virtual-network-id`],`virtual-network-id`,`text`)),l(await d(`Creating`,async()=>t.post(`/accounts/${n}/teamnet/routes/network/${encodeURIComponent(String(e[`ip-network-encoded`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Created`})}};function ah(e){return e.positional(`ip-network-encoded`,{type:`string`,description:`IP/CIDR range in URL-encoded format`,demandOption:!0}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`tun-type`,{type:`string`,description:`The type of tunnel.`,choices:[`cfd_tunnel`,`warp_connector`,`warp`,`magic`,`ip_sec`,`gre`,`cni`]}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const oh={command:`delete <ip-network-encoded>`,describe:"Deletes a private network route from an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format. If no virtual_network_id is provided it will delete the route from the default vnet. If no tun_type is provided it will fetch the type from the tunnel_id or if that is missing it will assume Cloudflare Tunnel as default. If tunnel_id is provided it will delete the route from that tunnel, otherwise it will delete the route based on the vnet and tun_type.",builder:ah,handler:async t=>{let n={virtual_network_id:t[`virtual-network-id`],tun_type:t[`tun-type`],tunnel_id:t[`tunnel-id`]};if(t.dryRun){u({command:`cf zero-trust networks routes networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/teamnet/routes/network/${t[`ip-network-encoded`]==null?`<ip-network-encoded>`:encodeURIComponent(String(t[`ip-network-encoded`]))}`,pathParams:{"ip-network-encoded":String(t[`ip-network-encoded`]??``)},query:n,bodyKind:`none`});return}let a=await i(t),s=t.local?m:await r(a);if(t.accountId=s,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>a.zeroTrust.networks.routes.networks.delete(t[`ip-network-encoded`],s,n)),{successLabel:`Deleted`})}};function sh(e){return e.positional(`ip-network-encoded`,{type:`string`,description:`IP/CIDR range in URL-encoded format`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ch={command:`edit <ip-network-encoded>`,describe:"Updates an existing private network route in an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format.",builder:sh,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust networks routes networks edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/teamnet/routes/network/${e[`ip-network-encoded`]==null?`<ip-network-encoded>`:encodeURIComponent(String(e[`ip-network-encoded`]))}`,pathParams:{"ip-network-encoded":String(e[`ip-network-encoded`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Updating`,async()=>t.zeroTrust.networks.routes.networks.edit(e[`ip-network-encoded`],n)),{successLabel:`Updated`})}},lh={command:`networks`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(ih).command(oh).command(ch).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},uh={command:`routes`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(Gm).command(qm).command(Ym).command(Zm).command(nh).command(eh).command(lh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function dh(e){return e.positional(`address-family`,{type:`string`,description:"IP address family, either `v4` (IPv4) or `v6` (IPv6)",demandOption:!0}).option(`comment`,{type:`string`,description:`An optional description of the subnet.`}).option(`name`,{type:`string`,description:`A user-friendly name for the subnet.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const fh={command:`update <address-family>`,describe:`Updates the Cloudflare Source subnet of the given address family`,builder:dh,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust networks subnets cloudflare-source update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zerotrust/subnets/cloudflare_source/${e[`address-family`]==null?`<address-family>`:encodeURIComponent(String(e[`address-family`]))}`,pathParams:{"address-family":String(e[`address-family`]??``)},bodyKind:`json`,body:{comment:e.comment,name:e.name,network:e.network,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/zerotrust/subnets/cloudflare_source/${encodeURIComponent(String(e[`address-family`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e.comment!==void 0&&s(a,[`comment`],f(e.comment,`comment`,`text`)),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),e.network!==void 0&&s(a,[`network`],f(e.network,`network`,`text`)),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/zerotrust/subnets/cloudflare_source/${encodeURIComponent(String(e[`address-family`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},ph={command:`cloudflare-source`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(fh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function mh(e){return e.option(`name`,{type:`string`,description:`If set, only list subnets with the given name`}).option(`comment`,{type:`string`,description:`If set, only list subnets with the given comment.`}).option(`network`,{type:`string`,description:`If set, only list the subnet whose network exactly matches the given CIDR.`}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`address-family`,{type:`string`,description:"If set, only include subnets in the given address family - `v4` or `v6`",choices:[`v4`,`v6`]}).option(`is-default-network`,{type:`boolean`,description:"If `true`, only include default subnets. If `false`, exclude default subnets subnets. If not set, all subnets will be included."}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted subnets. If `false`, exclude deleted subnets. If not set, all subnets will be included."}).option(`sort-order`,{type:`string`,description:"Sort order of the results. `asc` means oldest to newest, `desc` means newest to oldest. If not set, they will not be in any particular order.",choices:[`asc`,`desc`]}).option(`subnet-types`,{type:`string`,description:`If set, the types of subnets to include, separated by comma.`,choices:[`cloudflare_source`,`warp`]}).option(`per-page`,{type:`string`,description:`Number of results to display.`}).option(`page`,{type:`string`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const hh={command:`list`,describe:`Lists and filters subnets in an account.`,builder:mh,handler:async e=>{let t={name:e.name,comment:e.comment,network:e.network,existed_at:e[`existed-at`],address_family:e[`address-family`],is_default_network:e[`is-default-network`],is_deleted:e[`is-deleted`],sort_order:e[`sort-order`],subnet_types:e[`subnet-types`],per_page:e[`per-page`],page:e.page};if(e.dryRun){u({command:`cf zero-trust networks subnets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zerotrust/subnets`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.networks.subnets.list(a,t)),{successLabel:`Loaded`})}};function gh(e){return e.option(`comment`,{type:`string`,description:`An optional description of the subnet.`,default:``}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this is the default subnet for the account. There can only be one default subnet per account.",default:!1}).option(`name`,{type:`string`,description:`A user-friendly name for the subnet.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _h={command:`create`,describe:"Create a WARP IP assignment subnet. Currently, only IPv4 subnets can be created. **Network constraints:** - The network must be within one of the following private IP ranges: - `10.0.0.0/8` (RFC 1918) - `172.16.0.0/12` (RFC 1918) - `192.168.0.0/16` (RFC 1918) - `100.64.0.0/10` (RFC 6598 - CGNAT) - The subnet must have a prefix length of `/24` or larger (e.g., `/16`, `/20`, `/24` are valid; `/25`, `/28` are not)",builder:gh,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust networks subnets warp create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zerotrust/subnets/warp`,pathParams:{},bodyKind:`json`,body:{comment:e.comment,"is-default-network":e[`is-default-network`],name:e.name,network:e.network,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/zerotrust/subnets/warp`,{body:t})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await t(`name`,`A user-friendly name for the subnet.`)),e.network===void 0&&(e.network=await t(`network`,`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`));let p={};e.comment!==void 0&&s(p,[`comment`],f(e.comment,`comment`,`text`)),e[`is-default-network`]!==void 0&&s(p,[`is_default_network`],e[`is-default-network`]),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),e.network!==void 0&&s(p,[`network`],f(e.network,`network`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/zerotrust/subnets/warp`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function vh(e){return e.positional(`subnet-id`,{type:`string`,description:`The UUID of the subnet.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const yh={command:`delete <subnet-id>`,describe:`Delete a WARP IP assignment subnet. This operation is idempotent - deleting an already-deleted or non-existent subnet will return success with a null result.`,builder:vh,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust networks subnets warp delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zerotrust/subnets/warp/${t[`subnet-id`]==null?`<subnet-id>`:encodeURIComponent(String(t[`subnet-id`]))}`,pathParams:{"subnet-id":String(t[`subnet-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.networks.subnets.warp.delete(a,t[`subnet-id`])),{successLabel:`Deleted`})}};function bh(e){return e.positional(`subnet-id`,{type:`string`,description:`The UUID of the subnet.`,demandOption:!0}).option(`comment`,{type:`string`,description:`An optional description of the subnet.`}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this is the default subnet for the account. There can only be one default subnet per account."}).option(`name`,{type:`string`,description:`A user-friendly name for the subnet.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xh={command:`edit <subnet-id>`,describe:"Updates a WARP IP assignment subnet. **Update constraints:** - The `network` field cannot be modified for WARP subnets. Only `name`, `comment`, and `is_default_network` can be updated. - IPv6 subnets cannot be updated",builder:bh,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust networks subnets warp edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zerotrust/subnets/warp/${e[`subnet-id`]==null?`<subnet-id>`:encodeURIComponent(String(e[`subnet-id`]))}`,pathParams:{"subnet-id":String(e[`subnet-id`]??``)},bodyKind:`json`,body:{comment:e.comment,"is-default-network":e[`is-default-network`],name:e.name,network:e.network,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/zerotrust/subnets/warp/${encodeURIComponent(String(e[`subnet-id`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e.comment!==void 0&&s(a,[`comment`],f(e.comment,`comment`,`text`)),e[`is-default-network`]!==void 0&&s(a,[`is_default_network`],e[`is-default-network`]),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),e.network!==void 0&&s(a,[`network`],f(e.network,`network`,`text`)),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/zerotrust/subnets/warp/${encodeURIComponent(String(e[`subnet-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}};function Sh(e){return e.positional(`subnet-id`,{type:`string`,description:`The UUID of the subnet.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ch={command:`get <subnet-id>`,describe:`Get a WARP IP assignment subnet.`,builder:Sh,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust networks subnets warp get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zerotrust/subnets/warp/${e[`subnet-id`]==null?`<subnet-id>`:encodeURIComponent(String(e[`subnet-id`]))}`,pathParams:{"subnet-id":String(e[`subnet-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.networks.subnets.warp.get(n,e[`subnet-id`])),{successLabel:`Loaded`})}},wh={command:`warp`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(_h).command(yh).command(xh).command(Ch).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Th={command:`subnets`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(hh).command(ph).command(wh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Eh(e){return e.option(`comment`,{type:`string`,description:`Optional remark describing the virtual network.`,default:``}).option(`is-default`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account."}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account.",default:!1}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Dh={command:`create`,describe:`Adds a new virtual network to an account.`,builder:Eh,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust networks virtual-networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/teamnet/virtual_networks`,pathParams:{},bodyKind:`json`,body:{comment:e.comment,"is-default":e[`is-default`],"is-default-network":e[`is-default-network`],name:e.name,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/teamnet/virtual_networks`,{body:t})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await t(`name`,`A user-friendly name for the virtual network.`));let p={};e.comment!==void 0&&s(p,[`comment`],f(e.comment,`comment`,`text`)),e[`is-default`]!==void 0&&s(p,[`is_default`],e[`is-default`]),e[`is-default-network`]!==void 0&&s(p,[`is_default_network`],e[`is-default-network`]),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/teamnet/virtual_networks`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function Oh(e){return e.positional(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const kh={command:`delete <virtual-network-id>`,describe:`Deletes an existing virtual network.`,builder:Oh,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust networks virtual-networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/teamnet/virtual_networks/${t[`virtual-network-id`]==null?`<virtual-network-id>`:encodeURIComponent(String(t[`virtual-network-id`]))}`,pathParams:{"virtual-network-id":String(t[`virtual-network-id`]??``)},bodyKind:`json`,body:{body:t.body}});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body);l(await d(`Deleting`,async()=>n.delete(`/accounts/${a}/teamnet/virtual_networks/${encodeURIComponent(String(t[`virtual-network-id`]))}`,{body:e})),{successLabel:`Deleted`});return}l(await d(`Deleting`,async()=>n.zeroTrust.networks.virtualNetworks.delete(t[`virtual-network-id`],a)),{successLabel:`Deleted`})}};function Ah(e){return e.positional(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the virtual network.`}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account."}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const jh={command:`edit <virtual-network-id>`,describe:`Updates an existing virtual network.`,builder:Ah,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust networks virtual-networks edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/teamnet/virtual_networks/${e[`virtual-network-id`]==null?`<virtual-network-id>`:encodeURIComponent(String(e[`virtual-network-id`]))}`,pathParams:{"virtual-network-id":String(e[`virtual-network-id`]??``)},bodyKind:`json`,body:{comment:e.comment,"is-default-network":e[`is-default-network`],name:e.name,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/teamnet/virtual_networks/${encodeURIComponent(String(e[`virtual-network-id`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e.comment!==void 0&&s(a,[`comment`],f(e.comment,`comment`,`text`)),e[`is-default-network`]!==void 0&&s(a,[`is_default_network`],e[`is-default-network`]),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/teamnet/virtual_networks/${encodeURIComponent(String(e[`virtual-network-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}};function Mh(e){return e.positional(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the virtual network.`,default:``}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account."}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Nh={command:`get <virtual-network-id>`,describe:`Get a virtual network.`,builder:Mh,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust networks virtual-networks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/teamnet/virtual_networks/${e[`virtual-network-id`]==null?`<virtual-network-id>`:encodeURIComponent(String(e[`virtual-network-id`]))}`,pathParams:{"virtual-network-id":String(e[`virtual-network-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.networks.virtualNetworks.get(n,e[`virtual-network-id`])),{successLabel:`Loaded`})}};function Ph(e){return e.option(`id`,{type:`string`,description:`UUID of the virtual network.`}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`is-default`,{type:`boolean`,description:"If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included."}).option(`is-default-network`,{type:`boolean`,description:"If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included."}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted virtual networks. If `false`, exclude deleted virtual networks. If empty, all virtual networks will be included."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fh={command:`list`,describe:`Lists and filters virtual networks in an account.`,builder:Ph,handler:async e=>{let t={id:e.id,name:e.name,is_default:e[`is-default`],is_default_network:e[`is-default-network`],is_deleted:e[`is-deleted`]};if(e.dryRun){u({command:`cf zero-trust networks virtual-networks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/teamnet/virtual_networks`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.networks.virtualNetworks.list(a,t)),{successLabel:`Loaded`})}},Ih={command:`virtual-networks`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(Dh).command(kh).command(jh).command(Nh).command(Fh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Lh={command:`networks`,describe:`Operations for networks`,builder:e=>e.command(Um).command(uh).command(Th).command(Ih).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Rh(e){return e.option(`allow-authenticate-via-warp`,{type:`boolean`,description:`When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.`,default:!1}).option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`auto-redirect-to-identity`,{type:`boolean`,description:"When set to `true`, users skip the identity provider selection step during login.",default:!1}).option(`deny-unmatched-requests`,{type:`boolean`,description:"Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names` array."}).option(`deny-unmatched-requests-exempted-zone-names`,{type:`string`,array:!0,description:"Contains zone names to exempt from the `deny_unmatched_requests` feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request."}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`,default:!1}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:`Lists the MFA methods that users can authenticate with.`}).option(`mfa-config-amr-matching-session-duration`,{type:`string`,description:`Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).`}).option(`mfa-config-required-aaguids`,{type:`string`,description:`Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`mfa-required-for-all-apps`,{type:`boolean`,description:`Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.`,default:!1}).option(`mfa-ssh-piv-key-requirements-pin-policy`,{type:`string`,description:"Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN required), `once` (PIN required once per session), `always` (PIN required for each use).",choices:[`never`,`once`,`always`]}).option(`mfa-ssh-piv-key-requirements-require-fips-device`,{type:`boolean`,description:`Requires the SSH PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.`}).option(`mfa-ssh-piv-key-requirements-ssh-key-size`,{type:`string`,array:!0,description:`Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.`}).option(`mfa-ssh-piv-key-requirements-ssh-key-type`,{type:`string`,array:!0,description:"Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and `rsa`."}).option(`mfa-ssh-piv-key-requirements-touch-policy`,{type:`string`,description:"Defines when physical touch is required to use the SSH key. Valid values: `never` (no touch required), `always` (touch required for each use), `cached` (touch cached for 15 seconds).",choices:[`never`,`always`,`cached`]}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`warp-auth-session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const zh={command:`create`,describe:`Sets up a Zero Trust organization for your account.`,builder:Rh,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust organizations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/organizations`,pathParams:{},bodyKind:`json`,body:{"allow-authenticate-via-warp":e[`allow-authenticate-via-warp`],"auth-domain":e[`auth-domain`],"auto-redirect-to-identity":e[`auto-redirect-to-identity`],"deny-unmatched-requests":e[`deny-unmatched-requests`],"deny-unmatched-requests-exempted-zone-names":e[`deny-unmatched-requests-exempted-zone-names`],"is-ui-read-only":e[`is-ui-read-only`],"login-design-background-color":e[`login-design-background-color`],"login-design-footer-text":e[`login-design-footer-text`],"login-design-header-text":e[`login-design-header-text`],"login-design-logo-path":e[`login-design-logo-path`],"login-design-text-color":e[`login-design-text-color`],"mfa-config-allowed-authenticators":e[`mfa-config-allowed-authenticators`],"mfa-config-amr-matching-session-duration":e[`mfa-config-amr-matching-session-duration`],"mfa-config-required-aaguids":e[`mfa-config-required-aaguids`],"mfa-config-session-duration":e[`mfa-config-session-duration`],"mfa-required-for-all-apps":e[`mfa-required-for-all-apps`],"mfa-ssh-piv-key-requirements-pin-policy":e[`mfa-ssh-piv-key-requirements-pin-policy`],"mfa-ssh-piv-key-requirements-require-fips-device":e[`mfa-ssh-piv-key-requirements-require-fips-device`],"mfa-ssh-piv-key-requirements-ssh-key-size":e[`mfa-ssh-piv-key-requirements-ssh-key-size`],"mfa-ssh-piv-key-requirements-ssh-key-type":e[`mfa-ssh-piv-key-requirements-ssh-key-type`],"mfa-ssh-piv-key-requirements-touch-policy":e[`mfa-ssh-piv-key-requirements-touch-policy`],name:e.name,"session-duration":e[`session-duration`],"ui-read-only-toggle-reason":e[`ui-read-only-toggle-reason`],"user-seat-expiration-inactive-time":e[`user-seat-expiration-inactive-time`],"warp-auth-session-duration":e[`warp-auth-session-duration`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/access/organizations`,{body:t})),{successLabel:`Created`});return}e[`auth-domain`]===void 0&&(e[`auth-domain`]=await t(`auth-domain`,`The unique subdomain assigned to your Zero Trust organization.`)),e.name===void 0&&(e.name=await t(`name`,`The name of your Zero Trust organization.`));let p={};e[`allow-authenticate-via-warp`]!==void 0&&s(p,[`allow_authenticate_via_warp`],e[`allow-authenticate-via-warp`]),e[`auth-domain`]!==void 0&&s(p,[`auth_domain`],f(e[`auth-domain`],`auth-domain`,`text`)),e[`auto-redirect-to-identity`]!==void 0&&s(p,[`auto_redirect_to_identity`],e[`auto-redirect-to-identity`]),e[`deny-unmatched-requests`]!==void 0&&s(p,[`deny_unmatched_requests`],e[`deny-unmatched-requests`]),e[`deny-unmatched-requests-exempted-zone-names`]!==void 0&&s(p,[`deny_unmatched_requests_exempted_zone_names`],e[`deny-unmatched-requests-exempted-zone-names`]),e[`is-ui-read-only`]!==void 0&&s(p,[`is_ui_read_only`],e[`is-ui-read-only`]),e[`login-design-background-color`]!==void 0&&s(p,[`login_design`,`background_color`],f(e[`login-design-background-color`],`login-design-background-color`,`text`)),e[`login-design-footer-text`]!==void 0&&s(p,[`login_design`,`footer_text`],f(e[`login-design-footer-text`],`login-design-footer-text`,`text`)),e[`login-design-header-text`]!==void 0&&s(p,[`login_design`,`header_text`],f(e[`login-design-header-text`],`login-design-header-text`,`text`)),e[`login-design-logo-path`]!==void 0&&s(p,[`login_design`,`logo_path`],f(e[`login-design-logo-path`],`login-design-logo-path`,`text`)),e[`login-design-text-color`]!==void 0&&s(p,[`login_design`,`text_color`],f(e[`login-design-text-color`],`login-design-text-color`,`text`)),e[`mfa-config-allowed-authenticators`]!==void 0&&s(p,[`mfa_config`,`allowed_authenticators`],e[`mfa-config-allowed-authenticators`]),e[`mfa-config-amr-matching-session-duration`]!==void 0&&s(p,[`mfa_config`,`amr_matching_session_duration`],f(e[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`)),e[`mfa-config-required-aaguids`]!==void 0&&s(p,[`mfa_config`,`required_aaguids`],f(e[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`)),e[`mfa-config-session-duration`]!==void 0&&s(p,[`mfa_config`,`session_duration`],f(e[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)),e[`mfa-required-for-all-apps`]!==void 0&&s(p,[`mfa_required_for_all_apps`],e[`mfa-required-for-all-apps`]),e[`mfa-ssh-piv-key-requirements-pin-policy`]!==void 0&&s(p,[`mfa_ssh_piv_key_requirements`,`pin_policy`],f(e[`mfa-ssh-piv-key-requirements-pin-policy`],`mfa-ssh-piv-key-requirements-pin-policy`,`text`)),e[`mfa-ssh-piv-key-requirements-require-fips-device`]!==void 0&&s(p,[`mfa_ssh_piv_key_requirements`,`require_fips_device`],e[`mfa-ssh-piv-key-requirements-require-fips-device`]),e[`mfa-ssh-piv-key-requirements-ssh-key-size`]!==void 0&&s(p,[`mfa_ssh_piv_key_requirements`,`ssh_key_size`],e[`mfa-ssh-piv-key-requirements-ssh-key-size`]),e[`mfa-ssh-piv-key-requirements-ssh-key-type`]!==void 0&&s(p,[`mfa_ssh_piv_key_requirements`,`ssh_key_type`],e[`mfa-ssh-piv-key-requirements-ssh-key-type`]),e[`mfa-ssh-piv-key-requirements-touch-policy`]!==void 0&&s(p,[`mfa_ssh_piv_key_requirements`,`touch_policy`],f(e[`mfa-ssh-piv-key-requirements-touch-policy`],`mfa-ssh-piv-key-requirements-touch-policy`,`text`)),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),e[`session-duration`]!==void 0&&s(p,[`session_duration`],f(e[`session-duration`],`session-duration`,`text`)),e[`ui-read-only-toggle-reason`]!==void 0&&s(p,[`ui_read_only_toggle_reason`],f(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`)),e[`user-seat-expiration-inactive-time`]!==void 0&&s(p,[`user_seat_expiration_inactive_time`],f(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)),e[`warp-auth-session-duration`]!==void 0&&s(p,[`warp_auth_session_duration`],f(e[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/access/organizations`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function Bh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vh={command:`get`,describe:`Returns the DoH settings for your Zero Trust organization.`,builder:Bh,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust organizations doh get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/organizations/doh`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.organizations.doh.get(n)),{successLabel:`Loaded`})}};function Hh(e){return e.option(`doh-jwt-duration`,{type:`string`,description:"The duration the DoH JWT is valid for. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.  Note that the maximum duration for this setting is the same as the key rotation period on the account. Default expiration is 24h"}).option(`service-token-id`,{type:`string`,description:`The uuid of the service token you want to use for DoH authentication`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Uh={command:`update`,describe:`Updates the DoH settings for your Zero Trust organization.`,builder:Hh,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust organizations doh update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/organizations/doh`,pathParams:{},bodyKind:`json`,body:{"doh-jwt-duration":e[`doh-jwt-duration`],"service-token-id":e[`service-token-id`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/organizations/doh`,{body:r})),{successLabel:`Updated`});return}let a={};e[`doh-jwt-duration`]!==void 0&&s(a,[`doh_jwt_duration`],f(e[`doh-jwt-duration`],`doh-jwt-duration`,`text`)),e[`service-token-id`]!==void 0&&s(a,[`service_token_id`],f(e[`service-token-id`],`service-token-id`,`text`)),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/organizations/doh`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},Wh={command:`doh`,describe:`Zero Trust organization settings including login page, session duration, and user seat management`,builder:e=>e.command(Vh).command(Uh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Gh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kh={command:`list`,describe:`Returns the configuration for your Zero Trust organization.`,builder:Gh,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust organizations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/organizations`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.organizations.list(n)),{successLabel:`Loaded`})}};function qh(e){return e.option(`devices`,{type:`boolean`,description:"When set to `true`, all devices associated with the user will be revoked."}).option(`email`,{type:`string`,description:`The email of the user to revoke.`}).option(`user-uid`,{type:`string`,description:`The uuid of the user to revoke.`}).option(`warp-session-reauth`,{type:`boolean`,description:"When set to `true`, the user will be required to re-authenticate to WARP for all Gateway policies that enforce a WARP client session duration. When `false`, the user’s WARP session will remain active"}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Jh={command:`revoke-users`,describe:`Revokes a user's access across all applications.`,builder:qh,handler:async n=>{let a={devices:n.devices};if(n.dryRun){u({command:`cf zero-trust organizations revoke-users`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/organizations/revoke_user`,pathParams:{},query:a,bodyKind:`json`,body:{email:n.email,"user-uid":n[`user-uid`],"warp-session-reauth":n[`warp-session-reauth`],body:n.body}});return}let p=await i(n),h=n.local?m:await r(p);if(n.accountId=h,!await e({force:!!n.force,message:`This operation revokes all access tokens for a user destructively.`})){process.stderr.write(`Aborted.
+`);return}if(n.body){let e=c(n.body),t=new URLSearchParams(Object.entries(a).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString();l(await d(`Deleting`,async()=>p.post(`/accounts/${h}/access/organizations/revoke_user${t?`?`+t:``}`,{body:e})),{successLabel:`Deleted`});return}n.email===void 0&&(n.email=await t(`email`,`The email of the user to revoke.`));let g={};n.email!==void 0&&s(g,[`email`],f(n.email,`email`,`text`)),n[`user-uid`]!==void 0&&s(g,[`user_uid`],f(n[`user-uid`],`user-uid`,`text`)),n[`warp-session-reauth`]!==void 0&&s(g,[`warp_session_reauth`],n[`warp-session-reauth`]);let _=new URLSearchParams(Object.entries(a).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString();l(await d(`Deleting`,async()=>p.post(`/accounts/${h}/access/organizations/revoke_user${_?`?`+_:``}`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Deleted`})}};function Yh(e){return e.option(`allow-authenticate-via-warp`,{type:`boolean`,description:`When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.`}).option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`auto-redirect-to-identity`,{type:`boolean`,description:"When set to `true`, users skip the identity provider selection step during login."}).option(`custom-pages-forbidden`,{type:`string`,description:`The uid of the custom page to use when a user is denied access after failing a non-identity rule.`}).option(`custom-pages-identity-denied`,{type:`string`,description:`The uid of the custom page to use when a user is denied access.`}).option(`deny-unmatched-requests`,{type:`boolean`,description:"Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names` array."}).option(`deny-unmatched-requests-exempted-zone-names`,{type:`string`,array:!0,description:"Contains zone names to exempt from the `deny_unmatched_requests` feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request."}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:`Lists the MFA methods that users can authenticate with.`}).option(`mfa-config-amr-matching-session-duration`,{type:`string`,description:`Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).`}).option(`mfa-config-required-aaguids`,{type:`string`,description:`Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`mfa-required-for-all-apps`,{type:`boolean`,description:`Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.`}).option(`mfa-ssh-piv-key-requirements-pin-policy`,{type:`string`,description:"Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN required), `once` (PIN required once per session), `always` (PIN required for each use).",choices:[`never`,`once`,`always`]}).option(`mfa-ssh-piv-key-requirements-require-fips-device`,{type:`boolean`,description:`Requires the SSH PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.`}).option(`mfa-ssh-piv-key-requirements-ssh-key-size`,{type:`string`,array:!0,description:`Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.`}).option(`mfa-ssh-piv-key-requirements-ssh-key-type`,{type:`string`,array:!0,description:"Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and `rsa`."}).option(`mfa-ssh-piv-key-requirements-touch-policy`,{type:`string`,description:"Defines when physical touch is required to use the SSH key. Valid values: `never` (no touch required), `always` (touch required for each use), `cached` (touch cached for 15 seconds).",choices:[`never`,`always`,`cached`]}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`warp-auth-session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Xh={command:`update`,describe:`Updates the configuration for your Zero Trust organization.`,builder:Yh,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust organizations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/organizations`,pathParams:{},bodyKind:`json`,body:{"allow-authenticate-via-warp":e[`allow-authenticate-via-warp`],"auth-domain":e[`auth-domain`],"auto-redirect-to-identity":e[`auto-redirect-to-identity`],"custom-pages-forbidden":e[`custom-pages-forbidden`],"custom-pages-identity-denied":e[`custom-pages-identity-denied`],"deny-unmatched-requests":e[`deny-unmatched-requests`],"deny-unmatched-requests-exempted-zone-names":e[`deny-unmatched-requests-exempted-zone-names`],"is-ui-read-only":e[`is-ui-read-only`],"login-design-background-color":e[`login-design-background-color`],"login-design-footer-text":e[`login-design-footer-text`],"login-design-header-text":e[`login-design-header-text`],"login-design-logo-path":e[`login-design-logo-path`],"login-design-text-color":e[`login-design-text-color`],"mfa-config-allowed-authenticators":e[`mfa-config-allowed-authenticators`],"mfa-config-amr-matching-session-duration":e[`mfa-config-amr-matching-session-duration`],"mfa-config-required-aaguids":e[`mfa-config-required-aaguids`],"mfa-config-session-duration":e[`mfa-config-session-duration`],"mfa-required-for-all-apps":e[`mfa-required-for-all-apps`],"mfa-ssh-piv-key-requirements-pin-policy":e[`mfa-ssh-piv-key-requirements-pin-policy`],"mfa-ssh-piv-key-requirements-require-fips-device":e[`mfa-ssh-piv-key-requirements-require-fips-device`],"mfa-ssh-piv-key-requirements-ssh-key-size":e[`mfa-ssh-piv-key-requirements-ssh-key-size`],"mfa-ssh-piv-key-requirements-ssh-key-type":e[`mfa-ssh-piv-key-requirements-ssh-key-type`],"mfa-ssh-piv-key-requirements-touch-policy":e[`mfa-ssh-piv-key-requirements-touch-policy`],name:e.name,"session-duration":e[`session-duration`],"ui-read-only-toggle-reason":e[`ui-read-only-toggle-reason`],"user-seat-expiration-inactive-time":e[`user-seat-expiration-inactive-time`],"warp-auth-session-duration":e[`warp-auth-session-duration`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/organizations`,{body:r})),{successLabel:`Updated`});return}let a={};e[`allow-authenticate-via-warp`]!==void 0&&s(a,[`allow_authenticate_via_warp`],e[`allow-authenticate-via-warp`]),e[`auth-domain`]!==void 0&&s(a,[`auth_domain`],f(e[`auth-domain`],`auth-domain`,`text`)),e[`auto-redirect-to-identity`]!==void 0&&s(a,[`auto_redirect_to_identity`],e[`auto-redirect-to-identity`]),e[`custom-pages-forbidden`]!==void 0&&s(a,[`custom_pages`,`forbidden`],f(e[`custom-pages-forbidden`],`custom-pages-forbidden`,`text`)),e[`custom-pages-identity-denied`]!==void 0&&s(a,[`custom_pages`,`identity_denied`],f(e[`custom-pages-identity-denied`],`custom-pages-identity-denied`,`text`)),e[`deny-unmatched-requests`]!==void 0&&s(a,[`deny_unmatched_requests`],e[`deny-unmatched-requests`]),e[`deny-unmatched-requests-exempted-zone-names`]!==void 0&&s(a,[`deny_unmatched_requests_exempted_zone_names`],e[`deny-unmatched-requests-exempted-zone-names`]),e[`is-ui-read-only`]!==void 0&&s(a,[`is_ui_read_only`],e[`is-ui-read-only`]),e[`login-design-background-color`]!==void 0&&s(a,[`login_design`,`background_color`],f(e[`login-design-background-color`],`login-design-background-color`,`text`)),e[`login-design-footer-text`]!==void 0&&s(a,[`login_design`,`footer_text`],f(e[`login-design-footer-text`],`login-design-footer-text`,`text`)),e[`login-design-header-text`]!==void 0&&s(a,[`login_design`,`header_text`],f(e[`login-design-header-text`],`login-design-header-text`,`text`)),e[`login-design-logo-path`]!==void 0&&s(a,[`login_design`,`logo_path`],f(e[`login-design-logo-path`],`login-design-logo-path`,`text`)),e[`login-design-text-color`]!==void 0&&s(a,[`login_design`,`text_color`],f(e[`login-design-text-color`],`login-design-text-color`,`text`)),e[`mfa-config-allowed-authenticators`]!==void 0&&s(a,[`mfa_config`,`allowed_authenticators`],e[`mfa-config-allowed-authenticators`]),e[`mfa-config-amr-matching-session-duration`]!==void 0&&s(a,[`mfa_config`,`amr_matching_session_duration`],f(e[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`)),e[`mfa-config-required-aaguids`]!==void 0&&s(a,[`mfa_config`,`required_aaguids`],f(e[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`)),e[`mfa-config-session-duration`]!==void 0&&s(a,[`mfa_config`,`session_duration`],f(e[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)),e[`mfa-required-for-all-apps`]!==void 0&&s(a,[`mfa_required_for_all_apps`],e[`mfa-required-for-all-apps`]),e[`mfa-ssh-piv-key-requirements-pin-policy`]!==void 0&&s(a,[`mfa_ssh_piv_key_requirements`,`pin_policy`],f(e[`mfa-ssh-piv-key-requirements-pin-policy`],`mfa-ssh-piv-key-requirements-pin-policy`,`text`)),e[`mfa-ssh-piv-key-requirements-require-fips-device`]!==void 0&&s(a,[`mfa_ssh_piv_key_requirements`,`require_fips_device`],e[`mfa-ssh-piv-key-requirements-require-fips-device`]),e[`mfa-ssh-piv-key-requirements-ssh-key-size`]!==void 0&&s(a,[`mfa_ssh_piv_key_requirements`,`ssh_key_size`],e[`mfa-ssh-piv-key-requirements-ssh-key-size`]),e[`mfa-ssh-piv-key-requirements-ssh-key-type`]!==void 0&&s(a,[`mfa_ssh_piv_key_requirements`,`ssh_key_type`],e[`mfa-ssh-piv-key-requirements-ssh-key-type`]),e[`mfa-ssh-piv-key-requirements-touch-policy`]!==void 0&&s(a,[`mfa_ssh_piv_key_requirements`,`touch_policy`],f(e[`mfa-ssh-piv-key-requirements-touch-policy`],`mfa-ssh-piv-key-requirements-touch-policy`,`text`)),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),e[`session-duration`]!==void 0&&s(a,[`session_duration`],f(e[`session-duration`],`session-duration`,`text`)),e[`ui-read-only-toggle-reason`]!==void 0&&s(a,[`ui_read_only_toggle_reason`],f(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`)),e[`user-seat-expiration-inactive-time`]!==void 0&&s(a,[`user_seat_expiration_inactive_time`],f(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)),e[`warp-auth-session-duration`]!==void 0&&s(a,[`warp_auth_session_duration`],f(e[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/access/organizations`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},Zh={command:`organizations`,describe:`Zero Trust organization settings including login page, session duration, and user seat management`,builder:e=>e.command(zh).command(Kh).command(Jh).command(Xh).command(Wh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $h={command:`list`,describe:`Lists all DLP custom profiles in an account.`,builder:Qh,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust profiles custom list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/profiles/custom`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.profiles.custom.list(n)),{successLabel:`Loaded`})}},eg={command:`custom`,describe:`Profiles operations`,builder:e=>e.command($h).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function tg(e){return e.option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Predefined profiles can not be created. This endpoint will only update an existing predefined profiles settings.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const ng={command:`create`,describe:`Creates a DLP predefined profile. Only supports enabling/disabling entries.`,builder:tg,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust profiles predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/profiles/predefined`,pathParams:{},bodyKind:`json`,body:{"ai-context-enabled":e[`ai-context-enabled`],"allowed-match-count":e[`allowed-match-count`],"confidence-threshold":e[`confidence-threshold`],"context-awareness-enabled":e[`context-awareness-enabled`],"context-awareness-skip-files":e[`context-awareness-skip-files`],"ocr-enabled":e[`ocr-enabled`],"profile-id":e[`profile-id`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/profiles/predefined`,{body:t})),{successLabel:`Created`});return}e[`profile-id`]===void 0&&(e[`profile-id`]=await t(`profile-id`,`The profile_id field`));let p={};e[`ai-context-enabled`]!==void 0&&s(p,[`ai_context_enabled`],e[`ai-context-enabled`]),e[`allowed-match-count`]!==void 0&&s(p,[`allowed_match_count`],e[`allowed-match-count`]),e[`confidence-threshold`]!==void 0&&s(p,[`confidence_threshold`],f(e[`confidence-threshold`],`confidence-threshold`,`text`)),e[`context-awareness-enabled`]!==void 0&&s(p,[`context_awareness`,`enabled`],e[`context-awareness-enabled`]),e[`context-awareness-skip-files`]!==void 0&&s(p,[`context_awareness`,`skip`,`files`],e[`context-awareness-skip-files`]),e[`ocr-enabled`]!==void 0&&s(p,[`ocr_enabled`],e[`ocr-enabled`]),e[`profile-id`]!==void 0&&s(p,[`profile_id`],f(e[`profile-id`],`profile-id`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/dlp/profiles/predefined`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function rg(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ig={command:`get <profile-id>`,describe:`Fetches a predefined DLP profile by id.`,builder:rg,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust profiles predefined get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/profiles/predefined/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.profiles.predefined.get(n,e[`profile-id`])),{successLabel:`Loaded`})}};function ag(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the predefined profile.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const og={command:`update <profile-id>`,describe:`Updates a DLP predefined profile. Only supports enabling/disabling entries.`,builder:ag,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust profiles predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/profiles/predefined/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`json`,body:{"ai-context-enabled":e[`ai-context-enabled`],"allowed-match-count":e[`allowed-match-count`],"confidence-threshold":e[`confidence-threshold`],"context-awareness-enabled":e[`context-awareness-enabled`],"context-awareness-skip-files":e[`context-awareness-skip-files`],"ocr-enabled":e[`ocr-enabled`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/profiles/predefined/${encodeURIComponent(String(e[`profile-id`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e[`ai-context-enabled`]!==void 0&&s(a,[`ai_context_enabled`],e[`ai-context-enabled`]),e[`allowed-match-count`]!==void 0&&s(a,[`allowed_match_count`],e[`allowed-match-count`]),e[`confidence-threshold`]!==void 0&&s(a,[`confidence_threshold`],f(e[`confidence-threshold`],`confidence-threshold`,`text`)),e[`context-awareness-enabled`]!==void 0&&s(a,[`context_awareness`,`enabled`],e[`context-awareness-enabled`]),e[`context-awareness-skip-files`]!==void 0&&s(a,[`context_awareness`,`skip`,`files`],e[`context-awareness-skip-files`]),e[`ocr-enabled`]!==void 0&&s(a,[`ocr_enabled`],e[`ocr-enabled`]),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/profiles/predefined/${encodeURIComponent(String(e[`profile-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},sg={command:`predefined`,describe:`Profiles operations`,builder:e=>e.command(ng).command(ig).command(og).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},cg={command:`profiles`,describe:`Operations for profiles`,builder:e=>e.command(eg).command(sg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function lg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ug={command:`get`,describe:`Retrieves configured risk score behaviors that define how user actions affect their overall risk score.`,builder:lg,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust risk-scoring behaviours get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zt_risk_scoring/behaviors`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.riskScoring.behaviours.get(n)),{successLabel:`Loaded`})}};function dg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Behaviors.`})}const fg={command:`update`,describe:`Updates risk score behavior configurations, defining weights and thresholds for risk calculation.`,builder:dg,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust risk-scoring behaviours update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zt_risk_scoring/behaviors`,pathParams:{},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/zt_risk_scoring/behaviors`,{body:r})),{successLabel:`Updated`});return}l(await d(`Updating`,async()=>t.zeroTrust.riskScoring.behaviours.update(n)),{successLabel:`Updated`})}},pg={command:`behaviours`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(ug).command(fg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function mg(e){return e.positional(`user-id`,{type:`string`,description:`User ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const hg={command:`get <user-id>`,describe:`Retrieves the detailed risk score breakdown for a specific user, including contributing factors.`,builder:mg,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust risk-scoring get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zt_risk_scoring/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.riskScoring.get(n,e[`user-id`])),{successLabel:`Loaded`})}};function gg(e){return e.option(`integration-type`,{type:`string`,description:`The integration_type field`,choices:[`Okta`]}).option(`reference-id`,{type:`string`,description:`A reference id that can be supplied by the client. Currently this should be set to the Access-Okta IDP ID (a UUIDv4).
+https://developers.cloudflare.com/api/operations/access-identity-providers-get-an-access-identity-provider`}).option(`tenant-url`,{type:`string`,description:`The base url of the tenant, e.g. "https://tenant.okta.com".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _g={command:`create`,describe:`Creates a new Zero Trust risk score integration, connecting external risk signals to Cloudflare's risk scoring system.`,builder:gg,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust risk-scoring integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zt_risk_scoring/integrations`,pathParams:{},bodyKind:`json`,body:{"integration-type":e[`integration-type`],"reference-id":e[`reference-id`],"tenant-url":e[`tenant-url`],body:e.body}});return}let n=await i(e),p=e.local?m:await r(n);if(e.accountId=p,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${p}/zt_risk_scoring/integrations`,{body:t})),{successLabel:`Created`});return}e[`integration-type`]===void 0&&(e[`integration-type`]=await a(`integration-type`,`The integration_type field`,[`Okta`])),e[`tenant-url`]===void 0&&(e[`tenant-url`]=await t(`tenant-url`,`The base url of the tenant, e.g. "https://tenant.okta.com".`));let h={};e[`integration-type`]!==void 0&&s(h,[`integration_type`],f(e[`integration-type`],`integration-type`,`text`)),e[`reference-id`]!==void 0&&s(h,[`reference_id`],f(e[`reference-id`],`reference-id`,`text`)),e[`tenant-url`]!==void 0&&s(h,[`tenant_url`],f(e[`tenant-url`],`tenant-url`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${p}/zt_risk_scoring/integrations`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created`})}};function vg(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const yg={command:`delete <integration-id>`,describe:`Removes a Zero Trust risk score integration, disconnecting the external risk signal source.`,builder:vg,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust risk-scoring integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zt_risk_scoring/integrations/${t[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(t[`integration-id`]))}`,pathParams:{"integration-id":String(t[`integration-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.riskScoring.integrations.delete(a,t[`integration-id`])),{successLabel:`Deleted`})}};function bg(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xg={command:`get <integration-id>`,describe:`Gets configuration details for a specific Zero Trust risk score integration.`,builder:bg,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust risk-scoring integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zt_risk_scoring/integrations/${e[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(e[`integration-id`]))}`,pathParams:{"integration-id":String(e[`integration-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.riskScoring.integrations.get(n,e[`integration-id`])),{successLabel:`Loaded`})}};function Sg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cg={command:`list`,describe:`Lists all configured Zero Trust risk score integrations for the account.`,builder:Sg,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust risk-scoring integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zt_risk_scoring/integrations`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.riskScoring.integrations.list(n)),{successLabel:`Loaded`})}};function wg(e){return e.positional(`reference-id`,{type:`string`,description:`Reference ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Tg={command:`get <reference-id>`,describe:`Retrieves a Zero Trust risk score integration using its external reference ID.`,builder:wg,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust risk-scoring integrations references get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zt_risk_scoring/integrations/reference_id/${e[`reference-id`]==null?`<reference-id>`:encodeURIComponent(String(e[`reference-id`]))}`,pathParams:{"reference-id":String(e[`reference-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.riskScoring.integrations.references.get(n,e[`reference-id`])),{successLabel:`Loaded`})}},Eg={command:`references`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(Tg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Dg(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`active`,{type:`boolean`,description:`Whether this integration is enabled. If disabled, no risk changes will be exported to the third-party.`}).option(`reference-id`,{type:`string`,description:`A reference id that can be supplied by the client. Currently this should be set to the Access-Okta IDP ID (a UUIDv4).
+https://developers.cloudflare.com/api/operations/access-identity-providers-get-an-access-identity-provider`}).option(`tenant-url`,{type:`string`,description:`The base url of the tenant, e.g. "https://tenant.okta.com".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Og={command:`update <integration-id>`,describe:`Overwrite the reference_id, tenant_url, and active values with the ones provided.`,builder:Dg,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust risk-scoring integrations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zt_risk_scoring/integrations/${e[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(e[`integration-id`]))}`,pathParams:{"integration-id":String(e[`integration-id`]??``)},bodyKind:`json`,body:{active:e.active,"reference-id":e[`reference-id`],"tenant-url":e[`tenant-url`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${a}/zt_risk_scoring/integrations/${encodeURIComponent(String(e[`integration-id`]))}`,{body:t})),{successLabel:`Updated`});return}if(e.active===void 0)throw Error(`--active is required (or pass --body with this field set).`);e[`tenant-url`]===void 0&&(e[`tenant-url`]=await t(`tenant-url`,`The base url of the tenant, e.g. "https://tenant.okta.com".`));let p={};e.active!==void 0&&s(p,[`active`],e.active),e[`reference-id`]!==void 0&&s(p,[`reference_id`],f(e[`reference-id`],`reference-id`,`text`)),e[`tenant-url`]!==void 0&&s(p,[`tenant_url`],f(e[`tenant-url`],`tenant-url`,`text`)),l(await d(`Updating`,async()=>n.put(`/accounts/${a}/zt_risk_scoring/integrations/${encodeURIComponent(String(e[`integration-id`]))}`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated`})}},kg={command:`integrations`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(_g).command(yg).command(xg).command(Cg).command(Og).command(Eg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ag(e){return e.positional(`user-id`,{type:`string`,description:`User ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const jg={command:`reset <user-id>`,describe:`Resets risk scores for specified users, clearing their accumulated risk history.`,builder:Ag,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust risk-scoring reset`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zt_risk_scoring/${t[`user-id`]==null?`<user-id>`:encodeURIComponent(String(t[`user-id`]))}/reset`,pathParams:{"user-id":String(t[`user-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force,message:`This operation wipes risk-scoring history.`})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.riskScoring.reset(a,t[`user-id`])),{successLabel:`Deleted`})}};function Mg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ng={command:`get`,describe:`Gets an aggregate summary of risk scores across the account, including distribution and trends.`,builder:Mg,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust risk-scoring summary get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/zt_risk_scoring/summary`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.riskScoring.summary.get(n)),{successLabel:`Loaded`})}},Pg={command:`summary`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(Ng).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Fg={command:`risk-scoring`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(hg).command(jg).command(pg).command(kg).command(Pg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ig(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Lg={command:`edit`,describe:"Removes a user from a Zero Trust seat when both `access_seat` and `gateway_seat` are set to false.",builder:Ig,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust seats edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/seats`,pathParams:{},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/access/seats`,{body:r})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Rg={command:`seats`,describe:`View and manage user seat allocations for your Zero Trust subscription`,builder:e=>e.command(Lg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function zg(e){return e.option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.",default:1}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).",default:`8760h`}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Bg={command:`create`,describe:`Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to create a new service token.`,builder:zg,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust service-tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{"client-secret-version":e[`client-secret-version`],duration:e.duration,name:e.name,"previous-client-secret-expires-at":e[`previous-client-secret-expires-at`],body:e.body}});return}let r=await i(e);if(e.zoneId=await n({zone:e.zone},r,{quiet:e.quiet}),e.body){let t=c(e.body);l(await d(`Creating`,async()=>r.post(`/zones/${e.zoneId}/access/service_tokens`,{body:t})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await t(`name`,`The name of the service token.`));let a={};e[`client-secret-version`]!==void 0&&s(a,[`client_secret_version`],e[`client-secret-version`]),e.duration!==void 0&&s(a,[`duration`],f(e.duration,`duration`,`text`)),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),e[`previous-client-secret-expires-at`]!==void 0&&s(a,[`previous_client_secret_expires_at`],f(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)),l(await d(`Creating`,async()=>r.post(`/zones/${e.zoneId}/access/service_tokens`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Created`})}};function Vg(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Hg={command:`delete <service-token-id>`,describe:`Deletes a service token.`,builder:Vg,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust service-tokens delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/service_tokens/${t[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(t[`service-token-id`]))}`,pathParams:{"service-token-id":String(t[`service-token-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let r=await i(t),a=await n({zone:t.zone},r,{quiet:t.quiet});if(t.zoneId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>r.zeroTrust.serviceTokens.delete(t[`service-token-id`],a)),{successLabel:`Deleted`})}};function Ug(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Wg={command:`get <service-token-id>`,describe:`Fetches a single service token.`,builder:Ug,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust service-tokens get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.serviceTokens.get(e[`service-token-id`],r)),{successLabel:`Loaded`})}};function Gg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kg={command:`list`,describe:`Lists all service tokens.`,builder:Gg,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust service-tokens list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.serviceTokens.list(r)),{successLabel:`Loaded`})}};function qg(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`."}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h)."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Jg={command:`update <service-token-id>`,describe:`Updates a configured service token.`,builder:qg,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust service-tokens update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{"client-secret-version":e[`client-secret-version`],duration:e.duration,name:e.name,"previous-client-secret-expires-at":e[`previous-client-secret-expires-at`],body:e.body}});return}let t=await i(e);if(e.zoneId=await n({zone:e.zone},t,{quiet:e.quiet}),e.body){let n=c(e.body);l(await d(`Updating`,async()=>t.put(`/zones/${e.zoneId}/access/service_tokens/${encodeURIComponent(String(e[`service-token-id`]))}`,{body:n})),{successLabel:`Updated`});return}let r={};e[`client-secret-version`]!==void 0&&s(r,[`client_secret_version`],e[`client-secret-version`]),e.duration!==void 0&&s(r,[`duration`],f(e.duration,`duration`,`text`)),e.name!==void 0&&s(r,[`name`],f(e.name,`name`,`text`)),e[`previous-client-secret-expires-at`]!==void 0&&s(r,[`previous_client_secret_expires_at`],f(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)),l(await d(`Updating`,async()=>t.put(`/zones/${e.zoneId}/access/service_tokens/${encodeURIComponent(String(e[`service-token-id`]))}`,{body:Object.keys(r).length>0?r:void 0})),{successLabel:`Updated`})}},Yg={command:`service-tokens`,describe:`Service Tokens operations`,builder:e=>e.command(Bg).command(Hg).command(Wg).command(Kg).command(Jg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Xg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Zg={command:`delete`,describe:`Delete (reset) DLP account-level settings to initial values.`,builder:Xg,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust settings delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.settings.delete(a)),{successLabel:`Deleted`})}};function Qg(e){return e.option(`ai-context-analysis`,{type:`boolean`,description:`Whether AI context analysis is enabled at the account level.`}).option(`ocr`,{type:`boolean`,description:`Whether OCR is enabled at the account level.`}).option(`payload-logging-public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
+
+- Set to a non-empty base64 string to enable payload logging with the given key.
+- Set to an empty string to disable payload logging.
+- Omit or set to null to leave unchanged (PATCH) or reset to disabled (PUT).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`DLP settings fields to update.`})}const $g={command:`edit`,describe:`Missing fields keep their existing values.`,builder:Qg,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`json`,body:{"ai-context-analysis":e[`ai-context-analysis`],ocr:e.ocr,"payload-logging-public-key":e[`payload-logging-public-key`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/dlp/settings`,{body:r})),{successLabel:`Updated`});return}let a={};e[`ai-context-analysis`]!==void 0&&s(a,[`ai_context_analysis`],e[`ai-context-analysis`]),e.ocr!==void 0&&s(a,[`ocr`],e.ocr),e[`payload-logging-public-key`]!==void 0&&s(a,[`payload_logging`,`public_key`],f(e[`payload-logging-public-key`],`payload-logging-public-key`,`text`)),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/dlp/settings`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}};function e_(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const t_={command:`get`,describe:`Get DLP account-level settings.`,builder:e_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.settings.get(n)),{successLabel:`Loaded`})}};function n_(e){return e.option(`ai-context-analysis`,{type:`boolean`,description:`Whether AI context analysis is enabled at the account level.`}).option(`ocr`,{type:`boolean`,description:`Whether OCR is enabled at the account level.`}).option(`payload-logging-public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
+
+- Set to a non-empty base64 string to enable payload logging with the given key.
+- Set to an empty string to disable payload logging.
+- Omit or set to null to leave unchanged (PATCH) or reset to disabled (PUT).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`New DLP settings.`})}const r_={command:`update`,describe:`Missing fields are reset to initial (unconfigured) values.`,builder:n_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`json`,body:{"ai-context-analysis":e[`ai-context-analysis`],ocr:e.ocr,"payload-logging-public-key":e[`payload-logging-public-key`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/settings`,{body:r})),{successLabel:`Updated`});return}let a={};e[`ai-context-analysis`]!==void 0&&s(a,[`ai_context_analysis`],e[`ai-context-analysis`]),e.ocr!==void 0&&s(a,[`ocr`],e.ocr),e[`payload-logging-public-key`]!==void 0&&s(a,[`payload_logging`,`public_key`],f(e[`payload-logging-public-key`],`payload-logging-public-key`,`text`)),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/dlp/settings`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},i_={command:`settings`,describe:`Settings operations`,builder:e=>e.command(Zg).command($g).command(t_).command(r_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function a_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const o_={command:`get <tunnel-id>`,describe:`Gets the configuration for a remotely-managed tunnel`,builder:a_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust tunnels cloudflared configurations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/configurations`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.tunnels.cloudflared.configurations.get(n,e[`tunnel-id`])),{successLabel:`Loaded`})}};function s_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`config-origin-request-access-aud-tag`,{type:`string`,array:!0,description:`Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.`}).option(`config-origin-request-access-required`,{type:`boolean`,description:`Deny traffic that has not fulfilled Access authorization.`}).option(`config-origin-request-access-team-name`,{type:`string`,description:`The config.originRequest.access.teamName field`}).option(`config-origin-request-ca-pool`,{type:`string`,description:`Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.`}).option(`config-origin-request-connect-timeout`,{type:`number`,description:`Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.`}).option(`config-origin-request-disable-chunked-encoding`,{type:`boolean`,description:`Disables chunked transfer encoding. Useful if you are running a WSGI server.`}).option(`config-origin-request-http2origin`,{type:`boolean`,description:`Attempt to connect to origin using HTTP2. Origin must be configured as https.`}).option(`config-origin-request-http-host-header`,{type:`string`,description:`Sets the HTTP Host header on requests sent to the local service.`}).option(`config-origin-request-keep-alive-connections`,{type:`number`,description:`Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.`}).option(`config-origin-request-keep-alive-timeout`,{type:`number`,description:`Timeout after which an idle keepalive connection can be discarded.`}).option(`config-origin-request-match-snito-host`,{type:`boolean`,description:`Auto configure the Hostname on the origin server certificate.`}).option(`config-origin-request-no-happy-eyeballs`,{type:`boolean`,description:`Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.`}).option(`config-origin-request-no-tlsverify`,{type:`boolean`,description:`Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.`}).option(`config-origin-request-origin-server-name`,{type:`string`,description:`Hostname that cloudflared should expect from your origin server certificate.`}).option(`config-origin-request-proxy-type`,{type:`string`,description:`cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and "socks" for a SOCKS5 proxy.
+`}).option(`config-origin-request-tcp-keep-alive`,{type:`number`,description:`The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.`}).option(`config-origin-request-tls-timeout`,{type:`number`,description:`Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`config-origin-request-access-aud-tag`,`config-origin-request-access-required`,`config-origin-request-access-team-name`,`config-origin-request-ca-pool`,`config-origin-request-connect-timeout`,`config-origin-request-disable-chunked-encoding`,`config-origin-request-http2origin`,`config-origin-request-http-host-header`,`config-origin-request-keep-alive-connections`,`config-origin-request-keep-alive-timeout`,`config-origin-request-match-snito-host`,`config-origin-request-no-happy-eyeballs`,`config-origin-request-no-tlsverify`,`config-origin-request-origin-server-name`,`config-origin-request-proxy-type`,`config-origin-request-tcp-keep-alive`,`config-origin-request-tls-timeout`].some(t=>e[t]!==void 0)){let t=[`config-origin-request-access-aud-tag`,`config-origin-request-access-team-name`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --config-* flag is set`)}return!0})}const c_={command:`update <tunnel-id>`,describe:`Adds or updates the configuration for a remotely-managed tunnel.`,builder:s_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust tunnels cloudflared configurations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/configurations`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`json`,body:{"config-origin-request-access-aud-tag":e[`config-origin-request-access-aud-tag`],"config-origin-request-access-required":e[`config-origin-request-access-required`],"config-origin-request-access-team-name":e[`config-origin-request-access-team-name`],"config-origin-request-ca-pool":e[`config-origin-request-ca-pool`],"config-origin-request-connect-timeout":e[`config-origin-request-connect-timeout`],"config-origin-request-disable-chunked-encoding":e[`config-origin-request-disable-chunked-encoding`],"config-origin-request-http2origin":e[`config-origin-request-http2origin`],"config-origin-request-http-host-header":e[`config-origin-request-http-host-header`],"config-origin-request-keep-alive-connections":e[`config-origin-request-keep-alive-connections`],"config-origin-request-keep-alive-timeout":e[`config-origin-request-keep-alive-timeout`],"config-origin-request-match-snito-host":e[`config-origin-request-match-snito-host`],"config-origin-request-no-happy-eyeballs":e[`config-origin-request-no-happy-eyeballs`],"config-origin-request-no-tlsverify":e[`config-origin-request-no-tlsverify`],"config-origin-request-origin-server-name":e[`config-origin-request-origin-server-name`],"config-origin-request-proxy-type":e[`config-origin-request-proxy-type`],"config-origin-request-tcp-keep-alive":e[`config-origin-request-tcp-keep-alive`],"config-origin-request-tls-timeout":e[`config-origin-request-tls-timeout`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.put(`/accounts/${n}/cfd_tunnel/${encodeURIComponent(String(e[`tunnel-id`]))}/configurations`,{body:r})),{successLabel:`Updated`});return}let a={};e[`config-origin-request-access-aud-tag`]!==void 0&&s(a,[`config`,`originRequest`,`access`,`audTag`],e[`config-origin-request-access-aud-tag`]),e[`config-origin-request-access-required`]!==void 0&&s(a,[`config`,`originRequest`,`access`,`required`],e[`config-origin-request-access-required`]),e[`config-origin-request-access-team-name`]!==void 0&&s(a,[`config`,`originRequest`,`access`,`teamName`],f(e[`config-origin-request-access-team-name`],`config-origin-request-access-team-name`,`text`)),e[`config-origin-request-ca-pool`]!==void 0&&s(a,[`config`,`originRequest`,`caPool`],f(e[`config-origin-request-ca-pool`],`config-origin-request-ca-pool`,`text`)),e[`config-origin-request-connect-timeout`]!==void 0&&s(a,[`config`,`originRequest`,`connectTimeout`],e[`config-origin-request-connect-timeout`]),e[`config-origin-request-disable-chunked-encoding`]!==void 0&&s(a,[`config`,`originRequest`,`disableChunkedEncoding`],e[`config-origin-request-disable-chunked-encoding`]),e[`config-origin-request-http2origin`]!==void 0&&s(a,[`config`,`originRequest`,`http2Origin`],e[`config-origin-request-http2origin`]),e[`config-origin-request-http-host-header`]!==void 0&&s(a,[`config`,`originRequest`,`httpHostHeader`],f(e[`config-origin-request-http-host-header`],`config-origin-request-http-host-header`,`text`)),e[`config-origin-request-keep-alive-connections`]!==void 0&&s(a,[`config`,`originRequest`,`keepAliveConnections`],e[`config-origin-request-keep-alive-connections`]),e[`config-origin-request-keep-alive-timeout`]!==void 0&&s(a,[`config`,`originRequest`,`keepAliveTimeout`],e[`config-origin-request-keep-alive-timeout`]),e[`config-origin-request-match-snito-host`]!==void 0&&s(a,[`config`,`originRequest`,`matchSNItoHost`],e[`config-origin-request-match-snito-host`]),e[`config-origin-request-no-happy-eyeballs`]!==void 0&&s(a,[`config`,`originRequest`,`noHappyEyeballs`],e[`config-origin-request-no-happy-eyeballs`]),e[`config-origin-request-no-tlsverify`]!==void 0&&s(a,[`config`,`originRequest`,`noTLSVerify`],e[`config-origin-request-no-tlsverify`]),e[`config-origin-request-origin-server-name`]!==void 0&&s(a,[`config`,`originRequest`,`originServerName`],f(e[`config-origin-request-origin-server-name`],`config-origin-request-origin-server-name`,`text`)),e[`config-origin-request-proxy-type`]!==void 0&&s(a,[`config`,`originRequest`,`proxyType`],f(e[`config-origin-request-proxy-type`],`config-origin-request-proxy-type`,`text`)),e[`config-origin-request-tcp-keep-alive`]!==void 0&&s(a,[`config`,`originRequest`,`tcpKeepAlive`],e[`config-origin-request-tcp-keep-alive`]),e[`config-origin-request-tls-timeout`]!==void 0&&s(a,[`config`,`originRequest`,`tlsTimeout`],e[`config-origin-request-tls-timeout`]),l(await d(`Updating`,async()=>t.put(`/accounts/${n}/cfd_tunnel/${encodeURIComponent(String(e[`tunnel-id`]))}/configurations`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}},l_={command:`configurations`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command(o_).command(c_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function u_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`client-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const d_={command:`delete <tunnel-id>`,describe:`Removes a connection (aka Cloudflare Tunnel Connector) from a Cloudflare Tunnel independently of its current state. If no connector id (client_id) is provided all connectors will be removed. We recommend running this command after rotating tokens.`,builder:u_,handler:async t=>{let n={client_id:t[`client-id`]};if(t.dryRun){u({command:`cf zero-trust tunnels cloudflared connections delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/cfd_tunnel/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}/connections`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``)},query:n,bodyKind:`json`,body:{body:t.body}});return}let a=await i(t),s=t.local?m:await r(a);if(t.accountId=s,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body),r=new URLSearchParams(Object.entries(n).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString();l(await d(`Deleting`,async()=>a.delete(`/accounts/${s}/cfd_tunnel/${encodeURIComponent(String(t[`tunnel-id`]))}/connections${r?`?`+r:``}`,{body:e})),{successLabel:`Deleted`});return}l(await d(`Deleting`,async()=>a.zeroTrust.tunnels.cloudflared.connections.delete(s,t[`tunnel-id`],n)),{successLabel:`Deleted`})}};function f_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const p_={command:`get <tunnel-id>`,describe:`Fetches connection details for a Cloudflare Tunnel.`,builder:f_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust tunnels cloudflared connections get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/connections`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.tunnels.cloudflared.connections.get(n,e[`tunnel-id`])),{successLabel:`Loaded`})}},m_={command:`connections`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command(d_).command(p_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function h_(e){return e.positional(`connector-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`,demandOption:!0}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const g_={command:`get <connector-id>`,describe:`Fetches connector and connection details for a Cloudflare Tunnel.`,builder:h_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust tunnels cloudflared connectors get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/connectors/${e[`connector-id`]==null?`<connector-id>`:encodeURIComponent(String(e[`connector-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``),"connector-id":String(e[`connector-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.tunnels.cloudflared.connectors.get(n,e[`tunnel-id`],e[`connector-id`])),{successLabel:`Loaded`})}},__={command:`connectors`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command(g_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function v_(e){return e.option(`config-src`,{type:`string`,description:"Indicates if this is a locally or remotely configured tunnel. If `local`, manage the tunnel using a YAML file on the origin machine. If `cloudflare`, manage the tunnel on the Zero Trust dashboard.",choices:[`local`,`cloudflare`],default:`local`}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`tunnel-secret`,{type:`string`,description:`Sets the password required to run a locally-managed tunnel. Must be at least 32 bytes and encoded as a base64 string.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const y_={command:`create`,describe:`Creates a new Cloudflare Tunnel in an account.`,builder:v_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust tunnels cloudflared create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/cfd_tunnel`,pathParams:{},bodyKind:`json`,body:{"config-src":e[`config-src`],name:e.name,"tunnel-secret":e[`tunnel-secret`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/cfd_tunnel`,{body:t})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await t(`name`,`A user-friendly name for a tunnel.`));let p={};e[`config-src`]!==void 0&&s(p,[`config_src`],f(e[`config-src`],`config-src`,`text`)),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),e[`tunnel-secret`]!==void 0&&s(p,[`tunnel_secret`],f(e[`tunnel-secret`],`tunnel-secret`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/cfd_tunnel`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function b_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const x_={command:`delete <tunnel-id>`,describe:`Deletes a Cloudflare Tunnel from an account.`,builder:b_,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust tunnels cloudflared delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/cfd_tunnel/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``)},bodyKind:`json`,body:{body:t.body}});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body);l(await d(`Deleting`,async()=>n.delete(`/accounts/${a}/cfd_tunnel/${encodeURIComponent(String(t[`tunnel-id`]))}`,{body:e})),{successLabel:`Deleted`});return}l(await d(`Deleting`,async()=>n.zeroTrust.tunnels.cloudflared.delete(a,t[`tunnel-id`])),{successLabel:`Deleted`})}};function S_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`tunnel-secret`,{type:`string`,description:`Sets the password required to run a locally-managed tunnel. Must be at least 32 bytes and encoded as a base64 string.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const C_={command:`edit <tunnel-id>`,describe:`Updates an existing Cloudflare Tunnel.`,builder:S_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust tunnels cloudflared edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`json`,body:{name:e.name,"tunnel-secret":e[`tunnel-secret`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/cfd_tunnel/${encodeURIComponent(String(e[`tunnel-id`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),e[`tunnel-secret`]!==void 0&&s(a,[`tunnel_secret`],f(e[`tunnel-secret`],`tunnel-secret`,`text`)),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/cfd_tunnel/${encodeURIComponent(String(e[`tunnel-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}};function w_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const T_={command:`get <tunnel-id>`,describe:`Fetches a single Cloudflare Tunnel.`,builder:w_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust tunnels cloudflared get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.tunnels.cloudflared.get(n,e[`tunnel-id`])),{successLabel:`Loaded`})}};function E_(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included."}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`uuid`,{type:`string`,description:`UUID of the tunnel.`}).option(`was-active-at`,{type:`string`,description:`Was active at`}).option(`was-inactive-at`,{type:`string`,description:`Was inactive at`}).option(`include-prefix`,{type:`string`,description:`Include prefix`}).option(`exclude-prefix`,{type:`string`,description:`Exclude prefix`}).option(`status`,{type:`string`,description:"The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).",choices:[`inactive`,`degraded`,`healthy`,`down`]}).option(`per-page`,{type:`string`,description:`Number of results to display.`}).option(`page`,{type:`string`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const D_={command:`list`,describe:`Lists and filters Cloudflare Tunnels in an account.`,builder:E_,handler:async e=>{let t={name:e.name,is_deleted:e[`is-deleted`],existed_at:e[`existed-at`],uuid:e.uuid,was_active_at:e[`was-active-at`],was_inactive_at:e[`was-inactive-at`],include_prefix:e[`include-prefix`],exclude_prefix:e[`exclude-prefix`],status:e.status,per_page:e[`per-page`],page:e.page};if(e.dryRun){u({command:`cf zero-trust tunnels cloudflared list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/cfd_tunnel`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.tunnels.cloudflared.list(a,t)),{successLabel:`Loaded`})}};function O_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`resources`,{type:`string`,array:!0,description:`The resources field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const k_={command:`create <tunnel-id>`,describe:`Gets a management token used to access the management resources (i.e. Streaming Logs) of a tunnel.`,builder:O_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust tunnels cloudflared management create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/management`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`json`,body:{resources:e.resources,body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Creating`,async()=>t.post(`/accounts/${n}/cfd_tunnel/${encodeURIComponent(String(e[`tunnel-id`]))}/management`,{body:r})),{successLabel:`Created`});return}if(e.resources===void 0)throw Error(`--resources is required (or pass --body with this field set).`);let a={};e.resources!==void 0&&s(a,[`resources`],e.resources),l(await d(`Creating`,async()=>t.post(`/accounts/${n}/cfd_tunnel/${encodeURIComponent(String(e[`tunnel-id`]))}/management`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Created`})}},A_={command:`management`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command(k_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function j_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const M_={command:`get <tunnel-id>`,describe:`Gets the token used to associate cloudflared with a specific tunnel.`,builder:j_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust tunnels cloudflared token get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/token`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.tunnels.cloudflared.token.get(n,e[`tunnel-id`])),{successLabel:`Loaded`})}},N_={command:`token`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command(M_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},P_={command:`cloudflared`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command(y_).command(x_).command(C_).command(T_).command(D_).command(l_).command(m_).command(__).command(A_).command(N_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function F_(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for the tunnel.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included."}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`uuid`,{type:`string`,description:`UUID of the tunnel.`}).option(`was-active-at`,{type:`string`,description:`Was active at`}).option(`was-inactive-at`,{type:`string`,description:`Was inactive at`}).option(`include-prefix`,{type:`string`,description:`Include prefix`}).option(`exclude-prefix`,{type:`string`,description:`Exclude prefix`}).option(`tun-types`,{type:`string`,description:`The types of tunnels to filter by, separated by commas.`}).option(`status`,{type:`string`,description:"The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).",choices:[`inactive`,`degraded`,`healthy`,`down`]}).option(`per-page`,{type:`string`,description:`Number of results to display.`}).option(`page`,{type:`string`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const I_={command:`list`,describe:`Lists and filters all types of Tunnels in an account.`,builder:F_,handler:async e=>{let t={name:e.name,is_deleted:e[`is-deleted`],existed_at:e[`existed-at`],uuid:e.uuid,was_active_at:e[`was-active-at`],was_inactive_at:e[`was-inactive-at`],include_prefix:e[`include-prefix`],exclude_prefix:e[`exclude-prefix`],tun_types:e[`tun-types`],status:e.status,per_page:e[`per-page`],page:e.page};if(e.dryRun){u({command:`cf zero-trust tunnels list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/tunnels`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.tunnels.list(a,t)),{successLabel:`Loaded`})}};function L_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const R_={command:`get <tunnel-id>`,describe:`Fetches connection details for a WARP Connector Tunnel.`,builder:L_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust tunnels warp-connector connections get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/connections`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.tunnels.warpConnector.connections.get(n,e[`tunnel-id`])),{successLabel:`Loaded`})}},z_={command:`connections`,describe:`Connections operations`,builder:e=>e.command(R_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function B_(e){return e.positional(`connector-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`,demandOption:!0}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const V_={command:`get <connector-id>`,describe:`Fetches connector and connection details for a WARP Connector Tunnel.`,builder:B_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust tunnels warp-connector connectors get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/connectors/${e[`connector-id`]==null?`<connector-id>`:encodeURIComponent(String(e[`connector-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``),"connector-id":String(e[`connector-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.tunnels.warpConnector.connectors.get(n,e[`tunnel-id`],e[`connector-id`])),{successLabel:`Loaded`})}},H_={command:`connectors`,describe:`Connectors operations`,builder:e=>e.command(V_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function U_(e){return e.option(`ha`,{type:`boolean`,description:`Indicates that the tunnel will be created to be highly available. If omitted, defaults to false.`,default:!1}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const W_={command:`create`,describe:`Creates a new Warp Connector Tunnel in an account.`,builder:U_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust tunnels warp-connector create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/warp_connector`,pathParams:{},bodyKind:`json`,body:{ha:e.ha,name:e.name,body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Creating`,async()=>n.post(`/accounts/${a}/warp_connector`,{body:t})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await t(`name`,`A user-friendly name for a tunnel.`));let p={};e.ha!==void 0&&s(p,[`ha`],e.ha),e.name!==void 0&&s(p,[`name`],f(e.name,`name`,`text`)),l(await d(`Creating`,async()=>n.post(`/accounts/${a}/warp_connector`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created`})}};function G_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const K_={command:`delete <tunnel-id>`,describe:`Deletes a Warp Connector Tunnel from an account.`,builder:G_,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust tunnels warp-connector delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/warp_connector/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``)},bodyKind:`json`,body:{body:t.body}});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body);l(await d(`Deleting`,async()=>n.delete(`/accounts/${a}/warp_connector/${encodeURIComponent(String(t[`tunnel-id`]))}`,{body:e})),{successLabel:`Deleted`});return}l(await d(`Deleting`,async()=>n.zeroTrust.tunnels.warpConnector.delete(a,t[`tunnel-id`])),{successLabel:`Deleted`})}};function q_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`tunnel-secret`,{type:`string`,description:`Sets the password required to run a locally-managed tunnel. Must be at least 32 bytes and encoded as a base64 string.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const J_={command:`edit <tunnel-id>`,describe:`Updates an existing Warp Connector Tunnel.`,builder:q_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust tunnels warp-connector edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`json`,body:{name:e.name,"tunnel-secret":e[`tunnel-secret`],body:e.body}});return}let t=await i(e),n=e.local?m:await r(t);if(e.accountId=n,e.body){let r=c(e.body);l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/warp_connector/${encodeURIComponent(String(e[`tunnel-id`]))}`,{body:r})),{successLabel:`Updated`});return}let a={};e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),e[`tunnel-secret`]!==void 0&&s(a,[`tunnel_secret`],f(e[`tunnel-secret`],`tunnel-secret`,`text`)),l(await d(`Updating`,async()=>t.patch(`/accounts/${n}/warp_connector/${encodeURIComponent(String(e[`tunnel-id`]))}`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Updated`})}};function Y_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`client-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const X_={command:`update <tunnel-id>`,describe:`Triggers a manual failover for a specific WARP Connector Tunnel, setting the specified client as the active connector. The tunnel must be configured for high availability (HA) and the client must be linked to the tunnel.`,builder:Y_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust tunnels warp-connector failover update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/failover`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`json`,body:{"client-id":e[`client-id`],body:e.body}});return}let n=await i(e),a=e.local?m:await r(n);if(e.accountId=a,e.body){let t=c(e.body);l(await d(`Updating`,async()=>n.put(`/accounts/${a}/warp_connector/${encodeURIComponent(String(e[`tunnel-id`]))}/failover`,{body:t})),{successLabel:`Updated`});return}e[`client-id`]===void 0&&(e[`client-id`]=await t(`client-id`,`UUID of the Cloudflare Tunnel connector.`));let p={};e[`client-id`]!==void 0&&s(p,[`client_id`],f(e[`client-id`],`client-id`,`text`)),l(await d(`Updating`,async()=>n.put(`/accounts/${a}/warp_connector/${encodeURIComponent(String(e[`tunnel-id`]))}/failover`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated`})}},Z_={command:`failover`,describe:`Failover operations`,builder:e=>e.command(X_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Q_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $_={command:`get <tunnel-id>`,describe:`Fetches a single Warp Connector Tunnel.`,builder:Q_,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust tunnels warp-connector get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.tunnels.warpConnector.get(n,e[`tunnel-id`])),{successLabel:`Loaded`})}};function ev(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for the tunnel.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included."}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`uuid`,{type:`string`,description:`UUID of the tunnel.`}).option(`was-active-at`,{type:`string`,description:`Was active at`}).option(`was-inactive-at`,{type:`string`,description:`Was inactive at`}).option(`include-prefix`,{type:`string`,description:`Include prefix`}).option(`exclude-prefix`,{type:`string`,description:`Exclude prefix`}).option(`status`,{type:`string`,description:"The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).",choices:[`inactive`,`degraded`,`healthy`,`down`]}).option(`per-page`,{type:`string`,description:`Number of results to display.`}).option(`page`,{type:`string`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const tv={command:`list`,describe:`Lists and filters Warp Connector Tunnels in an account.`,builder:ev,handler:async e=>{let t={name:e.name,is_deleted:e[`is-deleted`],existed_at:e[`existed-at`],uuid:e.uuid,was_active_at:e[`was-active-at`],was_inactive_at:e[`was-inactive-at`],include_prefix:e[`include-prefix`],exclude_prefix:e[`exclude-prefix`],status:e.status,per_page:e[`per-page`],page:e.page};if(e.dryRun){u({command:`cf zero-trust tunnels warp-connector list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/warp_connector`,pathParams:{},query:t,bodyKind:`none`});return}let n=await i(e),a=e.local?m:await r(n);e.accountId=a,l(await d(`Loading`,async()=>n.zeroTrust.tunnels.warpConnector.list(a,t)),{successLabel:`Loaded`})}};function nv(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const rv={command:`get <tunnel-id>`,describe:`Gets the token used to associate warp device with a specific Warp Connector tunnel.`,builder:nv,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust tunnels warp-connector token get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/token`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let t=await i(e),n=e.local?m:await r(t);e.accountId=n,l(await d(`Loading`,async()=>t.zeroTrust.tunnels.warpConnector.token.get(n,e[`tunnel-id`])),{successLabel:`Loaded`})}},iv={command:`token`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command(rv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},av={command:`warp-connector`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command(W_).command(K_).command(J_).command($_).command(tv).command(z_).command(H_).command(Z_).command(iv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ov={command:`tunnels`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command(I_).command(P_).command(av).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function sv(e){return e.positional(`authenticator-id`,{type:`string`,description:`The unique identifier for the MFA device.`,demandOption:!0}).option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const cv={command:`delete <authenticator-id>`,describe:`Deletes a specific MFA device for a user. This action is only available if MFA is turned on for the organization.`,builder:sv,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust users mfa authenticators delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${o()??`<account-id>`}/access/users/${t[`user-id`]==null?`<user-id>`:encodeURIComponent(String(t[`user-id`]))}/mfa_authenticators/${t[`authenticator-id`]==null?`<authenticator-id>`:encodeURIComponent(String(t[`authenticator-id`]))}`,pathParams:{"user-id":String(t[`user-id`]??``),"authenticator-id":String(t[`authenticator-id`]??``)},bodyKind:`none`});return}let n=await i(t),a=t.local?m:await r(n);if(t.accountId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>n.zeroTrust.users.mfa.authenticators.delete(t[`user-id`],a,t[`authenticator-id`])),{successLabel:`Deleted`})}},lv={command:`authenticators`,describe:`Users operations`,builder:e=>e.command(cv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},uv={command:`mfa`,describe:`Operations for users.mfa`,builder:e=>e.command(lv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},dv={command:`users`,describe:`Operations for users`,builder:e=>e.command(uv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function fv(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pv={command:`create`,describe:`Adds a new identity provider to Access.`,builder:fv,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust zone-identity-providers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=r,e.body){let n=c(e.body);l(await d(`Creating`,async()=>t.post(`/zones/${e.zoneId}/access/identity_providers`,{body:n})),{successLabel:`Created`});return}l(await d(`Creating`,async()=>t.zeroTrust.zoneIdentityProviders.create(r)),{successLabel:`Created`})}};function mv(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const hv={command:`delete <identity-provider-id>`,describe:`Deletes an identity provider from Access.`,builder:mv,handler:async t=>{if(t.dryRun){u({command:`cf zero-trust zone-identity-providers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/identity_providers/${t[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(t[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(t[`identity-provider-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let r=await i(t),a=await n({zone:t.zone},r,{quiet:t.quiet});if(t.zoneId=a,!await e({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}l(await d(`Deleting`,async()=>r.zeroTrust.zoneIdentityProviders.delete(t[`identity-provider-id`],a)),{successLabel:`Deleted`})}};function gv(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _v={command:`get <identity-provider-id>`,describe:`Fetches a configured identity provider.`,builder:gv,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust zone-identity-providers get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.zoneIdentityProviders.get(e[`identity-provider-id`],r)),{successLabel:`Loaded`})}};function vv(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yv={command:`list`,describe:`Lists all configured identity providers.`,builder:vv,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust zone-identity-providers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.zoneIdentityProviders.list(r)),{successLabel:`Loaded`})}};function bv(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xv={command:`update <identity-provider-id>`,describe:`Updates a configured identity provider.`,builder:bv,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust zone-identity-providers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{body:e.body}});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=r,e.body){let n=c(e.body);l(await d(`Updating`,async()=>t.put(`/zones/${e.zoneId}/access/identity_providers/${encodeURIComponent(String(e[`identity-provider-id`]))}`,{body:n})),{successLabel:`Updated`});return}l(await d(`Updating`,async()=>t.zeroTrust.zoneIdentityProviders.update(e[`identity-provider-id`],r)),{successLabel:`Updated`})}},Sv={command:`zone-identity-providers`,describe:`Zone-scoped Access identity provider management`,builder:e=>e.command(pv).command(hv).command(_v).command(yv).command(xv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Cv(e){return e.option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const wv={command:`create`,describe:`Sets up a Zero Trust organization for your account.`,builder:Cv,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust zone-organizations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/organizations`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{"auth-domain":e[`auth-domain`],"is-ui-read-only":e[`is-ui-read-only`],"login-design-background-color":e[`login-design-background-color`],"login-design-footer-text":e[`login-design-footer-text`],"login-design-header-text":e[`login-design-header-text`],"login-design-logo-path":e[`login-design-logo-path`],"login-design-text-color":e[`login-design-text-color`],name:e.name,"ui-read-only-toggle-reason":e[`ui-read-only-toggle-reason`],"user-seat-expiration-inactive-time":e[`user-seat-expiration-inactive-time`],body:e.body}});return}let r=await i(e);if(e.zoneId=await n({zone:e.zone},r,{quiet:e.quiet}),e.body){let t=c(e.body);l(await d(`Creating`,async()=>r.post(`/zones/${e.zoneId}/access/organizations`,{body:t})),{successLabel:`Created`});return}e[`auth-domain`]===void 0&&(e[`auth-domain`]=await t(`auth-domain`,`The unique subdomain assigned to your Zero Trust organization.`)),e.name===void 0&&(e.name=await t(`name`,`The name of your Zero Trust organization.`));let a={};e[`auth-domain`]!==void 0&&s(a,[`auth_domain`],f(e[`auth-domain`],`auth-domain`,`text`)),e[`is-ui-read-only`]!==void 0&&s(a,[`is_ui_read_only`],e[`is-ui-read-only`]),e[`login-design-background-color`]!==void 0&&s(a,[`login_design`,`background_color`],f(e[`login-design-background-color`],`login-design-background-color`,`text`)),e[`login-design-footer-text`]!==void 0&&s(a,[`login_design`,`footer_text`],f(e[`login-design-footer-text`],`login-design-footer-text`,`text`)),e[`login-design-header-text`]!==void 0&&s(a,[`login_design`,`header_text`],f(e[`login-design-header-text`],`login-design-header-text`,`text`)),e[`login-design-logo-path`]!==void 0&&s(a,[`login_design`,`logo_path`],f(e[`login-design-logo-path`],`login-design-logo-path`,`text`)),e[`login-design-text-color`]!==void 0&&s(a,[`login_design`,`text_color`],f(e[`login-design-text-color`],`login-design-text-color`,`text`)),e.name!==void 0&&s(a,[`name`],f(e.name,`name`,`text`)),e[`ui-read-only-toggle-reason`]!==void 0&&s(a,[`ui_read_only_toggle_reason`],f(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`)),e[`user-seat-expiration-inactive-time`]!==void 0&&s(a,[`user_seat_expiration_inactive_time`],f(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)),l(await d(`Creating`,async()=>r.post(`/zones/${e.zoneId}/access/organizations`,{body:Object.keys(a).length>0?a:void 0})),{successLabel:`Created`})}};function Tv(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ev={command:`get`,describe:`Returns the configuration for your Zero Trust organization.`,builder:Tv,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust zone-organizations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/organizations`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await i(e),r=await n({zone:e.zone},t,{quiet:e.quiet});e.zoneId=r,l(await d(`Loading`,async()=>t.zeroTrust.zoneOrganizations.get(r)),{successLabel:`Loaded`})}};function Dv(e){return e.option(`email`,{type:`string`,description:`The email of the user to revoke.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ov={command:`revoke-user-create`,describe:`Revokes a user's access across all applications.`,builder:Dv,handler:async r=>{if(r.dryRun){u({command:`cf zero-trust zone-organizations revoke-user-create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${r.zone??r.zoneId??`<zone>`}/access/organizations/revoke_user`,pathParams:{"zone-id":String(r.zone??r[`zone-id`]??``)},bodyKind:`json`,body:{email:r.email,body:r.body}});return}let a=await i(r);if(r.zoneId=await n({zone:r.zone},a,{quiet:r.quiet}),!await e({force:!!r.force,message:`This operation revokes all access tokens for a user, affecting their access to all applications within the zone.`})){process.stderr.write(`Aborted.
+`);return}if(r.body){let e=c(r.body);l(await d(`Deleting`,async()=>a.post(`/zones/${r.zoneId}/access/organizations/revoke_user`,{body:e})),{successLabel:`Deleted`});return}r.email===void 0&&(r.email=await t(`email`,`The email of the user to revoke.`));let o={};r.email!==void 0&&s(o,[`email`],f(r.email,`email`,`text`)),l(await d(`Deleting`,async()=>a.post(`/zones/${r.zoneId}/access/organizations/revoke_user`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Deleted`})}};function kv(e){return e.option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Av={command:`update`,describe:`Updates the configuration for your Zero Trust organization.`,builder:kv,handler:async e=>{if(e.dryRun){u({command:`cf zero-trust zone-organizations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/organizations`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:{"auth-domain":e[`auth-domain`],"is-ui-read-only":e[`is-ui-read-only`],"login-design-background-color":e[`login-design-background-color`],"login-design-footer-text":e[`login-design-footer-text`],"login-design-header-text":e[`login-design-header-text`],"login-design-logo-path":e[`login-design-logo-path`],"login-design-text-color":e[`login-design-text-color`],name:e.name,"ui-read-only-toggle-reason":e[`ui-read-only-toggle-reason`],"user-seat-expiration-inactive-time":e[`user-seat-expiration-inactive-time`],body:e.body}});return}let t=await i(e);if(e.zoneId=await n({zone:e.zone},t,{quiet:e.quiet}),e.body){let n=c(e.body);l(await d(`Updating`,async()=>t.put(`/zones/${e.zoneId}/access/organizations`,{body:n})),{successLabel:`Updated`});return}let r={};e[`auth-domain`]!==void 0&&s(r,[`auth_domain`],f(e[`auth-domain`],`auth-domain`,`text`)),e[`is-ui-read-only`]!==void 0&&s(r,[`is_ui_read_only`],e[`is-ui-read-only`]),e[`login-design-background-color`]!==void 0&&s(r,[`login_design`,`background_color`],f(e[`login-design-background-color`],`login-design-background-color`,`text`)),e[`login-design-footer-text`]!==void 0&&s(r,[`login_design`,`footer_text`],f(e[`login-design-footer-text`],`login-design-footer-text`,`text`)),e[`login-design-header-text`]!==void 0&&s(r,[`login_design`,`header_text`],f(e[`login-design-header-text`],`login-design-header-text`,`text`)),e[`login-design-logo-path`]!==void 0&&s(r,[`login_design`,`logo_path`],f(e[`login-design-logo-path`],`login-design-logo-path`,`text`)),e[`login-design-text-color`]!==void 0&&s(r,[`login_design`,`text_color`],f(e[`login-design-text-color`],`login-design-text-color`,`text`)),e.name!==void 0&&s(r,[`name`],f(e.name,`name`,`text`)),e[`ui-read-only-toggle-reason`]!==void 0&&s(r,[`ui_read_only_toggle_reason`],f(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`)),e[`user-seat-expiration-inactive-time`]!==void 0&&s(r,[`user_seat_expiration_inactive_time`],f(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)),l(await d(`Updating`,async()=>t.put(`/zones/${e.zoneId}/access/organizations`,{body:Object.keys(r).length>0?r:void 0})),{successLabel:`Updated`})}},jv={command:`zone-organizations`,describe:`Zone-scoped Zero Trust organization management`,builder:e=>e.command(wv).command(Ev).command(Ov).command(Av).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Mv={command:`zero-trust`,describe:`Cloudflare's SASE platform — secure access, device posture, DLP, tunnels, gateway policies, and network segmentation`,builder:e=>e.command(Er).command(Di).command(Ui).command(Ji).command(gc).command(Tl).command(Id).command(ef).command(rm).command(mm).command(Mm).command(Lh).command(Zh).command(cg).command(Fg).command(Rg).command(Yg).command(i_).command(ov).command(dv).command(Sv).command(jv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{Mv as default};