cf 0.10.0 → 0.11.0

package/dist/{zero-trust-DV3sIOvu.mjs → zero-trust-DVdUPtj1.mjs}

@@ -1,39 +1,39 @@
 #!/usr/bin/env node
-import{t as e}from"./local-D-aVNu6A.mjs";import{f as t,g as n,h as r}from"./oauth-B0ETkNcX.mjs";import{a as i,r as a}from"./auth-MQEamPN9.mjs";import{t as o}from"./output-DrpYYfnB.mjs";import{n as s,t as c}from"./progress-CsHIt3Tp.mjs";import{n as l,r as u,t as d}from"./body-parser-C-c9gfH1.mjs";import{n as f,t as p}from"./input-validation-Bav2M9F-.mjs";import{a as m,i as h,n as g}from"./prompt-DdegNPpg.mjs";import{t as _}from"./cli-types-BsTty22w.mjs";import{n as v,t as ee}from"./raw-fetch-CteyTOM2.mjs";function te(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const y={command:`create <app-id>`,describe:`Generates a new short-lived certificate CA and public key.`,builder:te,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications cas create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/ca`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Creating`,async()=>l.zeroTrust.access.applications.cas.create({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`]})),{successLabel:`Created`})}};function b(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const x={command:`delete <app-id>`,describe:`Deletes a short-lived certificate CA.`,builder:b,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications cas delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/ca`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(u===`zones`?i.zoneId=d:i.accountId=d,!await g({force:!!i.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>l.zeroTrust.access.applications.cas.delete({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`]})),{successLabel:`Deleted`})}};function S(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const C={command:`get <app-id>`,describe:`Fetches a short-lived certificate CA and its public key.`,builder:S,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications cas get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/ca`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.access.applications.cas.get({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`]})),{successLabel:`Loaded`})}};function w(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const T={command:`list`,describe:`Lists short-lived certificate CAs and their public keys.`,builder:w,handler:async i=>{let l={page:i.page,per_page:i[`per-page`]};if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications cas list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/ca`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},query:l,bodyKind:`none`});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();d===`zones`?i.zoneId=f:i.accountId=f,o(await c(`Loading`,async()=>u.zeroTrust.access.applications.cas.list({account_or_zone:d,account_or_zone_id:f,...l})),{successLabel:`Loaded`})}},E={command:`cas`,describe:`Operations for access.applications.cas`,builder:e=>e.command(y).command(x).command(C).command(T).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function D(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const O={command:`create`,describe:`Adds a new application to Access.`,builder:D,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?void 0:l(i.body)});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=f:i.accountId=f,i.body){let e=l(i.body);o(await c(`Creating`,async()=>u.zeroTrust.access.applications.create({body:e,account_or_zone:d,account_or_zone_id:f})),{successLabel:`Created`});return}if(i.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function k(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const A={command:`delete <app-id>`,describe:`Deletes an application from Access.`,builder:k,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(u===`zones`?i.zoneId=d:i.accountId=d,!await g({force:!!i.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>l.zeroTrust.access.applications.delete({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`]})),{successLabel:`Deleted`})}};function j(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const M={command:`get <app-id>`,describe:`Fetches information about an Access application.`,builder:j,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.access.applications.get({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`]})),{successLabel:`Loaded`})}};function N(e){return e.option(`name`,{type:`string`,description:`The name of the app.`}).option(`domain`,{type:`string`,description:`The domain of the app.`}).option(`aud`,{type:`string`,description:`The aud of the app.`}).option(`target-attributes`,{type:`string`,description:`Target Criteria attributes in key=value format.`}).option(`exact`,{type:`boolean`,description:`True for only exact string matches against passed name/domain query parameters.`}).option(`search`,{type:`string`,description:`Search for apps by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const P={command:`list`,describe:`Lists all Access applications in an account or zone.`,builder:N,handler:async i=>{let l={name:i.name,domain:i.domain,aud:i.aud,target_attributes:i[`target-attributes`],exact:i.exact,search:i.search,page:i.page,per_page:i[`per-page`]};if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},query:l,bodyKind:`none`});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();d===`zones`?i.zoneId=f:i.accountId=f,o(await c(`Loading`,async()=>u.zeroTrust.access.applications.list({account_or_zone:d,account_or_zone_id:f,...l})),{successLabel:`Loaded`})}};function F(e){return e.positional(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const I={command:`create <app-id>`,describe:`Creates a policy applying exclusive to a single application that defines the users or groups who can reach it. We recommend creating a reusable policy instead and subsequently referencing its ID in the application's 'policies' array.`,builder:F,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/policies`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?void 0:l(i.body)});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=f:i.accountId=f,i.body){let e=l(i.body);o(await c(`Creating`,async()=>u.zeroTrust.access.applications.policies.create({body:e,account_or_zone:d,account_or_zone_id:f,app_id:i[`app-id`]})),{successLabel:`Created`});return}if(i.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function L(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const R={command:`delete <policy-id>`,describe:`Deletes an Access policy specific to an application. To delete a reusable policy, use the /account or zones/{account or zone_id}/policies/{uid} endpoint.`,builder:L,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/policies/${i[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(i[`policy-id`]))}`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"policy-id":String(i[`policy-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(u===`zones`?i.zoneId=d:i.accountId=d,!await g({force:!!i.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>l.zeroTrust.access.applications.policies.delete({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`],policy_id:i[`policy-id`]})),{successLabel:`Deleted`})}};function z(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const B={command:`get <policy-id>`,describe:`Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.`,builder:z,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/policies/${i[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(i[`policy-id`]))}`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"policy-id":String(i[`policy-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.access.applications.policies.get({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`],policy_id:i[`policy-id`]})),{successLabel:`Loaded`})}};function V(e){return e.option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const H={command:`list`,describe:`Lists Access policies configured for an application. Returns both exclusively scoped and reusable policies used by the application.`,builder:V,handler:async i=>{let l={page:i.page,per_page:i[`per-page`]};if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/policies`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},query:l,bodyKind:`none`});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();d===`zones`?i.zoneId=f:i.accountId=f,o(await c(`Loading`,async()=>u.zeroTrust.access.applications.policies.list({account_or_zone:d,account_or_zone_id:f,app_id:i[`app-id`],...l})),{successLabel:`Loaded`})}};function U(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const W={command:`update <policy-id>`,describe:`Updates an Access policy specific to an application. To update a reusable policy, use the /account or zones/{account or zone_id}/policies/{uid} endpoint.`,builder:U,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/policies/${i[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(i[`policy-id`]))}`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"policy-id":String(i[`policy-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?void 0:l(i.body)});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=f:i.accountId=f,i.body){let e=l(i.body);o(await c(`Updating`,async()=>u.zeroTrust.access.applications.policies.update({body:e,account_or_zone:d,account_or_zone_id:f,app_id:i[`app-id`],policy_id:i[`policy-id`]})),{successLabel:`Updated`});return}if(i.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},G={command:`policies`,describe:`Operations for access.applications.policies`,builder:e=>e.command(I).command(R).command(B).command(H).command(W).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function K(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const q={command:`create`,describe:`Starts an Access policy test.`,builder:K,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications policy-tests create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policy-tests`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.applications.policyTests.create({...e,account_id:u})),{successLabel:`Created`});return}o(await c(`Creating`,async()=>i.zeroTrust.access.applications.policyTests.create({account_id:u})),{successLabel:`Created`})}};function J(e){return e.positional(`policy-test-id`,{type:`string`,description:`The UUID of the policy test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Y={command:`get <policy-test-id>`,describe:`Fetches the current status of a given Access policy test.`,builder:J,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications policy-tests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policy-tests/${r[`policy-test-id`]==null?`<policy-test-id>`:encodeURIComponent(String(r[`policy-test-id`]))}`,pathParams:{"policy-test-id":String(r[`policy-test-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.applications.policyTests.get({account_id:l,policy_test_id:r[`policy-test-id`]})),{successLabel:`Loaded`})}};function X(e){return e.option(`policy-test-id`,{type:`string`,description:`The UUID of the policy test.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`status`,{type:`string`,description:`Filter users by their policy evaluation status.`,choices:[`success`,`fail`,`error`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Z={command:`list`,describe:`Fetches a single page of user results from an Access policy test.`,builder:_(X),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],status:r.status};if(r.dryRun){s({command:`cf zero-trust access applications policy-tests users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policy-tests/${r[`policy-test-id`]==null?`<policy-test-id>`:encodeURIComponent(String(r[`policy-test-id`]))}/users`,pathParams:{"policy-test-id":String(r[`policy-test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.applications.policyTests.users.list({account_id:u,policy_test_id:r[`policy-test-id`],...i})),{successLabel:`Loaded`})}},Q={command:`users`,describe:`Operations for access.applications.policy-tests.users`,builder:e=>e.command(Z).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ne={command:`policy-tests`,describe:`Operations for access.applications.policy-tests`,builder:e=>e.command(q).command(Y).command(Q).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function re(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ie={command:`revoke-tokens <app-id>`,describe:`Revokes all tokens issued for an application.`,builder:re,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications revoke-tokens`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/revoke_tokens`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(u===`zones`?i.zoneId=d:i.accountId=d,!await g({force:!!i.force,message:`This operation invalidates every service token for the app.`})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>l.zeroTrust.access.applications.revokeTokens({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`]})),{successLabel:`Deleted`})}};function ae(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const oe={command:`edit <app-id>`,describe:`Updates Access application settings.`,builder:ae,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/settings`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?d({allow_iframe:i[`allow-iframe`],skip_interstitial:i[`skip-interstitial`]}):l(i.body)});return}let u=await a(i),f=i.zone===void 0?`accounts`:`zones`,p=f===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();if(f===`zones`?i.zoneId=p:i.accountId=p,i.body){let e=l(i.body);o(await c(`Updating`,async()=>u.zeroTrust.access.applications.settings.edit({body:e,account_or_zone:f,account_or_zone_id:p,app_id:i[`app-id`]})),{successLabel:`Updated`});return}let m=d({allow_iframe:i[`allow-iframe`],skip_interstitial:i[`skip-interstitial`]});o(await c(`Updating`,async()=>u.zeroTrust.access.applications.settings.edit({body:m,account_or_zone:f,account_or_zone_id:p,app_id:i[`app-id`]})),{successLabel:`Updated`})}};function se(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ce={command:`update <app-id>`,describe:`Updates Access application settings.`,builder:se,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/settings`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?d({allow_iframe:i[`allow-iframe`],skip_interstitial:i[`skip-interstitial`]}):l(i.body)});return}let u=await a(i),f=i.zone===void 0?`accounts`:`zones`,p=f===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();if(f===`zones`?i.zoneId=p:i.accountId=p,i.body){let e=l(i.body);o(await c(`Updating`,async()=>u.zeroTrust.access.applications.settings.update({body:e,account_or_zone:f,account_or_zone_id:p,app_id:i[`app-id`]})),{successLabel:`Updated`});return}let m=d({allow_iframe:i[`allow-iframe`],skip_interstitial:i[`skip-interstitial`]});o(await c(`Updating`,async()=>u.zeroTrust.access.applications.settings.update({body:m,account_or_zone:f,account_or_zone_id:p,app_id:i[`app-id`]})),{successLabel:`Updated`})}},le={command:`settings`,describe:`Operations for access.applications.settings`,builder:e=>e.command(oe).command(ce).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ue(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const de={command:`update <app-id>`,describe:`Updates an Access application.`,builder:ue,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?void 0:l(i.body)});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=f:i.accountId=f,i.body){let e=l(i.body);o(await c(`Updating`,async()=>u.zeroTrust.access.applications.update({body:e,account_or_zone:d,account_or_zone_id:f,app_id:i[`app-id`]})),{successLabel:`Updated`});return}if(i.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function fe(e){return e.option(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pe={command:`list`,describe:`Tests if a specific user has permission to access an application.`,builder:fe,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications user-policy-checks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/user_policy_checks`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.access.applications.userPolicyChecks.list({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`]})),{successLabel:`Loaded`})}},me={command:`user-policy-checks`,describe:`Operations for access.applications.user-policy-checks`,builder:e=>e.command(pe).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},he={command:`applications`,describe:`Operations for access.applications`,builder:e=>e.command(O).command(A).command(M).command(P).command(ie).command(de).command(E).command(G).command(ne).command(le).command(me).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ge(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _e={command:`list`,describe:`Returns a list of Authenticator Device AAGUIDs for MFA configuration.`,builder:ge,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access authenticator-device-aaguids list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/authenticator_device_aaguids`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.authenticatorDeviceAaguids.list({account_id:l})),{successLabel:`Loaded`})}},ve={command:`authenticator-device-aaguids`,describe:`Operations for access.authenticator-device-aaguids`,builder:e=>e.command(_e).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ye(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const be={command:`create <bookmark-id>`,describe:`Create a new Bookmark application.`,builder:ye,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access bookmarks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/bookmarks/${r[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(r[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(r[`bookmark-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.access.bookmarks.create({account_id:l,bookmark_id:r[`bookmark-id`]})),{successLabel:`Created`})}};function xe(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Se={command:`delete <bookmark-id>`,describe:`Deletes a Bookmark application.`,builder:xe,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access bookmarks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/bookmarks/${r[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(r[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(r[`bookmark-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.bookmarks.delete({account_id:l,bookmark_id:r[`bookmark-id`]})),{successLabel:`Deleted`})}};function Ce(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const we={command:`get <bookmark-id>`,describe:`Fetches a single Bookmark application.`,builder:Ce,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access bookmarks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/bookmarks/${r[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(r[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(r[`bookmark-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.bookmarks.get({account_id:l,bookmark_id:r[`bookmark-id`]})),{successLabel:`Loaded`})}};function Te(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ee={command:`list`,describe:`Lists Bookmark applications.`,builder:Te,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access bookmarks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/bookmarks`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.bookmarks.list({account_id:l})),{successLabel:`Loaded`})}};function De(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Oe={command:`update <bookmark-id>`,describe:`Updates a configured Bookmark application.`,builder:De,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access bookmarks update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/bookmarks/${r[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(r[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(r[`bookmark-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Updating`,async()=>i.zeroTrust.access.bookmarks.update({account_id:l,bookmark_id:r[`bookmark-id`]})),{successLabel:`Updated`})}},ke={command:`bookmarks`,describe:`Operations for access.bookmarks`,builder:e=>e.command(be).command(Se).command(we).command(Ee).command(Oe).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ae(e){return e.option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`certificate`,{type:`string`,description:`The certificate content.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const je={command:`create`,describe:`Adds a new mTLS root certificate to Access.`,builder:Ae,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/certificates`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?d({associated_hostnames:i[`associated-hostnames`],certificate:f(i.certificate,`certificate`,`text`),name:f(i.name,`name`,`text`)}):l(i.body)});return}let u=await a(i),p=i.zone===void 0?`accounts`:`zones`,h=p===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();if(p===`zones`?i.zoneId=h:i.accountId=h,i.body){let e=l(i.body);o(await c(`Creating`,async()=>u.zeroTrust.access.certificates.create({...e,account_or_zone:p,account_or_zone_id:h})),{successLabel:`Created`});return}i.certificate===void 0&&(i.certificate=await m(`certificate`,`The certificate content.`)),i.name===void 0&&(i.name=await m(`name`,`The name of the certificate.`));let g=d({associated_hostnames:i[`associated-hostnames`],certificate:f(i.certificate,`certificate`,`text`),name:f(i.name,`name`,`text`)});o(await c(`Creating`,async()=>u.zeroTrust.access.certificates.create({...g,account_or_zone:p,account_or_zone_id:h})),{successLabel:`Created`})}};function Me(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ne={command:`delete <certificate-id>`,describe:`Deletes an mTLS certificate.`,builder:Me,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/certificates/${i[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(i[`certificate-id`]))}`,pathParams:{"account-or-zone":String(t),"certificate-id":String(i[`certificate-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(u===`zones`?i.zoneId=d:i.accountId=d,!await g({force:!!i.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>l.zeroTrust.access.certificates.delete({account_or_zone:u,account_or_zone_id:d,certificate_id:i[`certificate-id`]})),{successLabel:`Deleted`})}};function Pe(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fe={command:`get <certificate-id>`,describe:`Fetches a single mTLS certificate.`,builder:Pe,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/certificates/${i[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(i[`certificate-id`]))}`,pathParams:{"account-or-zone":String(t),"certificate-id":String(i[`certificate-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.access.certificates.get({account_or_zone:u,account_or_zone_id:d,certificate_id:i[`certificate-id`]})),{successLabel:`Loaded`})}};function Ie(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Le={command:`list`,describe:`Lists all mTLS root certificates.`,builder:Ie,handler:async i=>{let l={page:i.page,per_page:i[`per-page`]};if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/certificates`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},query:l,bodyKind:`none`});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();d===`zones`?i.zoneId=f:i.accountId=f,o(await c(`Loading`,async()=>u.zeroTrust.access.certificates.list({account_or_zone:d,account_or_zone_id:f,...l})),{successLabel:`Loaded`})}};function Re(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ze={command:`get`,describe:`List all mTLS hostname settings for this account or zone.`,builder:Re,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access certificates settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/certificates/settings`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.access.certificates.settings.get({account_or_zone:u,account_or_zone_id:d})),{successLabel:`Loaded`})}};function Be(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ve={command:`update`,describe:`Updates an mTLS certificate's hostname settings.`,builder:Be,handler:async u=>{if(u.dryRun){let e=u.zone===void 0?await n():void 0,t=u.zone===void 0?`accounts`:`zones`,r=u.zone??e??`<account-id>`;s({command:`cf zero-trust access certificates settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/certificates/settings`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:u.body===void 0?void 0:l(u.body)});return}let d=await a(u),f=u.zone===void 0?`accounts`:`zones`,p=f===`zones`?await r({zone:u.zone},d,{quiet:u.quiet}):u.local?e:await t();if(f===`zones`?u.zoneId=p:u.accountId=p,u.body){let e=l(u.body);o(await c(`Updating`,async()=>d.zeroTrust.access.certificates.settings.update({...e,account_or_zone:f,account_or_zone_id:p})),{successLabel:`Updated`});return}o(await c(`Updating`,async()=>i(d,`PUT`,`/${f}/${p}/access/certificates/settings`)),{successLabel:`Updated`})}},He={command:`settings`,describe:`Operations for access.certificates.settings`,builder:e=>e.command(ze).command(Ve).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ue(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const We={command:`update <certificate-id>`,describe:`Updates a configured mTLS certificate.`,builder:Ue,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access certificates update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/certificates/${i[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(i[`certificate-id`]))}`,pathParams:{"account-or-zone":String(t),"certificate-id":String(i[`certificate-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?d({associated_hostnames:i[`associated-hostnames`],name:f(i.name,`name`,`text`)}):l(i.body)});return}let u=await a(i),p=i.zone===void 0?`accounts`:`zones`,m=p===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();if(p===`zones`?i.zoneId=m:i.accountId=m,i.body){let e=l(i.body);o(await c(`Updating`,async()=>u.zeroTrust.access.certificates.update({...e,account_or_zone:p,account_or_zone_id:m,certificate_id:i[`certificate-id`]})),{successLabel:`Updated`});return}if(i[`associated-hostnames`]===void 0)throw Error(`--associated-hostnames is required (or pass --body with this field set).`);let h=d({associated_hostnames:i[`associated-hostnames`],name:f(i.name,`name`,`text`)});o(await c(`Updating`,async()=>u.zeroTrust.access.certificates.update({...h,account_or_zone:p,account_or_zone_id:m,certificate_id:i[`certificate-id`]})),{successLabel:`Updated`})}},Ge={command:`certificates`,describe:`Operations for access.certificates`,builder:e=>e.command(je).command(Ne).command(Fe).command(Le).command(We).command(He).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ke(e){return e.option(`app-count`,{type:`number`,description:`Number of apps the custom page is assigned to.`}).option(`contract-version`,{type:`number`,description:`Contract version of the page's Liquid template. Present (>= 1) marks a sanitized template; absent or 0 marks a legacy page served verbatim.`}).option(`custom-html`,{type:`string`,description:`Custom page HTML.`}).option(`name`,{type:`string`,description:`Custom page name.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`,`login`,`interstitial`]}).option(`uid`,{type:`string`,description:`UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const qe={command:`create`,describe:`Create a custom page`,builder:Ke,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access custom-pages create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({app_count:r[`app-count`],contract_version:r[`contract-version`],custom_html:f(r[`custom-html`],`custom-html`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`),uid:f(r.uid,`uid`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.customPages.create({body:e,account_id:u})),{successLabel:`Created`});return}r[`custom-html`]===void 0&&(r[`custom-html`]=await m(`custom-html`,`Custom page HTML.`)),r.name===void 0&&(r.name=await m(`name`,`Custom page name.`)),r.type===void 0&&(r.type=await h(`type`,`Custom page type.`,[`identity_denied`,`forbidden`,`login`,`interstitial`]));let p=d({app_count:r[`app-count`],contract_version:r[`contract-version`],custom_html:f(r[`custom-html`],`custom-html`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`),uid:f(r.uid,`uid`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.customPages.create({body:p,account_id:u})),{successLabel:`Created`})}};function Je(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ye={command:`delete <custom-page-id>`,describe:`Delete a custom page`,builder:Je,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access custom-pages delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages/${r[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(r[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(r[`custom-page-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.customPages.delete({account_id:l,custom_page_id:r[`custom-page-id`]})),{successLabel:`Deleted`})}};function Xe(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ze={command:`get <custom-page-id>`,describe:`Fetches a custom page and also returns its HTML.`,builder:Xe,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access custom-pages get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages/${r[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(r[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(r[`custom-page-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.customPages.get({account_id:l,custom_page_id:r[`custom-page-id`]})),{successLabel:`Loaded`})}};function Qe(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $e={command:`list`,describe:`List custom pages`,builder:Qe,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access custom-pages list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.customPages.list({account_id:u,...i})),{successLabel:`Loaded`})}};function et(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-count`,{type:`number`,description:`Number of apps the custom page is assigned to.`}).option(`contract-version`,{type:`number`,description:`Contract version of the page's Liquid template. Present (>= 1) marks a sanitized template; absent or 0 marks a legacy page served verbatim.`}).option(`custom-html`,{type:`string`,description:`Custom page HTML.`}).option(`name`,{type:`string`,description:`Custom page name.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`,`login`,`interstitial`]}).option(`uid`,{type:`string`,description:`UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const tt={command:`update <custom-page-id>`,describe:`Update a custom page`,builder:et,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access custom-pages update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages/${r[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(r[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(r[`custom-page-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({app_count:r[`app-count`],contract_version:r[`contract-version`],custom_html:f(r[`custom-html`],`custom-html`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`),uid:f(r.uid,`uid`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.customPages.update({body:e,account_id:u,custom_page_id:r[`custom-page-id`]})),{successLabel:`Updated`});return}r[`custom-html`]===void 0&&(r[`custom-html`]=await m(`custom-html`,`Custom page HTML.`)),r.name===void 0&&(r.name=await m(`name`,`Custom page name.`)),r.type===void 0&&(r.type=await h(`type`,`Custom page type.`,[`identity_denied`,`forbidden`,`login`,`interstitial`]));let p=d({app_count:r[`app-count`],contract_version:r[`contract-version`],custom_html:f(r[`custom-html`],`custom-html`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`),uid:f(r.uid,`uid`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.access.customPages.update({body:p,account_id:u,custom_page_id:r[`custom-page-id`]})),{successLabel:`Updated`})}};function nt(e){return e.option(`template`,{type:`string`,description:`The Liquid template to validate.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`,`login`,`interstitial`]}).option(`version`,{type:`number`,description:`Contract version to validate against; omit for the latest.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A template to validate without persisting it.`})}const rt={command:`validate`,describe:`Validate a Liquid template and return its errors and warnings without persisting it.`,builder:nt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access custom-pages validate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages/validate`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({template:f(r.template,`template`,`text`),type:f(r.type,`type`,`text`),version:r.version}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.customPages.validate({...e,account_id:u})),{successLabel:`Created`});return}r.template===void 0&&(r.template=await m(`template`,`The Liquid template to validate.`)),r.type===void 0&&(r.type=await h(`type`,`Custom page type.`,[`identity_denied`,`forbidden`,`login`,`interstitial`]));let p=d({template:f(r.template,`template`,`text`),type:f(r.type,`type`,`text`),version:r.version});o(await c(`Creating`,async()=>i.zeroTrust.access.customPages.validate({...p,account_id:u})),{successLabel:`Created`})}},it={command:`custom-pages`,describe:`Operations for access.custom-pages`,builder:e=>e.command(qe).command(Ye).command(Ze).command($e).command(tt).command(rt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function at(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ot={command:`create`,describe:`Adds a new SSH Certificate Authority (CA).`,builder:at,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access gateway-ca create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/gateway_ca`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.access.gatewayCa.create({account_id:l})),{successLabel:`Created`})}};function st(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ct={command:`delete <certificate-id>`,describe:`Deletes an SSH Certificate Authority.`,builder:st,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access gateway-ca delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/gateway_ca/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.gatewayCa.delete({account_id:l,certificate_id:r[`certificate-id`]})),{successLabel:`Deleted`})}};function lt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ut={command:`list`,describe:`Lists SSH Certificate Authorities (CA).`,builder:lt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access gateway-ca list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/gateway_ca`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.gatewayCa.list({account_id:l})),{successLabel:`Loaded`})}},dt={command:`gateway-ca`,describe:`Operations for access.gateway-ca`,builder:e=>e.command(ot).command(ct).command(ut).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ft(e){return e.option(`is-default`,{type:`boolean`,description:`Whether this is the default group`}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pt={command:`create`,describe:`Creates a new Access group.`,builder:ft,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/groups`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?d({is_default:i[`is-default`],name:f(i.name,`name`,`text`)}):l(i.body)});return}let u=await a(i),p=i.zone===void 0?`accounts`:`zones`,h=p===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();if(p===`zones`?i.zoneId=h:i.accountId=h,i.body){let e=l(i.body);o(await c(`Creating`,async()=>u.zeroTrust.access.groups.create({...e,account_or_zone:p,account_or_zone_id:h})),{successLabel:`Created`});return}i.name===void 0&&(i.name=await m(`name`,`The name of the Access group.`));let g=d({is_default:i[`is-default`],name:f(i.name,`name`,`text`)});o(await c(`Creating`,async()=>u.zeroTrust.access.groups.create({...g,account_or_zone:p,account_or_zone_id:h})),{successLabel:`Created`})}};function mt(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ht={command:`delete <group-id>`,describe:`Deletes an Access group.`,builder:mt,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/groups/${i[`group-id`]==null?`<group-id>`:encodeURIComponent(String(i[`group-id`]))}`,pathParams:{"account-or-zone":String(t),"group-id":String(i[`group-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(u===`zones`?i.zoneId=d:i.accountId=d,!await g({force:!!i.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>l.zeroTrust.access.groups.delete({account_or_zone:u,account_or_zone_id:d,group_id:i[`group-id`]})),{successLabel:`Deleted`})}};function gt(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _t={command:`get <group-id>`,describe:`Fetches a single Access group.`,builder:gt,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/groups/${i[`group-id`]==null?`<group-id>`:encodeURIComponent(String(i[`group-id`]))}`,pathParams:{"account-or-zone":String(t),"group-id":String(i[`group-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.access.groups.get({account_or_zone:u,account_or_zone_id:d,group_id:i[`group-id`]})),{successLabel:`Loaded`})}};function vt(e){return e.option(`name`,{type:`string`,description:`The name of the group.`}).option(`search`,{type:`string`,description:`Search for groups by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yt={command:`list`,describe:`Lists all Access groups.`,builder:vt,handler:async i=>{let l={name:i.name,search:i.search,page:i.page,per_page:i[`per-page`]};if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/groups`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},query:l,bodyKind:`none`});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();d===`zones`?i.zoneId=f:i.accountId=f,o(await c(`Loading`,async()=>u.zeroTrust.access.groups.list({account_or_zone:d,account_or_zone_id:f,...l})),{successLabel:`Loaded`})}};function bt(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`is-default`,{type:`boolean`,description:`Whether this is the default group`}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xt={command:`update <group-id>`,describe:`Updates a configured Access group.`,builder:bt,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/groups/${i[`group-id`]==null?`<group-id>`:encodeURIComponent(String(i[`group-id`]))}`,pathParams:{"account-or-zone":String(t),"group-id":String(i[`group-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?d({is_default:i[`is-default`],name:f(i.name,`name`,`text`)}):l(i.body)});return}let u=await a(i),p=i.zone===void 0?`accounts`:`zones`,h=p===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();if(p===`zones`?i.zoneId=h:i.accountId=h,i.body){let e=l(i.body);o(await c(`Updating`,async()=>u.zeroTrust.access.groups.update({...e,account_or_zone:p,account_or_zone_id:h,group_id:i[`group-id`]})),{successLabel:`Updated`});return}i.name===void 0&&(i.name=await m(`name`,`The name of the Access group.`));let g=d({is_default:i[`is-default`],name:f(i.name,`name`,`text`)});o(await c(`Updating`,async()=>u.zeroTrust.access.groups.update({...g,account_or_zone:p,account_or_zone_id:h,group_id:i[`group-id`]})),{successLabel:`Updated`})}},St={command:`groups`,describe:`Operations for access.groups`,builder:e=>e.command(pt).command(ht).command(_t).command(yt).command(xt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ct(e){return e.option(`idp-id`,{type:`string`,description:`UID of the identity provider to federate. Must be an existing identity provider in this account. One-time pin and Cloudflare-managed identity providers cannot be federated.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const wt={command:`create`,describe:`Creates an IdP federation grant for the specified identity provider, making it available for federation to other accounts in the same Cloudflare organization. The account must belong to a Cloudflare organization. One-time pin and Cloudflare-managed identity providers cannot be federated. An account can federate at most five identity providers at a time.`,builder:Ct,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access idp-federation-grants create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/idp_federation_grants`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({idp_id:f(r[`idp-id`],`idp-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.idpFederationGrants.create({...e,account_id:u})),{successLabel:`Created`});return}r[`idp-id`]===void 0&&(r[`idp-id`]=await m(`idp-id`,`UID of the identity provider to federate. Must be an existing identity provider in this account. One-time pin and Cloudflare-managed identity providers cannot be federated.`));let p=d({idp_id:f(r[`idp-id`],`idp-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.idpFederationGrants.create({...p,account_id:u})),{successLabel:`Created`})}};function Tt(e){return e.positional(`grant-id`,{type:`string`,description:`UID of the IdP federation grant.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Et={command:`delete <grant-id>`,describe:`Deletes an IdP federation grant. The identity provider remains in the account, but it is no longer available for federation to other accounts.`,builder:Tt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access idp-federation-grants delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/idp_federation_grants/${r[`grant-id`]==null?`<grant-id>`:encodeURIComponent(String(r[`grant-id`]))}`,pathParams:{"grant-id":String(r[`grant-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.idpFederationGrants.delete({account_id:l,grant_id:r[`grant-id`]})),{successLabel:`Deleted`})}};function Dt(e){return e.positional(`grant-id`,{type:`string`,description:`UID of the IdP federation grant.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ot={command:`get <grant-id>`,describe:`Retrieves a single IdP federation grant by its UID.`,builder:Dt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access idp-federation-grants get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/idp_federation_grants/${r[`grant-id`]==null?`<grant-id>`:encodeURIComponent(String(r[`grant-id`]))}`,pathParams:{"grant-id":String(r[`grant-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.idpFederationGrants.get({account_id:l,grant_id:r[`grant-id`]})),{successLabel:`Loaded`})}};function kt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const At={command:`list`,describe:`Lists the IdP federation grants owned by the account.`,builder:kt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access idp-federation-grants list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/idp_federation_grants`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.idpFederationGrants.list({account_id:l})),{successLabel:`Loaded`})}},jt={command:`idp-federation-grants`,describe:`Operations for access.idp-federation-grants`,builder:e=>e.command(wt).command(Et).command(Ot).command(At).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Mt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Nt={command:`get`,describe:`Gets the Access key rotation settings for an account.`,builder:Mt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access keys get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/keys`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.keys.get({account_id:l})),{successLabel:`Loaded`})}};function Pt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ft={command:`rotate`,describe:`Perfoms a key rotation for an account.`,builder:Pt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access keys rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/keys/rotate`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.access.keys.rotate({account_id:l})),{successLabel:`Created`})}};function It(e){return e.option(`key-rotation-interval-days`,{type:`number`,description:`The number of days between key rotations.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Lt={command:`update`,describe:`Updates the Access key rotation settings for an account.`,builder:It,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access keys update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/keys`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({key_rotation_interval_days:r[`key-rotation-interval-days`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.keys.update({...e,account_id:u})),{successLabel:`Updated`});return}if(r[`key-rotation-interval-days`]===void 0)throw Error(`--key-rotation-interval-days is required (or pass --body with this field set).`);let f=d({key_rotation_interval_days:r[`key-rotation-interval-days`]});o(await c(`Updating`,async()=>i.zeroTrust.access.keys.update({...f,account_id:u})),{successLabel:`Updated`})}},Rt={command:`keys`,describe:`Operations for access.keys`,builder:e=>e.command(Nt).command(Ft).command(Lt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function zt(e){return e.option(`limit`,{type:`number`,description:`The maximum number of log entries to retrieve.`}).option(`direction`,{type:`string`,description:`The chronological sorting order for the logs.`,choices:[`desc`,`asc`]}).option(`since`,{type:`string`,description:`The earliest event timestamp to query.`}).option(`until`,{type:`string`,description:`The latest event timestamp to query.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`email`,{type:`string`,description:"Filter by user email. Match mode is controlled by `emailOp` (preferred) or the legacy `email_exact` flag.\n- Default (no `emailOp`, `email_exact=false` or unset): substring match — `email=@example.com` returns all events with that domain.\n- Exact match: set `emailOp=eq` (preferred) or `email_exact=true` — e.g. `email=user@example.com&email_exact=true` returns only that user.\n- Explicit substring match: set `emailOp=contains` (without `email_exact=true`). When both are set, `email_exact=true` takes precedence and the match is exact.\n- Exclusion: set `emailOp=neq`. With `email_exact=true` this is an exact-value exclusion; without it, a fuzzy substring exclusion."}).option(`email-exact`,{type:`boolean`,description:"When true, `email` is matched exactly instead of substring matching."}).option(`user-id`,{type:`string`,description:"Deprecated. Accepted for backward compatibility but no longer applied\nas a filter. Use `email` instead."}).option(`allowed-op`,{type:`string`,description:"Operator for the `allowed` filter.",choices:[`eq`,`neq`]}).option(`country-code-op`,{type:`string`,description:"Operator for the `country_code` filter.",choices:[`eq`,`neq`]}).option(`app-type-op`,{type:`string`,description:"Operator for the `app_type` filter.",choices:[`eq`,`neq`]}).option(`app-uid-op`,{type:`string`,description:"Operator for the `app_uid` filter.",choices:[`eq`,`neq`]}).option(`ray-id-op`,{type:`string`,description:"Operator for the `ray_id` filter.",choices:[`eq`,`neq`]}).option(`email-op`,{type:`string`,description:"Operator for the `email` filter.\n`contains` performs a substring (case-sensitive) match. When `email_exact=true`\nis also set, `email_exact` takes precedence and `contains` is ignored.",choices:[`eq`,`neq`,`contains`]}).option(`idp-op`,{type:`string`,description:"Operator for the `idp` filter.",choices:[`eq`,`neq`]}).option(`non-identity-op`,{type:`string`,description:"Operator for the `non_identity` filter.",choices:[`eq`,`neq`]}).option(`user-id-op`,{type:`string`,description:"Deprecated. Accepted for backward compatibility but no longer applied\nas a filter (the `user_id` parameter is itself deprecated).",choices:[`eq`,`neq`]}).option(`fields`,{type:`string`,description:`Comma-separated list of fields to include in the response.
-When omitted, all fields are returned.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bt={command:`list`,describe:`Gets a list of Access authentication audit logs for an account.`,builder:_(zt),handler:async r=>{let i={limit:r.limit,direction:r.direction,since:r.since,until:r.until,page:r.page,per_page:r[`per-page`],email:r.email,email_exact:r[`email-exact`],user_id:r[`user-id`],allowedOp:r[`allowed-op`],country_codeOp:r[`country-code-op`],app_typeOp:r[`app-type-op`],app_uidOp:r[`app-uid-op`],ray_idOp:r[`ray-id-op`],emailOp:r[`email-op`],idpOp:r[`idp-op`],non_identityOp:r[`non-identity-op`],user_idOp:r[`user-id-op`],fields:r.fields};if(r.dryRun){s({command:`cf zero-trust access logs access-requests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/logs/access_requests`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.logs.accessRequests.list({account_id:u,...i})),{successLabel:`Loaded`})}},Vt={command:`access-requests`,describe:`Operations for access.logs.access-requests`,builder:e=>e.command(Bt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ht(e){return e.positional(`knock-request-id`,{type:`string`,description:`Knock request ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ut={command:`get <knock-request-id>`,describe:`Gets an account-scoped Access JIT request summary and its lifecycle events in chronological order.`,builder:Ht,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access logs jit-requests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/logs/jit_requests/${r[`knock-request-id`]==null?`<knock-request-id>`:encodeURIComponent(String(r[`knock-request-id`]))}`,pathParams:{"knock-request-id":String(r[`knock-request-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.logs.jitRequests.get({account_id:l,knock_request_id:r[`knock-request-id`]})),{successLabel:`Loaded`})}};function Wt(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`status`,{type:`string`,description:"JIT request status. `SPENT` is deprecated and interpreted as `APPROVED`.",choices:[`PENDING`,`APPROVED`,`DENIED`,`CANCELED`,`SPENT`]}).option(`search`,{type:`string`,description:`Case-insensitive search over request ID, requester email, application audience, and application hostname.`}).option(`since`,{type:`string`,description:`The earliest request timestamp to query. Defaults to 366 days before the current time.`}).option(`until`,{type:`string`,description:`The latest request timestamp to query. Defaults to the current time.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gt={command:`list`,describe:`Lists account-wide Access JIT request logs reconstructed from request lifecycle events.`,builder:_(Wt),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],status:r.status,search:r.search,since:r.since,until:r.until};if(r.dryRun){s({command:`cf zero-trust access logs jit-requests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/logs/jit_requests`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.logs.jitRequests.list({account_id:u,...i})),{successLabel:`Loaded`})}},Kt={command:`jit-requests`,describe:`Operations for access.logs.jit-requests`,builder:e=>e.command(Ut).command(Gt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function qt(e){return e.option(`limit`,{type:`number`,description:`The maximum number of update logs to retrieve.`}).option(`direction`,{type:`string`,description:`The chronological order used to sort the logs.`,choices:[`desc`,`asc`]}).option(`since`,{type:`string`,description:`the timestamp of the earliest update log.`}).option(`until`,{type:`string`,description:`the timestamp of the most-recent update log.`}).option(`idp-id`,{type:`string`,description:`The unique Id of the IdP that has SCIM enabled.`,demandOption:!0}).option(`status`,{type:`string`,description:`The status of the SCIM request.`}).option(`resource-type`,{type:`string`,description:`The resource type of the SCIM request.`}).option(`request-method`,{type:`string`,description:`The request method of the SCIM request.`}).option(`resource-user-email`,{type:`string`,description:"The email address of the SCIM User resource. Pass once for a single\nlookup (`?resource_user_email=A`) or repeat the parameter\n(`?resource_user_email=A&resource_user_email=B`) to filter by multiple\nemails in one request."}).option(`resource-group-name`,{type:`string`,description:"The display name of the SCIM Group resource. Pass once for a single\nlookup (`?resource_group_name=A`) or repeat the parameter\n(`?resource_group_name=A&resource_group_name=B`) to filter by multiple\ngroup names in one request."}).option(`cf-resource-id`,{type:`string`,description:"The unique Cloudflare-generated Id of the SCIM resource. Pass once for\na single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to filter by multiple resources\nin one request."}).option(`idp-resource-id`,{type:`string`,description:"The IdP-generated Id of the SCIM resource. Pass once for a single\nlookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to filter by multiple\nresources in one request."}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jt={command:`list`,describe:`Lists Access SCIM update logs that maintain a record of updates made to User and Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:_(qt),handler:async r=>{let i={limit:r.limit,direction:r.direction,since:r.since,until:r.until,idp_id:r[`idp-id`],status:r.status,resource_type:r[`resource-type`],request_method:r[`request-method`],resource_user_email:r[`resource-user-email`],resource_group_name:r[`resource-group-name`],cf_resource_id:r[`cf-resource-id`],idp_resource_id:r[`idp-resource-id`],page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access logs scim updates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/logs/scim/updates`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.logs.scim.updates.list({account_id:u,...i})),{successLabel:`Loaded`})}},Yt={command:`updates`,describe:`Operations for access.logs.scim.updates`,builder:e=>e.command(Jt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Xt={command:`scim`,describe:`Operations for access.logs.scim`,builder:e=>e.command(Yt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Zt={command:`logs`,describe:`Operations for access.logs`,builder:e=>e.command(Vt).command(Kt).command(Xt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qt(e){return e.option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const $t={command:`create`,describe:`Creates a new Access reusable policy.`,builder:Qt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policies`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({decision:f(r.decision,`decision`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.policies.create({body:e,account_id:u})),{successLabel:`Created`});return}r.decision===void 0&&(r.decision=await h(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),r.name===void 0&&(r.name=await m(`name`,`The name of the Access policy.`));let p=d({decision:f(r.decision,`decision`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.policies.create({body:p,account_id:u})),{successLabel:`Created`})}};function en(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const tn={command:`delete <policy-id>`,describe:`Deletes an Access reusable policy.`,builder:en,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policies/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.policies.delete({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Deleted`})}};function nn(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const rn={command:`get <policy-id>`,describe:`Fetches a single Access reusable policy.`,builder:nn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policies/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.policies.get({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Loaded`})}};function an(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const on={command:`list`,describe:`Lists Access reusable policies.`,builder:an,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policies`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.policies.list({account_id:u,...i})),{successLabel:`Loaded`})}};function sn(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const cn={command:`update <policy-id>`,describe:`Updates a Access reusable policy.`,builder:sn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policies/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({decision:f(r.decision,`decision`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.policies.update({body:e,account_id:u,policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}r.decision===void 0&&(r.decision=await h(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),r.name===void 0&&(r.name=await m(`name`,`The name of the Access policy.`));let p=d({decision:f(r.decision,`decision`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.access.policies.update({body:p,account_id:u,policy_id:r[`policy-id`]})),{successLabel:`Updated`})}},ln={command:`policies`,describe:`Operations for access.policies`,builder:e=>e.command($t).command(tn).command(rn).command(on).command(cn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function un(e){return e.positional(`saml-cert-set-id`,{type:`string`,description:`UID of the SAML certificate set.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dn={command:`get-pem <saml-cert-set-id>`,describe:`Downloads the current SAML encryption certificate's public key in PEM format for the specified certificate set. This endpoint is useful for providing the certificate to Identity Providers for SAML assertion encryption configuration.`,builder:un,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access saml-certificates get-pem`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/saml_certificates/${r[`saml-cert-set-id`]==null?`<saml-cert-set-id>`:encodeURIComponent(String(r[`saml-cert-set-id`]))}/pem`,pathParams:{"saml-cert-set-id":String(r[`saml-cert-set-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.samlCertificates.getPem({account_id:l,saml_cert_set_id:r[`saml-cert-set-id`]})),{successLabel:`Loaded`})}};function fn(e){return e.positional(`saml-cert-set-id`,{type:`string`,description:`UID of the SAML certificate set.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pn={command:`get <saml-cert-set-id>`,describe:`Retrieves a specific SAML encryption certificate set by its UID, including both current and previous certificates if available.`,builder:fn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access saml-certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/saml_certificates/${r[`saml-cert-set-id`]==null?`<saml-cert-set-id>`:encodeURIComponent(String(r[`saml-cert-set-id`]))}`,pathParams:{"saml-cert-set-id":String(r[`saml-cert-set-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.samlCertificates.get({account_id:l,saml_cert_set_id:r[`saml-cert-set-id`]})),{successLabel:`Loaded`})}};function mn(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`per-page`,{type:`number`,description:`Maximum number of results per page.`}).option(`id`,{type:`string`,description:`Filter by SAML certificate set UID. Accepts a comma-separated list of UIDs.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const hn={command:`list`,describe:`Returns a paginated list of the organization's SAML encryption certificate sets. Each certificate set includes the current and (if present) previous certificates.`,builder:mn,handler:async r=>{let i={page:r.page,per_page:r[`per-page`],id:r.id};if(r.dryRun){s({command:`cf zero-trust access saml-certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/saml_certificates`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.samlCertificates.list({account_id:u,...i})),{successLabel:`Loaded`})}};function gn(e){return e.positional(`saml-cert-set-id`,{type:`string`,description:`UID of the SAML certificate set to rotate.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _n={command:`rotate <saml-cert-set-id>`,describe:`Rotates the SAML encryption certificates within the specified certificate set. This generates a new certificate and moves the current certificate to the previous slot. If a previous certificate exists, it will be deactivated and removed. This endpoint ensures zero-downtime rotation by maintaining both current and previous certificates during the transition period, allowing IdPs time to update their configurations. Automated rotation happens 30 days before a current certificate's expiration.`,builder:gn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access saml-certificates rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/saml_certificates/${r[`saml-cert-set-id`]==null?`<saml-cert-set-id>`:encodeURIComponent(String(r[`saml-cert-set-id`]))}/rotate`,pathParams:{"saml-cert-set-id":String(r[`saml-cert-set-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.access.samlCertificates.rotate({account_id:l,saml_cert_set_id:r[`saml-cert-set-id`]})),{successLabel:`Created`})}},vn={command:`saml-certificates`,describe:`Operations for access.saml-certificates`,builder:e=>e.command(pn).command(dn).command(hn).command(_n).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function yn(e){return e.option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.",default:1}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).",default:`8760h`}).option(`enabled`,{type:`boolean`,description:"Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous `client_secret` stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const bn={command:`create`,describe:`Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token.`,builder:yn,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access service-tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/service_tokens`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?d({client_secret_version:i[`client-secret-version`],duration:f(i.duration,`duration`,`text`),enabled:i.enabled,name:f(i.name,`name`,`text`),previous_client_secret_expires_at:f(i[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):l(i.body)});return}let u=await a(i),p=i.zone===void 0?`accounts`:`zones`,h=p===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();if(p===`zones`?i.zoneId=h:i.accountId=h,i.body){let e=l(i.body);o(await c(`Creating`,async()=>u.zeroTrust.access.serviceTokens.create({...e,account_or_zone:p,account_or_zone_id:h})),{successLabel:`Created`});return}i.name===void 0&&(i.name=await m(`name`,`The name of the service token.`));let g=d({client_secret_version:i[`client-secret-version`],duration:f(i.duration,`duration`,`text`),enabled:i.enabled,name:f(i.name,`name`,`text`),previous_client_secret_expires_at:f(i[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});o(await c(`Creating`,async()=>u.zeroTrust.access.serviceTokens.create({...g,account_or_zone:p,account_or_zone_id:h})),{successLabel:`Created`})}};function xn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Sn={command:`delete <service-token-id>`,describe:`Deletes a service token.`,builder:xn,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access service-tokens delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/service_tokens/${i[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(i[`service-token-id`]))}`,pathParams:{"account-or-zone":String(t),"service-token-id":String(i[`service-token-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(u===`zones`?i.zoneId=d:i.accountId=d,!await g({force:!!i.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>l.zeroTrust.access.serviceTokens.delete({account_or_zone:u,account_or_zone_id:d,service_token_id:i[`service-token-id`]})),{successLabel:`Deleted`})}};function Cn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wn={command:`get <service-token-id>`,describe:`Fetches a single service token.`,builder:Cn,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access service-tokens get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/service_tokens/${i[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(i[`service-token-id`]))}`,pathParams:{"account-or-zone":String(t),"service-token-id":String(i[`service-token-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.access.serviceTokens.get({account_or_zone:u,account_or_zone_id:d,service_token_id:i[`service-token-id`]})),{successLabel:`Loaded`})}};function Tn(e){return e.option(`name`,{type:`string`,description:`The name of the service token.`}).option(`search`,{type:`string`,description:`Search for service tokens by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const En={command:`list`,describe:`Lists all service tokens.`,builder:Tn,handler:async i=>{let l={name:i.name,search:i.search,page:i.page,per_page:i[`per-page`]};if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access service-tokens list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/service_tokens`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},query:l,bodyKind:`none`});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();d===`zones`?i.zoneId=f:i.accountId=f,o(await c(`Loading`,async()=>u.zeroTrust.access.serviceTokens.list({account_or_zone:d,account_or_zone_id:f,...l})),{successLabel:`Loaded`})}};function Dn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const On={command:`refresh <service-token-id>`,describe:`Refreshes the expiration of a service token.`,builder:Dn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access service-tokens refresh`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/service_tokens/${r[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(r[`service-token-id`]))}/refresh`,pathParams:{"service-token-id":String(r[`service-token-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.access.serviceTokens.refresh({account_id:l,service_token_id:r[`service-token-id`]})),{successLabel:`Created`})}};function kn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. If not provided, it defaults to the current timestamp in order to immediately expire the previous secret."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const An={command:`rotate <service-token-id>`,describe:`Generates a new Client Secret for a service token and revokes the old one.`,builder:kn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access service-tokens rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/service_tokens/${r[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(r[`service-token-id`]))}/rotate`,pathParams:{"service-token-id":String(r[`service-token-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({previous_client_secret_expires_at:f(r[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.serviceTokens.rotate({...e,account_id:u,service_token_id:r[`service-token-id`]})),{successLabel:`Created`});return}let p=d({previous_client_secret_expires_at:f(r[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.serviceTokens.rotate({...p,account_id:u,service_token_id:r[`service-token-id`]})),{successLabel:`Created`})}};function jn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`."}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h)."}).option(`enabled`,{type:`boolean`,description:"Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous `client_secret` stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Mn={command:`update <service-token-id>`,describe:`Updates a configured service token.`,builder:jn,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access service-tokens update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/service_tokens/${i[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(i[`service-token-id`]))}`,pathParams:{"account-or-zone":String(t),"service-token-id":String(i[`service-token-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?d({client_secret_version:i[`client-secret-version`],duration:f(i.duration,`duration`,`text`),enabled:i.enabled,name:f(i.name,`name`,`text`),previous_client_secret_expires_at:f(i[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):l(i.body)});return}let u=await a(i),p=i.zone===void 0?`accounts`:`zones`,m=p===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();if(p===`zones`?i.zoneId=m:i.accountId=m,i.body){let e=l(i.body);o(await c(`Updating`,async()=>u.zeroTrust.access.serviceTokens.update({...e,account_or_zone:p,account_or_zone_id:m,service_token_id:i[`service-token-id`]})),{successLabel:`Updated`});return}let h=d({client_secret_version:i[`client-secret-version`],duration:f(i.duration,`duration`,`text`),enabled:i.enabled,name:f(i.name,`name`,`text`),previous_client_secret_expires_at:f(i[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});o(await c(`Updating`,async()=>u.zeroTrust.access.serviceTokens.update({...h,account_or_zone:p,account_or_zone_id:m,service_token_id:i[`service-token-id`]})),{successLabel:`Updated`})}},Nn={command:`service-tokens`,describe:`Operations for access.service-tokens`,builder:e=>e.command(bn).command(Sn).command(wn).command(En).command(On).command(An).command(Mn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Pn(e){return e.option(`name`,{type:`string`,description:`The name of the tag`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Fn={command:`create`,describe:`Create a tag`,builder:Pn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access tags create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/tags`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.tags.create({...e,account_id:u})),{successLabel:`Created`});return}let p=d({name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.tags.create({...p,account_id:u})),{successLabel:`Created`})}};function In(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ln={command:`delete <tag-name>`,describe:`Delete a tag`,builder:In,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access tags delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/tags/${r[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(r[`tag-name`]))}`,pathParams:{"tag-name":String(r[`tag-name`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.tags.delete({account_id:l,tag_name:r[`tag-name`]})),{successLabel:`Deleted`})}};function Rn(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zn={command:`get <tag-name>`,describe:`Get a tag`,builder:Rn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access tags get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/tags/${r[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(r[`tag-name`]))}`,pathParams:{"tag-name":String(r[`tag-name`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.tags.get({account_id:l,tag_name:r[`tag-name`]})),{successLabel:`Loaded`})}};function Bn(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vn={command:`list`,describe:`List tags`,builder:Bn,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access tags list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/tags`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.tags.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Hn(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`name`,{type:`string`,description:`The name of the tag`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A tag`})}const Un={command:`update <tag-name>`,describe:`Update a tag`,builder:Hn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access tags update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/tags/${r[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(r[`tag-name`]))}`,pathParams:{"tag-name":String(r[`tag-name`]??``)},bodyKind:`json`,body:r.body===void 0?d({name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.tags.update({...e,account_id:u,tag_name:r[`tag-name`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await m(`name`,`The name of the tag`));let p=d({name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.access.tags.update({...p,account_id:u,tag_name:r[`tag-name`]})),{successLabel:`Updated`})}},Wn={command:`tags`,describe:`Operations for access.tags`,builder:e=>e.command(Fn).command(Ln).command(zn).command(Vn).command(Un).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Gn(e){return e.positional(`nonce`,{type:`string`,description:`Nonce`,demandOption:!0}).option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kn={command:`get <nonce>`,describe:`Get an active session for a single user.`,builder:Gn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users active-sessions get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/active_sessions/${r.nonce==null?`<nonce>`:encodeURIComponent(String(r.nonce))}`,pathParams:{"user-id":String(r[`user-id`]??``),nonce:String(r.nonce??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.users.activeSessions.get({account_id:l,user_id:r[`user-id`],nonce:r.nonce})),{successLabel:`Loaded`})}};function qn(e){return e.option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jn={command:`list`,describe:`Get active sessions for a single user.`,builder:qn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users active-sessions list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/active_sessions`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.users.activeSessions.list({account_id:l,user_id:r[`user-id`]})),{successLabel:`Loaded`})}},Yn={command:`active-sessions`,describe:`Operations for access.users.active-sessions`,builder:e=>e.command(Kn).command(Jn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Xn(e){return e.option(`email`,{type:`string`,description:`The email of the user.`}).option(`name`,{type:`string`,description:`The name of the user.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Zn={command:`create`,describe:`Creates a new user.`,builder:Xn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({email:f(r.email,`email`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.users.create({...e,account_id:u})),{successLabel:`Created`});return}r.email===void 0&&(r.email=await m(`email`,`The email of the user.`));let p=d({email:f(r.email,`email`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.users.create({...p,account_id:u})),{successLabel:`Created`})}};function Qn(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const $n={command:`delete <user-id>`,describe:`Deletes a specific user for an account. This will also revoke any active seats and tokens for the user.`,builder:Qn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.users.delete({account_id:l,user_id:r[`user-id`]})),{successLabel:`Deleted`})}};function er(e){return e.option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const tr={command:`list`,describe:`Get all failed login attempts for a single user.`,builder:er,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users failed-logins list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/failed_logins`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.users.failedLogins.list({account_id:l,user_id:r[`user-id`]})),{successLabel:`Loaded`})}},nr={command:`failed-logins`,describe:`Operations for access.users.failed-logins`,builder:e=>e.command(tr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function rr(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ir={command:`get <user-id>`,describe:`Gets a specific user for an account.`,builder:rr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.users.get({account_id:l,user_id:r[`user-id`]})),{successLabel:`Loaded`})}};function ar(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const or={command:`get <user-id>`,describe:`Get last seen identity for a single user.`,builder:ar,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users last-seen-identity get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/last_seen_identity`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.users.lastSeenIdentity.get({account_id:l,user_id:r[`user-id`]})),{successLabel:`Loaded`})}},sr={command:`last-seen-identity`,describe:`Operations for access.users.last-seen-identity`,builder:e=>e.command(or).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cr(e){return e.option(`name`,{type:`string`,description:`The name of the user.`}).option(`email`,{type:`string`,description:`The email of the user.`}).option(`search`,{type:`string`,description:`Search for users by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lr={command:`list`,describe:`Gets a list of users for an account.`,builder:cr,handler:async r=>{let i={name:r.name,email:r.email,search:r.search,page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.users.list({account_id:u,...i})),{successLabel:`Loaded`})}};function ur(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`email`,{type:`string`,description:`The email of the user.`}).option(`name`,{type:`string`,description:`The name of the user.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const dr={command:`update <user-id>`,describe:`Updates a specific user's name for an account. Requires the user's current email as confirmation (email cannot be changed).`,builder:ur,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({email:f(r.email,`email`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.users.update({...e,account_id:u,user_id:r[`user-id`]})),{successLabel:`Updated`});return}r.email===void 0&&(r.email=await m(`email`,`The email of the user.`)),r.name===void 0&&(r.name=await m(`name`,`The name of the user.`));let p=d({email:f(r.email,`email`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.access.users.update({...p,account_id:u,user_id:r[`user-id`]})),{successLabel:`Updated`})}},fr={command:`users`,describe:`Operations for access.users`,builder:e=>e.command(Zn).command($n).command(ir).command(lr).command(dr).command(Yn).command(nr).command(sr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},pr={command:`access`,describe:`Operations for access`,builder:e=>e.command(he).command(ve).command(ke).command(Ge).command(it).command(dt).command(St).command(jt).command(Rt).command(Zt).command(ln).command(vn).command(Nn).command(Wn).command(fr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function mr(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const hr={command:`update <policy-id>`,describe:`Converts an application-scoped policy to a reusable policy. The policy will no longer be exclusively scoped to the application. Further updates to the policy should go through the /accounts/{account_id}/policies/{uid} endpoint.`,builder:mr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust apps policies make reusable update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}/policies/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/make_reusable`,pathParams:{"app-id":String(r[`app-id`]??``),"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Updating`,async()=>i.zeroTrust.apps.policies.make.reusable.update({account_id:l,app_id:r[`app-id`],policy_id:r[`policy-id`]})),{successLabel:`Updated`})}},gr={command:`reusable`,describe:`Operations for apps.policies.make.reusable`,builder:e=>e.command(hr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},_r={command:`make`,describe:`Operations for apps.policies.make`,builder:e=>e.command(gr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},vr={command:`policies`,describe:`Operations for apps.policies`,builder:e=>e.command(_r).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function yr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const br={command:`list`,describe:`Retrieve the statuses of your applications.`,builder:yr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust apps review status list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/apps/review_status`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.apps.review.status.list({account_id:l})),{successLabel:`Loaded`})}};function xr(e){return e.option(`approved-apps`,{type:`string`,array:!0,description:`Contains the ids of the approved applications.`}).option(`in-review-apps`,{type:`string`,array:!0,description:`Contains the ids of the applications in review.`}).option(`unapproved-apps`,{type:`string`,array:!0,description:`Contains the ids of the unapproved applications.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Sr={command:`update`,describe:`Update the statuses of your applications.`,builder:xr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust apps review status update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/apps/review_status`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({approved_apps:r[`approved-apps`],in_review_apps:r[`in-review-apps`],unapproved_apps:r[`unapproved-apps`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.apps.review.status.update({...e,account_id:u})),{successLabel:`Updated`});return}if(r[`approved-apps`]===void 0)throw Error(`--approved-apps is required (or pass --body with this field set).`);if(r[`in-review-apps`]===void 0)throw Error(`--in-review-apps is required (or pass --body with this field set).`);if(r[`unapproved-apps`]===void 0)throw Error(`--unapproved-apps is required (or pass --body with this field set).`);let f=d({approved_apps:r[`approved-apps`],in_review_apps:r[`in-review-apps`],unapproved_apps:r[`unapproved-apps`]});o(await c(`Updating`,async()=>i.zeroTrust.apps.review.status.update({...f,account_id:u})),{successLabel:`Updated`})}},Cr={command:`status`,describe:`Operations for apps.review.status`,builder:e=>e.command(br).command(Sr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},wr={command:`review`,describe:`Operations for apps.review`,builder:e=>e.command(Cr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Tr={command:`apps`,describe:`Operations for apps`,builder:e=>e.command(vr).command(wr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Er(e){return e.option(`application-id`,{type:`string`,description:`Application/vendor identifier.`,demandOption:!0}).option(`page`,{type:`number`,description:`A page number within the paginated result set.`}).option(`page-size`,{type:`number`,description:`Number of results to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dr={command:`list`,describe:`Returns available auth methods for the specified vendor, including credential schema, instructions, and example payloads. Use this to understand what credentials are required before calling POST /v2/integrations.`,builder:_(Er),handler:async r=>{let i={page:r.page,page_size:r[`page-size`]};if(r.dryRun){s({command:`cf zero-trust casb applications authMethods list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/applications/${r[`application-id`]==null?`<application-id>`:encodeURIComponent(String(r[`application-id`]))}/auth-methods`,pathParams:{"application-id":String(r[`application-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.casb.applications.authMethods.list({account_id:u,application_id:r[`application-id`],...i})),{successLabel:`Loaded`})}},Or={command:`authMethods`,describe:`Operations for casb.applications.authMethods`,builder:e=>e.command(Dr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function kr(e){return e.positional(`application-id`,{type:`string`,description:`Application/vendor identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ar={command:`get <application-id>`,describe:`Returns full application details including auth methods, use cases, and permissions.`,builder:_(kr),handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb applications get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/applications/${r[`application-id`]==null?`<application-id>`:encodeURIComponent(String(r[`application-id`]))}`,pathParams:{"application-id":String(r[`application-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.casb.applications.get({account_id:l,application_id:r[`application-id`]})),{successLabel:`Loaded`})}};function jr(e){return e.option(`environment`,{type:`string`,description:`Filter by supported environment (standard, fedramp).`}).option(`page`,{type:`number`,description:`A page number within the paginated result set.`}).option(`page-size`,{type:`number`,description:`Number of results to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Mr={command:`list`,describe:`Returns a list of available applications with use cases and permissions.`,builder:jr,handler:async r=>{let i={environment:r.environment,page:r.page,page_size:r[`page-size`]};if(r.dryRun){s({command:`cf zero-trust casb applications list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/applications`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.casb.applications.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Nr(e){return e.option(`application-id`,{type:`string`,description:`Application/vendor identifier.`,demandOption:!0}).option(`auth-method`,{type:`string`,description:`Filter by auth method id. Get available ids from GET /v2/applications.`}).option(`environment`,{type:`string`,description:`Filter by environment.`,choices:[`fedramp`,`standard`]}).option(`page`,{type:`number`,description:`A page number within the paginated result set.`}).option(`page-size`,{type:`number`,description:`Number of results to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pr={command:`list`,describe:`Returns all available setup flows for the application, one per auth method.`,builder:_(Nr),handler:async r=>{let i={auth_method:r[`auth-method`],environment:r.environment,page:r.page,page_size:r[`page-size`]};if(r.dryRun){s({command:`cf zero-trust casb applications setupFlows list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/applications/${r[`application-id`]==null?`<application-id>`:encodeURIComponent(String(r[`application-id`]))}/setup-flows`,pathParams:{"application-id":String(r[`application-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.casb.applications.setupFlows.list({account_id:u,application_id:r[`application-id`],...i})),{successLabel:`Loaded`})}},Fr={command:`setupFlows`,describe:`Operations for casb.applications.setupFlows`,builder:e=>e.command(Pr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ir={command:`applications`,describe:`Operations for casb.applications`,builder:e=>e.command(Ar).command(Mr).command(Or).command(Fr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Lr(e){return e.option(`application`,{type:`string`,description:"Vendor/application slug (e.g., GOOGLE_WORKSPACE).\n\n* `ANTHROPIC` - ANTHROPIC\n* `AWS` - AWS\n* `BITBUCKET` - BITBUCKET\n* `BOX` - BOX\n* `CONFLUENCE` - CONFLUENCE\n* `DROPBOX` - DROPBOX\n* `GITHUB` - GITHUB\n* `GOOGLE_CLOUD_PLATFORM` - GOOGLE_CLOUD_PLATFORM\n* `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE\n* `JIRA` - JIRA\n* `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL\n* `OPENAI` - OPENAI\n* `SALESFORCE` - SALESFORCE\n* `SERVICENOW` - SERVICENOW\n* `SLACK` - SLACK",choices:[`ANTHROPIC`,`AWS`,`BITBUCKET`,`BOX`,`CONFLUENCE`,`DROPBOX`,`GITHUB`,`GOOGLE_CLOUD_PLATFORM`,`GOOGLE_WORKSPACE`,`JIRA`,`MICROSOFT_INTERNAL`,`OPENAI`,`SALESFORCE`,`SERVICENOW`,`SLACK`]}).option(`auth-method`,{type:`string`,description:`Authentication method slug (uses default if omitted).`}).option(`dlp-profiles`,{type:`string`,array:!0,description:`List of DLP profile IDs to associate.`}).option(`name`,{type:`string`,description:`Name of the integration.`}).option(`permissions`,{type:`string`,array:!0,description:`List of permission scopes (uses policy defaults if empty).`}).option(`use-cases`,{type:`string`,array:!0,description:`List of use case or feature slugs to enroll (e.g., ['casb', 'ces', 'auto_remediation']).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Serializer for v2 integration create requests.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Rr={command:`create`,describe:"Creates a new integration for the specified application. Integration creation with OAuth is not supported by API at the moment. For other auth methods, use `GET /v2/applications/{application_id}/credential-guide` to see the required credential structure and example payloads for each vendor.",builder:Lr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({application:f(r.application,`application`,`text`),auth_method:f(r[`auth-method`],`auth-method`,`text`),dlp_profiles:r[`dlp-profiles`],name:f(r.name,`name`,`text`),permissions:r.permissions,use_cases:r[`use-cases`]}):l(r.body)});return}let g=await a(r),_=r.local?e:await t();if(r.accountId=_,r.file){let e=p(r.file);o(await c(`Creating`,async()=>i(g,`POST`,`/accounts/${_}/one/integrations`,{body:e,headers:{"Content-Type":`text/plain;charset=UTF-8`}})),{successLabel:`Created`});return}if(r.body){let e=l(r.body);o(await c(`Creating`,async()=>i(g,`POST`,`/accounts/${_}/one/integrations`,{body:e})),{successLabel:`Created`});return}r.application===void 0&&(r.application=await h(`application`,"Vendor/application slug (e.g., GOOGLE_WORKSPACE).  * `ANTHROPIC` - ANTHROPIC * `AWS` - AWS * `BITBUCKET` - BITBUCKET * `BOX` - BOX * `CONFLUENCE` - CONFLUENCE * `DROPBOX` - DROPBOX * `GITHUB` - GITHUB * `GOOGLE_CLOUD_PLATFORM` - GOOGLE_CLOUD_PLATFORM * `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE * `JIRA` - JIRA * `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL * `OPENAI` - OPENAI * `SALESFORCE` - SALESFORCE * `SERVICENOW` - SERVICENOW * `SLACK` - SLACK",[`ANTHROPIC`,`AWS`,`BITBUCKET`,`BOX`,`CONFLUENCE`,`DROPBOX`,`GITHUB`,`GOOGLE_CLOUD_PLATFORM`,`GOOGLE_WORKSPACE`,`JIRA`,`MICROSOFT_INTERNAL`,`OPENAI`,`SALESFORCE`,`SERVICENOW`,`SLACK`])),r.name===void 0&&(r.name=await m(`name`,`Name of the integration.`));let v={};r.application!==void 0&&u(v,[`application`],f(r.application,`application`,`text`)),r[`auth-method`]!==void 0&&u(v,[`auth_method`],f(r[`auth-method`],`auth-method`,`text`)),r[`dlp-profiles`]!==void 0&&u(v,[`dlp_profiles`],r[`dlp-profiles`]),r.name!==void 0&&u(v,[`name`],f(r.name,`name`,`text`)),r.permissions!==void 0&&u(v,[`permissions`],r.permissions),r[`use-cases`]!==void 0&&u(v,[`use_cases`],r[`use-cases`]),o(await c(`Creating`,async()=>i(g,`POST`,`/accounts/${_}/one/integrations`,{body:Object.keys(v).length>0?v:void 0})),{successLabel:`Created`})}};function zr(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Br={command:`delete <id>`,describe:`Delete an integration by soft-deleting it.`,builder:zr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations/${r.id==null?`<id>`:encodeURIComponent(String(r.id))}`,pathParams:{id:String(r.id??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.casb.integrations.delete({account_id:l,id:r.id})),{successLabel:`Deleted`})}};function Vr(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Hr={command:`get <id>`,describe:`Returns full integration details including use cases and permissions.`,builder:Vr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations/${r.id==null?`<id>`:encodeURIComponent(String(r.id))}`,pathParams:{id:String(r.id??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.casb.integrations.get({account_id:l,id:r.id})),{successLabel:`Loaded`})}};function Ur(e){return e.option(`application`,{type:`string`,description:`Filter by application/vendor (e.g., GOOGLE_WORKSPACE, MICROSOFT_INTERNAL).`}).option(`direction`,{type:`string`,description:`Direction to order results.`,choices:[`asc`,`desc`]}).option(`dlp-enabled`,{type:`boolean`,description:`Filter by DLP enabled status (true/false).`}).option(`order`,{type:`string`,description:`Field to order results by.`,choices:[`application`,`created`,`name`,`status`]}).option(`page`,{type:`number`,description:`Page number within the paginated result set.`}).option(`page-size`,{type:`number`,description:`Number of results per page.`}).option(`search`,{type:`string`,description:`Search integrations by name or application.`}).option(`status`,{type:`string`,description:`Filter by integration status.`,choices:[`Healthy`,`Initializing`,`Offline`,`Unhealthy`]}).option(`use-cases`,{type:`string`,description:`Filter by enabled use cases (e.g., casb, ces). Matches integrations enrolled in any of the specified values. Can be specified multiple times.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Wr={command:`list`,describe:`Returns a paginated list of integrations for the account.`,builder:_(Ur),handler:async r=>{let i={application:r.application,direction:r.direction,dlp_enabled:r[`dlp-enabled`],order:r.order,page:r.page,page_size:r[`page-size`],search:r.search,status:r.status,use_cases:r[`use-cases`]};if(r.dryRun){s({command:`cf zero-trust casb integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.casb.integrations.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Gr(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kr={command:`pause <id>`,describe:`Pauses an integration, stopping all crawlers.`,builder:Gr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations pause`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations/${r.id==null?`<id>`:encodeURIComponent(String(r.id))}/pause`,pathParams:{id:String(r.id??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.casb.integrations.pause({account_id:l,id:r.id})),{successLabel:`Created`})}};function qr(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jr={command:`resume <id>`,describe:`Resumes a paused integration, restarting crawlers.`,builder:qr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations resume`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations/${r.id==null?`<id>`:encodeURIComponent(String(r.id))}/resume`,pathParams:{id:String(r.id??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.casb.integrations.resume({account_id:l,id:r.id})),{successLabel:`Created`})}};function Yr(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dlp-profiles`,{type:`string`,array:!0,description:`List of DLP profile IDs to associate with the integration.`}).option(`name`,{type:`string`,description:`Name of the integration.`}).option(`permissions`,{type:`string`,array:!0,description:`List of permission scopes granted to the integration.`}).option(`use-cases`,{type:`string`,array:!0,description:`List of use case or feature slugs to enroll (e.g., ['casb', 'ces', 'auto_remediation']).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Serializer for v2 integration PATCH requests.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Xr={command:`update <id>`,describe:`Updates an integration's name, permissions, DLP profiles, use cases, or credentials.`,builder:Yr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations/${r.id==null?`<id>`:encodeURIComponent(String(r.id))}`,pathParams:{id:String(r.id??``)},bodyKind:`json`,body:r.body===void 0?d({dlp_profiles:r[`dlp-profiles`],name:f(r.name,`name`,`text`),permissions:r.permissions,use_cases:r[`use-cases`]}):l(r.body)});return}let m=await a(r),h=r.local?e:await t();if(r.accountId=h,r.file){let e=p(r.file);o(await c(`Updating`,async()=>i(m,`PATCH`,`/accounts/${h}/one/integrations/${encodeURIComponent(String(r.id))}`,{body:e,headers:{"Content-Type":`text/plain;charset=UTF-8`}})),{successLabel:`Updated`});return}if(r.body){let e=l(r.body);o(await c(`Updating`,async()=>i(m,`PATCH`,`/accounts/${h}/one/integrations/${encodeURIComponent(String(r.id))}`,{body:e})),{successLabel:`Updated`});return}let g={};r[`dlp-profiles`]!==void 0&&u(g,[`dlp_profiles`],r[`dlp-profiles`]),r.name!==void 0&&u(g,[`name`],f(r.name,`name`,`text`)),r.permissions!==void 0&&u(g,[`permissions`],r.permissions),r[`use-cases`]!==void 0&&u(g,[`use_cases`],r[`use-cases`]),o(await c(`Updating`,async()=>i(m,`PATCH`,`/accounts/${h}/one/integrations/${encodeURIComponent(String(r.id))}`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Updated`})}},Zr={command:`integrations`,describe:`Operations for casb.integrations`,builder:e=>e.command(Rr).command(Br).command(Hr).command(Wr).command(Kr).command(Jr).command(Xr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Qr={command:`casb`,describe:`Operations for casb`,builder:e=>e.command(Ir).command(Zr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $r(e){return e.option(`icmp-proxy-enabled`,{type:`boolean`,description:`A flag to enable the ICMP proxy for the account network.`}).option(`offramp-warp-enabled`,{type:`boolean`,description:`A flag to enable WARP to WARP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ei={command:`edit`,describe:`Updates the Zero Trust Connectivity Settings for the given account.`,builder:$r,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust connectivity-settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zerotrust/connectivity_settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({icmp_proxy_enabled:r[`icmp-proxy-enabled`],offramp_warp_enabled:r[`offramp-warp-enabled`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.connectivitySettings.edit({...e,account_id:u})),{successLabel:`Updated`});return}let f=d({icmp_proxy_enabled:r[`icmp-proxy-enabled`],offramp_warp_enabled:r[`offramp-warp-enabled`]});o(await c(`Updating`,async()=>i.zeroTrust.connectivitySettings.edit({...f,account_id:u})),{successLabel:`Updated`})}};function ti(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ni={command:`get`,describe:`Gets the Zero Trust Connectivity Settings for the given account.`,builder:ti,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust connectivity-settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zerotrust/connectivity_settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.connectivitySettings.get({account_id:l})),{successLabel:`Loaded`})}},ri={command:`connectivity-settings`,describe:`Operations for connectivity-settings`,builder:e=>e.command(ei).command(ni).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ii(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ai={command:`list`,describe:`Retrieves a list of all available target environments with their display names. This endpoint is in Beta.`,builder:ii,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices client target environments list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/client-versions/target-environments`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.client.target.environments.list({account_id:l})),{successLabel:`Loaded`})}},oi={command:`environments`,describe:`Operations for devices.client.target.environments`,builder:e=>e.command(ai).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},si={command:`target`,describe:`Operations for devices.client.target`,builder:e=>e.command(oi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ci(e){return e.option(`target-environment`,{type:`string`,description:`The target environment for the client version (e.g., windows, macos).`,demandOption:!0}).option(`release-track`,{type:`string`,description:`The release track (ga for General Availability, beta for Beta releases).`,choices:[`ga`,`beta`],demandOption:!0}).option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The maximum number of versions to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const li={command:`list`,describe:`Lists available WARP client versions for a specific target environment and release track. This endpoint is in Beta.`,builder:_(ci),handler:async r=>{let i={target_environment:r[`target-environment`],release_track:r[`release-track`],page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust devices client versions list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/client-versions`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.client.versions.list({account_id:u,...i})),{successLabel:`Loaded`})}},ui={command:`versions`,describe:`Operations for devices.client.versions`,builder:e=>e.command(li).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},di={command:`client`,describe:`Operations for devices.client`,builder:e=>e.command(si).command(ui).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function fi(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const pi={command:`delete <device-id>`,describe:`Deletes a WARP device.`,builder:fi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/physical-devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}`,pathParams:{"device-id":String(r[`device-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.delete({account_id:l,device_id:r[`device-id`]})),{successLabel:`Deleted`})}};function mi(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for the deployment group.`}).option(`policy-ids`,{type:`string`,array:!0,description:`Contains an optional list of policy IDs assigned to a group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const hi={command:`create`,describe:`Creates a new deployment group. Policy IDs must be unique across all deployment groups. This endpoint is in Beta.`,builder:mi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices deployment groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/deployment-groups`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({name:f(r.name,`name`,`text`),policy_ids:r[`policy-ids`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.deployment.groups.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`A user-friendly name for the deployment group.`));let p=d({name:f(r.name,`name`,`text`),policy_ids:r[`policy-ids`]});o(await c(`Creating`,async()=>i.zeroTrust.devices.deployment.groups.create({...p,account_id:u})),{successLabel:`Created`})}};function gi(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const _i={command:`delete <group-id>`,describe:`Deletes a deployment group. Associated policies no longer apply and devices stop receiving version targets. This endpoint is in Beta.`,builder:gi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices deployment groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/deployment-groups/${r[`group-id`]==null?`<group-id>`:encodeURIComponent(String(r[`group-id`]))}`,pathParams:{"group-id":String(r[`group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.deployment.groups.delete({account_id:l,group_id:r[`group-id`]})),{successLabel:`Deleted`})}};function vi(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yi={command:`get <group-id>`,describe:`Fetches a single deployment group by its ID. This endpoint is in Beta.`,builder:vi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices deployment groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/deployment-groups/${r[`group-id`]==null?`<group-id>`:encodeURIComponent(String(r[`group-id`]))}`,pathParams:{"group-id":String(r[`group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.deployment.groups.get({account_id:l,group_id:r[`group-id`]})),{successLabel:`Loaded`})}};function bi(e){return e.option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The maximum number of deployment groups to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xi={command:`list`,describe:`Lists all deployment groups for an account. Use deployment groups to assign target WARP client versions to specific devices. This endpoint is in Beta.`,builder:bi,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust devices deployment groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/deployment-groups`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.deployment.groups.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Si(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for the deployment group.`}).option(`policy-ids`,{type:`string`,array:!0,description:`Replaces the entire list of policy IDs.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ci={command:`update <group-id>`,describe:`Updates a deployment group. Returns 409 if any newly added policy IDs already belong to another deployment group. This endpoint is in Beta.`,builder:Si,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices deployment groups update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/deployment-groups/${r[`group-id`]==null?`<group-id>`:encodeURIComponent(String(r[`group-id`]))}`,pathParams:{"group-id":String(r[`group-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({name:f(r.name,`name`,`text`),policy_ids:r[`policy-ids`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.deployment.groups.update({...e,account_id:u,group_id:r[`group-id`]})),{successLabel:`Updated`});return}let p=d({name:f(r.name,`name`,`text`),policy_ids:r[`policy-ids`]});o(await c(`Updating`,async()=>i.zeroTrust.devices.deployment.groups.update({...p,account_id:u,group_id:r[`group-id`]})),{successLabel:`Updated`})}},wi={command:`groups`,describe:`Operations for devices.deployment.groups`,builder:e=>e.command(hi).command(_i).command(yi).command(xi).command(Ci).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ti={command:`deployment`,describe:`Operations for devices.deployment`,builder:e=>e.command(wi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ei(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the device response. Supported values are: "last_seen_registration.policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Di={command:`get <device-id>`,describe:`Fetches a single WARP device.`,builder:Ei,handler:async r=>{let i={include:r.include};if(r.dryRun){s({command:`cf zero-trust devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/physical-devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}`,pathParams:{"device-id":String(r[`device-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.get({account_id:u,device_id:r[`device-id`],...i})),{successLabel:`Loaded`})}};function Oi(e){return e.option(`description`,{type:`string`,description:`An optional description of the Device IP profile.`}).option(`enabled`,{type:`boolean`,description:`Whether the Device IP profile will be applied to matching devices.`,default:!0}).option(`match`,{type:`string`,description:`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`}).option(`name`,{type:`string`,description:`A user-friendly name for the Device IP profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.`}).option(`subnet-id`,{type:`string`,description:`The ID of the Subnet.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ki={command:`create`,describe:`Creates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.`,builder:Oi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices ip-profiles create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/ip-profiles`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),enabled:r.enabled,match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,subnet_id:f(r[`subnet-id`],`subnet-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.ipProfiles.create({...e,account_id:u})),{successLabel:`Created`});return}if(r.match===void 0&&(r.match=await m(`match`,`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`)),r.name===void 0&&(r.name=await m(`name`,`A user-friendly name for the Device IP profile.`)),r.precedence===void 0)throw Error(`--precedence is required (or pass --body with this field set).`);r[`subnet-id`]===void 0&&(r[`subnet-id`]=await m(`subnet-id`,`The ID of the Subnet.`));let p=d({description:f(r.description,`description`,`text`),enabled:r.enabled,match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,subnet_id:f(r[`subnet-id`],`subnet-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.devices.ipProfiles.create({...p,account_id:u})),{successLabel:`Created`})}};function Ai(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ji={command:`delete <profile-id>`,describe:`Delete a WARP Device IP profile.`,builder:Ai,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices ip-profiles delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/ip-profiles/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.ipProfiles.delete({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Deleted`})}};function Mi(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ni={command:`get <profile-id>`,describe:`Fetches a single WARP Device IP profile.`,builder:Mi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices ip-profiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/ip-profiles/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.ipProfiles.get({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Loaded`})}};function Pi(e){return e.option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The number of IP profiles to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fi={command:`list`,describe:`Lists WARP Device IP profiles.`,builder:Pi,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust devices ip-profiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/ip-profiles`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.ipProfiles.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Ii(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`description`,{type:`string`,description:`An optional description of the Device IP profile.`}).option(`enabled`,{type:`boolean`,description:`Whether the Device IP profile is enabled.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`}).option(`name`,{type:`string`,description:`A user-friendly name for the Device IP profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.`}).option(`subnet-id`,{type:`string`,description:`The ID of the Subnet.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Li={command:`update <profile-id>`,describe:`Updates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.`,builder:Ii,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices ip-profiles update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/ip-profiles/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),enabled:r.enabled,match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,subnet_id:f(r[`subnet-id`],`subnet-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.ipProfiles.update({...e,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),enabled:r.enabled,match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,subnet_id:f(r[`subnet-id`],`subnet-id`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.devices.ipProfiles.update({...p,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`})}},Ri={command:`ip-profiles`,describe:`Operations for devices.ip-profiles`,builder:e=>e.command(ki).command(ji).command(Ni).command(Fi).command(Li).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function zi(e){return e.option(`cursor`,{type:`string`,description:`Opaque token indicating the starting position when requesting the next set of records. A cursor value can be obtained from the result_info.cursor field in the response.`}).option(`sort-by`,{type:`string`,description:`The device field to order results by.`,choices:[`name`,`id`,`client_version`,`last_seen_user.email`,`last_seen_at`,`active_registrations`,`created_at`]}).option(`sort-order`,{type:`string`,description:`Sort direction.`,choices:[`asc`,`desc`]}).option(`last-seen-user-email`,{type:`string`,description:`Filter by the last seen user's email.`}).option(`seen-after`,{type:`string`,description:`Filter by the last_seen timestamp - returns only devices last seen after this timestamp.`}).option(`seen-before`,{type:`string`,description:`Filter by the last_seen timestamp - returns only devices last seen before this timestamp.`}).option(`per-page`,{type:`number`,description:`The maximum number of devices to return in a single response.`}).option(`search`,{type:`string`,description:`Search by device details.`}).option(`active-registrations`,{type:`string`,description:`Include or exclude devices with active registrations. The default is "only" - return only devices with active registrations.`,choices:[`include`,`only`,`exclude`]}).option(`id`,{type:`string`,description:`Filter by a one or more device IDs.`}).option(`last-seen-registration-policy-id`,{type:`string`,description:`Filter by the ID of the device settings profile assigned to the device registration.`}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the device response. Supported values are: "last_seen_registration.policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bi={command:`list`,describe:`Lists WARP devices.`,builder:_(zi),handler:async r=>{let i={cursor:r.cursor,sort_by:r[`sort-by`],sort_order:r[`sort-order`],"last_seen_user.email":r[`last-seen-user-email`],seen_after:r[`seen-after`],seen_before:r[`seen-before`],per_page:r[`per-page`],search:r.search,active_registrations:r[`active-registrations`],id:r.id,"last_seen_registration.policy.id":r[`last-seen-registration-policy-id`],include:r.include};if(r.dryRun){s({command:`cf zero-trust devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/physical-devices`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Vi(e){return e.option(`config-sha256`,{type:`string`,description:`The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.`}).option(`config-tls-sockaddr`,{type:`string`,description:`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`}).option(`name`,{type:`string`,description:`The name of the device managed network. This name must be unique.`}).option(`type`,{type:`string`,description:`The type of device managed network.`,choices:[`tls`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Hi={command:`create`,describe:`Creates a new device managed network.`,builder:Vi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/networks`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({config:{sha256:f(r[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:f(r[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.networks.create({...e,account_id:u})),{successLabel:`Created`});return}r[`config-tls-sockaddr`]===void 0&&(r[`config-tls-sockaddr`]=await m(`config-tls-sockaddr`,`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`)),r.name===void 0&&(r.name=await m(`name`,`The name of the device managed network. This name must be unique.`)),r.type===void 0&&(r.type=await h(`type`,`The type of device managed network.`,[`tls`]));let p=d({config:{sha256:f(r[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:f(r[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.devices.networks.create({...p,account_id:u})),{successLabel:`Created`})}};function Ui(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Wi={command:`delete <network-id>`,describe:`Deletes a device managed network and fetches a list of the remaining device managed networks for an account.`,builder:Ui,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/networks/${r[`network-id`]==null?`<network-id>`:encodeURIComponent(String(r[`network-id`]))}`,pathParams:{"network-id":String(r[`network-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.networks.delete({account_id:l,network_id:r[`network-id`]})),{successLabel:`Deleted`})}};function Gi(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ki={command:`get <network-id>`,describe:`Fetches details for a single managed network.`,builder:Gi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices networks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/networks/${r[`network-id`]==null?`<network-id>`:encodeURIComponent(String(r[`network-id`]))}`,pathParams:{"network-id":String(r[`network-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.networks.get({account_id:l,network_id:r[`network-id`]})),{successLabel:`Loaded`})}};function qi(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ji={command:`list`,describe:`Fetches a list of managed networks for an account.`,builder:qi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices networks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/networks`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.networks.list({account_id:l})),{successLabel:`Loaded`})}};function Yi(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`config-sha256`,{type:`string`,description:`The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.`}).option(`config-tls-sockaddr`,{type:`string`,description:`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`}).option(`name`,{type:`string`,description:`The name of the device managed network. This name must be unique.`}).option(`type`,{type:`string`,description:`The type of device managed network.`,choices:[`tls`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`config-sha256`,`config-tls-sockaddr`].some(t=>e[t]!==void 0)){let t=[`config-tls-sockaddr`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --config-* flag is set`)}return!0})}const Xi={command:`update <network-id>`,describe:`Updates a configured device managed network.`,builder:Yi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices networks update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/networks/${r[`network-id`]==null?`<network-id>`:encodeURIComponent(String(r[`network-id`]))}`,pathParams:{"network-id":String(r[`network-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({config:{sha256:f(r[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:f(r[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.networks.update({...e,account_id:u,network_id:r[`network-id`]})),{successLabel:`Updated`});return}let p=d({config:{sha256:f(r[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:f(r[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.devices.networks.update({...p,account_id:u,network_id:r[`network-id`]})),{successLabel:`Updated`})}},Zi={command:`networks`,describe:`Operations for devices.networks`,builder:e=>e.command(Hi).command(Wi).command(Ki).command(Ji).command(Xi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qi(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $i={command:`get <registration-id>`,describe:`Fetches one-time use admin override codes for a registration. This relies on the **Admin Override** setting being enabled in your device configuration.`,builder:Qi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices override-codes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations/${r[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(r[`registration-id`]))}/override_codes`,pathParams:{"registration-id":String(r[`registration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.overrideCodes.get({account_id:l,registration_id:r[`registration-id`]})),{successLabel:`Loaded`})}};function ea(e){return e.option(`device-id`,{type:`string`,description:`Registration ID. Equal to Device ID except for accounts which enabled [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/).`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ta={command:`list`,describe:`Fetches a one-time use admin override code for a device. This relies on the **Admin Override** setting being enabled in your device configuration. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated:** please use GET /accounts/{account_id}/devices/registrations/{registration_id}/override_codes instead.`,builder:ea,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices override-codes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}/override_codes`,pathParams:{"device-id":String(r[`device-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.overrideCodes.list({account_id:l,device_id:r[`device-id`]})),{successLabel:`Loaded`})}},na={command:`override-codes`,describe:`Operations for devices.override-codes`,builder:e=>e.command($i).command(ta).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ra(e){return e.option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`,default:!1}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`,default:!1}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`,default:!0}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`,default:0}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`,default:180}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`.",default:!1}).option(`enabled`,{type:`boolean`,description:`Whether the policy will be applied to matching devices.`,default:!0}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`,default:!1}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`}).option(`name`,{type:`string`,description:`The name of the device settings profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`,default:!0}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`,default:!1}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`,default:``}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`,default:!1}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`,default:``}).option(`uninstall-protection`,{type:`boolean`,description:`Determines whether uninstalling the WARP client requires an override code. (Windows only).`,default:!1}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const ia={command:`create`,describe:`Creates a device settings profile to be applied to certain devices matching the criteria.`,builder:ra,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],disable_auto_fallback:r[`disable-auto-fallback`],enabled:r.enabled,exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:f(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:f(r[`tunnel-protocol`],`tunnel-protocol`,`text`),uninstall_protection:r[`uninstall-protection`],virtual_networks:{allowed:r[`virtual-networks-allowed`],default:f(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.policies.custom.create({...e,account_id:u})),{successLabel:`Created`});return}if(r.match===void 0&&(r.match=await m(`match`,`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`)),r.name===void 0&&(r.name=await m(`name`,`The name of the device settings profile.`)),r.precedence===void 0)throw Error(`--precedence is required (or pass --body with this field set).`);let p=d({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],disable_auto_fallback:r[`disable-auto-fallback`],enabled:r.enabled,exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:f(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:f(r[`tunnel-protocol`],`tunnel-protocol`,`text`),uninstall_protection:r[`uninstall-protection`],virtual_networks:{allowed:r[`virtual-networks-allowed`],default:f(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}});o(await c(`Creating`,async()=>i.zeroTrust.devices.policies.custom.create({...p,account_id:u})),{successLabel:`Created`})}};function aa(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const oa={command:`delete <policy-id>`,describe:`Deletes a device settings profile and fetches a list of the remaining profiles for an account.`,builder:aa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.policies.custom.delete({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Deleted`})}};function sa(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`}).option(`description`,{type:`string`,description:`A description of the policy.`}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`."}).option(`enabled`,{type:`boolean`,description:`Whether the policy will be applied to matching devices.`}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`}).option(`name`,{type:`string`,description:`The name of the device settings profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`}).option(`uninstall-protection`,{type:`boolean`,description:`Determines whether uninstalling the WARP client requires an override code. (Windows only).`}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const ca={command:`edit <policy-id>`,describe:`Updates a configured device settings profile.`,builder:sa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],description:f(r.description,`description`,`text`),disable_auto_fallback:r[`disable-auto-fallback`],enabled:r.enabled,exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:f(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:f(r[`tunnel-protocol`],`tunnel-protocol`,`text`),uninstall_protection:r[`uninstall-protection`],virtual_networks:{allowed:r[`virtual-networks-allowed`],default:f(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.custom.edit({...e,account_id:u,policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}let p=d({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],description:f(r.description,`description`,`text`),disable_auto_fallback:r[`disable-auto-fallback`],enabled:r.enabled,exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:f(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:f(r[`tunnel-protocol`],`tunnel-protocol`,`text`),uninstall_protection:r[`uninstall-protection`],virtual_networks:{allowed:r[`virtual-networks-allowed`],default:f(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}});o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.custom.edit({...p,account_id:u,policy_id:r[`policy-id`]})),{successLabel:`Updated`})}};function la(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ua={command:`get <policy-id>`,describe:`Fetches the list of routes excluded from the WARP client's tunnel for a specific device settings profile.`,builder:la,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom excludes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/exclude`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.custom.excludes.get({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Loaded`})}};function da(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const fa={command:`update <policy-id>`,describe:`Sets the list of routes excluded from the WARP client's tunnel for a specific device settings profile.`,builder:da,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom excludes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/exclude`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.custom.excludes.update({body:e,account_id:u,policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},pa={command:`excludes`,describe:`Operations for devices.policies.custom.excludes`,builder:e=>e.command(ua).command(fa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ma(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ha={command:`get <policy-id>`,describe:`Fetches the list of domains to bypass Gateway DNS resolution from a specified device settings profile. These domains will use the specified local DNS resolver instead.`,builder:ma,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom fallback-domains get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/fallback_domains`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.custom.fallbackDomains.get({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Loaded`})}};function ga(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _a={command:`update <policy-id>`,describe:`Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. This will only apply to the specified device settings profile.`,builder:ga,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom fallback-domains update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/fallback_domains`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.custom.fallbackDomains.update({body:e,account_id:u,policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},va={command:`fallback-domains`,describe:`Operations for devices.policies.custom.fallback-domains`,builder:e=>e.command(ha).command(_a).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ya(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ba={command:`get <policy-id>`,describe:`Fetches a device settings profile by ID.`,builder:ya,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.custom.get({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Loaded`})}};function xa(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sa={command:`get <policy-id>`,describe:`Fetches the list of routes included in the WARP client's tunnel for a specific device settings profile.`,builder:xa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom includes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/include`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.custom.includes.get({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Loaded`})}};function Ca(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const wa={command:`update <policy-id>`,describe:`Sets the list of routes included in the WARP client's tunnel for a specific device settings profile.`,builder:Ca,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom includes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/include`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.custom.includes.update({body:e,account_id:u,policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ta={command:`includes`,describe:`Operations for devices.policies.custom.includes`,builder:e=>e.command(Sa).command(wa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ea(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Da={command:`list`,describe:`Fetches a list of the device settings profiles for an account.`,builder:Ea,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policies`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.custom.list({account_id:l})),{successLabel:`Loaded`})}},Oa={command:`custom`,describe:`Operations for devices.policies.custom`,builder:e=>e.command(ia).command(oa).command(ca).command(ba).command(Da).command(pa).command(va).command(Ta).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ka(e){return e.option(`enabled`,{type:`boolean`,description:`The current status of the device policy certificate provisioning feature for WARP clients.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Aa={command:`edit`,describe:`Enable Zero Trust Clients to provision a certificate, containing a x509 subject, and referenced by Access device posture policies when the client visits MTLS protected domains. This facilitates device posture without a WARP session.`,builder:ka,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust devices policies default certificates edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/devices/policy/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({enabled:e.enabled}):l(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=l(e.body);o(await c(`Updating`,async()=>t.zeroTrust.devices.policies.default.certificates.edit({body:r,zone_id:n})),{successLabel:`Updated`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let i=d({enabled:e.enabled});o(await c(`Updating`,async()=>t.zeroTrust.devices.policies.default.certificates.edit({body:i,zone_id:n})),{successLabel:`Updated`})}};function ja(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ma={command:`get`,describe:`Fetches device certificate provisioning.`,builder:ja,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust devices policies default certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/devices/policy/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.devices.policies.default.certificates.get({zone_id:n})),{successLabel:`Loaded`})}},Na={command:`certificates`,describe:`Operations for devices.policies.default.certificates`,builder:e=>e.command(Aa).command(Ma).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Pa(e){return e.option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`."}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`}).option(`uninstall-protection`,{type:`boolean`,description:`Determines whether uninstalling the WARP client requires an override code. (Windows only).`}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const Fa={command:`edit`,describe:`Updates the default device settings profile for an account.`,builder:Pa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],disable_auto_fallback:r[`disable-auto-fallback`],exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:f(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:f(r[`tunnel-protocol`],`tunnel-protocol`,`text`),uninstall_protection:r[`uninstall-protection`],virtual_networks:{allowed:r[`virtual-networks-allowed`],default:f(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.default.edit({...e,account_id:u})),{successLabel:`Updated`});return}let p=d({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],disable_auto_fallback:r[`disable-auto-fallback`],exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:f(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:f(r[`tunnel-protocol`],`tunnel-protocol`,`text`),uninstall_protection:r[`uninstall-protection`],virtual_networks:{allowed:r[`virtual-networks-allowed`],default:f(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}});o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.default.edit({...p,account_id:u})),{successLabel:`Updated`})}};function Ia(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const La={command:`get`,describe:`Fetches the list of routes excluded from the WARP client's tunnel.`,builder:Ia,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default excludes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/exclude`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.default.excludes.get({account_id:l})),{successLabel:`Loaded`})}};function Ra(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const za={command:`update`,describe:`Sets the list of routes excluded from the WARP client's tunnel.`,builder:Ra,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default excludes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/exclude`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.default.excludes.update({body:e,account_id:u})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ba={command:`excludes`,describe:`Operations for devices.policies.default.excludes`,builder:e=>e.command(La).command(za).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Va(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ha={command:`get`,describe:`Fetches a list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.`,builder:Va,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default fallback-domains get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/fallback_domains`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.default.fallbackDomains.get({account_id:l})),{successLabel:`Loaded`})}};function Ua(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wa={command:`update`,describe:`Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.`,builder:Ua,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default fallback-domains update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/fallback_domains`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.default.fallbackDomains.update({body:e,account_id:u})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ga={command:`fallback-domains`,describe:`Operations for devices.policies.default.fallback-domains`,builder:e=>e.command(Ha).command(Wa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ka(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qa={command:`get`,describe:`Fetches the default device settings profile for an account.`,builder:Ka,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.default.get({account_id:l})),{successLabel:`Loaded`})}};function Ja(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ya={command:`get`,describe:`Fetches the list of routes included in the WARP client's tunnel.`,builder:Ja,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default includes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/include`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.default.includes.get({account_id:l})),{successLabel:`Loaded`})}};function Xa(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Za={command:`update`,describe:`Sets the list of routes included in the WARP client's tunnel.`,builder:Xa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default includes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/include`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.default.includes.update({body:e,account_id:u})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Qa={command:`includes`,describe:`Operations for devices.policies.default.includes`,builder:e=>e.command(Ya).command(Za).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},$a={command:`default`,describe:`Operations for devices.policies.default`,builder:e=>e.command(Fa).command(qa).command(Na).command(Ba).command(Ga).command(Qa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},eo={command:`policies`,describe:`Operations for devices.policies`,builder:e=>e.command(Oa).command($a).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function to(e){return e.option(`description`,{type:`string`,description:`The description of the device posture rule.`}).option(`expiration`,{type:`string`,description:`Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.`}).option(`input-exists`,{type:`boolean`,description:`Whether or not file exists.`}).option(`input-operating-system`,{type:`string`,description:`Operating system.`,choices:[`windows`,`linux`,`mac`,`android`,`ios`,`chromeos`]}).option(`input-path`,{type:`string`,description:`File path.`}).option(`input-sha256`,{type:`string`,description:`SHA-256.`}).option(`input-thumbprint`,{type:`string`,description:`Signing certificate thumbprint.`}).option(`input-id`,{type:`string`,description:`List ID.`}).option(`input-domain`,{type:`string`,description:`Domain.`}).option(`input-operator`,{type:`string`,description:`Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-os-distro-name`,{type:`string`,description:`Operating System Distribution Name (linux only).`}).option(`input-os-distro-revision`,{type:`string`,description:`Version of OS Distribution (linux only).`}).option(`input-os-version-extra`,{type:`string`,description:`Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.`}).option(`input-version`,{type:`string`,description:`Version of OS.`}).option(`input-enabled`,{type:`boolean`,description:`Enabled.`}).option(`input-check-disks`,{type:`string`,array:!0,description:`List of volume names to be checked for encryption.`}).option(`input-require-all`,{type:`boolean`,description:`Whether to check all disks for encryption.`}).option(`input-certificate-id`,{type:`string`,description:`UUID of Cloudflare managed certificate.`}).option(`input-cn`,{type:`string`,description:`Common Name that is protected by the certificate.`}).option(`input-check-private-key`,{type:`boolean`,description:`Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.`}).option(`input-extended-key-usage`,{type:`string`,array:!0,description:`List of values indicating purposes for which the certificate public key can be used.`}).option(`input-locations-paths`,{type:`string`,array:!0,description:`List of paths to check for client certificate on linux.`}).option(`input-locations-trust-stores`,{type:`string`,array:!0,description:`List of trust stores to check for client certificate.`}).option(`input-subject-alternative-names`,{type:`string`,array:!0,description:`List of certificate Subject Alternative Names.`}).option(`input-update-window-days`,{type:`number`,description:`Number of days that the antivirus should be updated within.`}).option(`input-compliance-status`,{type:`string`,description:`Compliance Status.`,choices:[`compliant`,`noncompliant`,`unknown`,`notapplicable`,`ingraceperiod`,`error`]}).option(`input-connection-id`,{type:`string`,description:`Posture Integration ID.`}).option(`input-last-seen`,{type:`string`,description:`For more details on last seen, please refer to the Crowdstrike documentation.`}).option(`input-os`,{type:`string`,description:`Os Version.`}).option(`input-overall`,{type:`string`,description:`Overall.`}).option(`input-sensor-config`,{type:`string`,description:`SensorConfig.`}).option(`input-state`,{type:`string`,description:`For more details on state, please refer to the Crowdstrike documentation.`,choices:[`online`,`offline`,`unknown`]}).option(`input-version-operator`,{type:`string`,description:`Version Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-auth-state`,{type:`string`,array:!0,description:`The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.`}).option(`input-count-operator`,{type:`string`,description:`Count Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-issue-count`,{type:`string`,description:`The Number of Issues.`}).option(`input-eid-last-seen`,{type:`string`,description:`For more details on eid last seen, refer to the Tanium documentation.`}).option(`input-risk-level`,{type:`string`,description:`For more details on risk level, refer to the Tanium documentation.`,choices:[`low`,`medium`,`high`,`critical`]}).option(`input-score-operator`,{type:`string`,description:`Score Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-total-score`,{type:`number`,description:`For more details on total score, refer to the Tanium documentation.`}).option(`input-active-threats`,{type:`number`,description:`The Number of active threats.`}).option(`input-infected`,{type:`boolean`,description:`Whether device is infected.`}).option(`input-is-active`,{type:`boolean`,description:`Whether device is active.`}).option(`input-network-status`,{type:`string`,description:`Network status of device.`,choices:[`connected`,`disconnected`,`disconnecting`,`connecting`]}).option(`input-operational-state`,{type:`string`,description:`Agent operational state.`,choices:[`na`,`partially_disabled`,`auto_fully_disabled`,`fully_disabled`,`auto_partially_disabled`,`disabled_error`,`db_corruption`]}).option(`input-score`,{type:`number`,description:`A value between 0-100 assigned to devices set by the 3rd party posture provider.`}).option(`name`,{type:`string`,description:`The name of the device posture rule.`}).option(`schedule`,{type:`string`,description:"Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`."}).option(`type`,{type:`string`,description:`The type of device posture rule.`,choices:[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`input-exists`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operating-system`,`input-id.input-check-disks.input-require-all.input-certificate-id.input-cn.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-operator.input-os.input-overall.input-sensor-config.input-state.input-version.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-path`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sha256`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-thumbprint`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-id`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-domain`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operator`,[`input-exists`,`input-path`,`input-sha256`,`input-thumbprint`,`input-operating-system`,`input-id`,`input-domain`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`,`input-compliance-status`,`input-connection-id`,`input-auth-state`,`input-count-operator`,`input-issue-count`]).conflicts(`input-os-distro-name`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-distro-revision`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-version-extra`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-version`,[`input-operating-system`,`input-operator`]).conflicts(`input-enabled`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-enabled`,[`input-operating-system`]).conflicts(`input-check-disks`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-require-all`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-certificate-id`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-cn`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-cn`,[`input-certificate-id`]).conflicts(`input-check-private-key`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-check-private-key`,[`input-certificate-id`,`input-operating-system`]).conflicts(`input-extended-key-usage`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-paths`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-trust-stores`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-subject-alternative-names`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-update-window-days`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-compliance-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-connection-id`,[`input-exists`,`input-operating-system`,`input-path`,`input-sha256`,`input-thumbprint`,`input-id`,`input-domain`,`input-operator`,`input-os-distro-name`,`input-os-distro-revision`,`input-os-version-extra`,`input-version`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`]).conflicts(`input-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-overall`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sensor-config`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-auth-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-count-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-issue-count`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-eid-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-risk-level`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-score-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-total-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-active-threats`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-infected`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-is-active`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-network-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-operational-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state`.split(`.`)).implies(`input-score`,[`input-connection-id`,`input-operator`])}const no={command:`create`,describe:`Creates a new device posture rule.`,builder:to,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),expiration:f(r.expiration,`expiration`,`text`),input:{exists:r[`input-exists`],operating_system:f(r[`input-operating-system`],`input-operating-system`,`text`),path:f(r[`input-path`],`input-path`,`text`),sha256:f(r[`input-sha256`],`input-sha256`,`text`),thumbprint:f(r[`input-thumbprint`],`input-thumbprint`,`text`),id:f(r[`input-id`],`input-id`,`text`),domain:f(r[`input-domain`],`input-domain`,`text`),operator:f(r[`input-operator`],`input-operator`,`text`),os_distro_name:f(r[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:f(r[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:f(r[`input-os-version-extra`],`input-os-version-extra`,`text`),version:f(r[`input-version`],`input-version`,`text`),enabled:r[`input-enabled`],checkDisks:r[`input-check-disks`],requireAll:r[`input-require-all`],certificate_id:f(r[`input-certificate-id`],`input-certificate-id`,`text`),cn:f(r[`input-cn`],`input-cn`,`text`),check_private_key:r[`input-check-private-key`],extended_key_usage:r[`input-extended-key-usage`],locations:{paths:r[`input-locations-paths`],trust_stores:r[`input-locations-trust-stores`]},subject_alternative_names:r[`input-subject-alternative-names`],update_window_days:r[`input-update-window-days`],compliance_status:f(r[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:f(r[`input-connection-id`],`input-connection-id`,`text`),last_seen:f(r[`input-last-seen`],`input-last-seen`,`text`),os:f(r[`input-os`],`input-os`,`text`),overall:f(r[`input-overall`],`input-overall`,`text`),sensor_config:f(r[`input-sensor-config`],`input-sensor-config`,`text`),state:f(r[`input-state`],`input-state`,`text`),versionOperator:f(r[`input-version-operator`],`input-version-operator`,`text`),auth_state:r[`input-auth-state`],countOperator:f(r[`input-count-operator`],`input-count-operator`,`text`),issue_count:f(r[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:f(r[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:f(r[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:f(r[`input-score-operator`],`input-score-operator`,`text`),total_score:r[`input-total-score`],active_threats:r[`input-active-threats`],infected:r[`input-infected`],is_active:r[`input-is-active`],network_status:f(r[`input-network-status`],`input-network-status`,`text`),operational_state:f(r[`input-operational-state`],`input-operational-state`,`text`),score:r[`input-score`]},name:f(r.name,`name`,`text`),schedule:f(r.schedule,`schedule`,`text`),type:f(r.type,`type`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.posture.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`The name of the device posture rule.`)),r.type===void 0&&(r.type=await h(`type`,`The type of device posture rule.`,[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]));let p=d({description:f(r.description,`description`,`text`),expiration:f(r.expiration,`expiration`,`text`),input:{exists:r[`input-exists`],operating_system:f(r[`input-operating-system`],`input-operating-system`,`text`),path:f(r[`input-path`],`input-path`,`text`),sha256:f(r[`input-sha256`],`input-sha256`,`text`),thumbprint:f(r[`input-thumbprint`],`input-thumbprint`,`text`),id:f(r[`input-id`],`input-id`,`text`),domain:f(r[`input-domain`],`input-domain`,`text`),operator:f(r[`input-operator`],`input-operator`,`text`),os_distro_name:f(r[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:f(r[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:f(r[`input-os-version-extra`],`input-os-version-extra`,`text`),version:f(r[`input-version`],`input-version`,`text`),enabled:r[`input-enabled`],checkDisks:r[`input-check-disks`],requireAll:r[`input-require-all`],certificate_id:f(r[`input-certificate-id`],`input-certificate-id`,`text`),cn:f(r[`input-cn`],`input-cn`,`text`),check_private_key:r[`input-check-private-key`],extended_key_usage:r[`input-extended-key-usage`],locations:{paths:r[`input-locations-paths`],trust_stores:r[`input-locations-trust-stores`]},subject_alternative_names:r[`input-subject-alternative-names`],update_window_days:r[`input-update-window-days`],compliance_status:f(r[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:f(r[`input-connection-id`],`input-connection-id`,`text`),last_seen:f(r[`input-last-seen`],`input-last-seen`,`text`),os:f(r[`input-os`],`input-os`,`text`),overall:f(r[`input-overall`],`input-overall`,`text`),sensor_config:f(r[`input-sensor-config`],`input-sensor-config`,`text`),state:f(r[`input-state`],`input-state`,`text`),versionOperator:f(r[`input-version-operator`],`input-version-operator`,`text`),auth_state:r[`input-auth-state`],countOperator:f(r[`input-count-operator`],`input-count-operator`,`text`),issue_count:f(r[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:f(r[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:f(r[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:f(r[`input-score-operator`],`input-score-operator`,`text`),total_score:r[`input-total-score`],active_threats:r[`input-active-threats`],infected:r[`input-infected`],is_active:r[`input-is-active`],network_status:f(r[`input-network-status`],`input-network-status`,`text`),operational_state:f(r[`input-operational-state`],`input-operational-state`,`text`),score:r[`input-score`]},name:f(r.name,`name`,`text`),schedule:f(r.schedule,`schedule`,`text`),type:f(r.type,`type`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.devices.posture.create({...p,account_id:u})),{successLabel:`Created`})}};function ro(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const io={command:`delete <rule-id>`,describe:`Deletes a device posture rule.`,builder:ro,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.posture.delete({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Deleted`})}};function ao(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const oo={command:`get <rule-id>`,describe:`Fetches a single device posture rule.`,builder:ao,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.posture.get({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Loaded`})}};function so(e){return e.option(`config-api-url`,{type:`string`,description:`The Workspace One API URL provided in the Workspace One Admin Dashboard.`}).option(`config-auth-url`,{type:`string`,description:`The Workspace One Authorization URL depending on your region.`}).option(`config-client-id`,{type:`string`,description:`The Workspace One client ID provided in the Workspace One Admin Dashboard.`}).option(`config-client-secret`,{type:`string`,description:`The Workspace One client secret provided in the Workspace One Admin Dashboard.`}).option(`config-customer-id`,{type:`string`,description:`The Crowdstrike customer ID.`}).option(`config-client-key`,{type:`string`,description:`The Uptycs client secret.`}).option(`config-access-client-id`,{type:`string`,description:"If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`."}).option(`config-access-client-secret`,{type:`string`,description:"If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`."}).option(`interval`,{type:`string`,description:"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`)."}).option(`name`,{type:`string`,description:`The name of the device posture integration.`}).option(`type`,{type:`string`,description:`The type of device posture integration.`,choices:[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`config-api-url`,[`config-customer-id`,`config-client-id`,`config-client-secret`]).conflicts(`config-auth-url`,[`config-customer-id`,`config-client-key`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-auth-url`,[`config-api-url`,`config-client-id`,`config-client-secret`]).conflicts(`config-client-id`,[`config-client-key`,`config-customer-id`,`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-client-secret`,[`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-customer-id`,[`config-auth-url`,`config-client-id`,`config-api-url`,`config-access-client-id`,`config-access-client-secret`]).conflicts(`config-client-key`,[`config-auth-url`,`config-client-id`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-client-key`,[`config-api-url`,`config-customer-id`,`config-client-secret`]).conflicts(`config-access-client-id`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-id`,[`config-api-url`,`config-access-client-secret`]).conflicts(`config-access-client-secret`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-secret`,[`config-api-url`,`config-access-client-id`])}const co={command:`create`,describe:`Create a new device posture integration.`,builder:so,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/integration`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({config:{api_url:f(r[`config-api-url`],`config-api-url`,`text`),auth_url:f(r[`config-auth-url`],`config-auth-url`,`text`),client_id:f(r[`config-client-id`],`config-client-id`,`text`),client_secret:f(r[`config-client-secret`],`config-client-secret`,`text`),customer_id:f(r[`config-customer-id`],`config-customer-id`,`text`),client_key:f(r[`config-client-key`],`config-client-key`,`text`),access_client_id:f(r[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:f(r[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:f(r.interval,`interval`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.posture.integrations.create({...e,account_id:u})),{successLabel:`Created`});return}r.interval===void 0&&(r.interval=await m(`interval`,"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`).")),r.name===void 0&&(r.name=await m(`name`,`The name of the device posture integration.`)),r.type===void 0&&(r.type=await h(`type`,`The type of device posture integration.`,[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]));let p=d({config:{api_url:f(r[`config-api-url`],`config-api-url`,`text`),auth_url:f(r[`config-auth-url`],`config-auth-url`,`text`),client_id:f(r[`config-client-id`],`config-client-id`,`text`),client_secret:f(r[`config-client-secret`],`config-client-secret`,`text`),customer_id:f(r[`config-customer-id`],`config-customer-id`,`text`),client_key:f(r[`config-client-key`],`config-client-key`,`text`),access_client_id:f(r[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:f(r[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:f(r.interval,`interval`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.devices.posture.integrations.create({...p,account_id:u})),{successLabel:`Created`})}};function lo(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const uo={command:`delete <integration-id>`,describe:`Delete a configured device posture integration.`,builder:lo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/integration/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.posture.integrations.delete({account_id:l,integration_id:r[`integration-id`]})),{successLabel:`Deleted`})}};function fo(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`config-api-url`,{type:`string`,description:`The Workspace One API URL provided in the Workspace One Admin Dashboard.`}).option(`config-auth-url`,{type:`string`,description:`The Workspace One Authorization URL depending on your region.`}).option(`config-client-id`,{type:`string`,description:`The Workspace One client ID provided in the Workspace One Admin Dashboard.`}).option(`config-client-secret`,{type:`string`,description:`The Workspace One client secret provided in the Workspace One Admin Dashboard.`}).option(`config-customer-id`,{type:`string`,description:`The Crowdstrike customer ID.`}).option(`config-client-key`,{type:`string`,description:`The Uptycs client secret.`}).option(`config-access-client-id`,{type:`string`,description:"If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`."}).option(`config-access-client-secret`,{type:`string`,description:"If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`."}).option(`interval`,{type:`string`,description:"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`)."}).option(`name`,{type:`string`,description:`The name of the device posture integration.`}).option(`type`,{type:`string`,description:`The type of device posture integration.`,choices:[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`config-api-url`,[`config-customer-id`,`config-client-id`,`config-client-secret`]).conflicts(`config-auth-url`,[`config-customer-id`,`config-client-key`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-auth-url`,[`config-api-url`,`config-client-id`,`config-client-secret`]).conflicts(`config-client-id`,[`config-client-key`,`config-customer-id`,`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-client-secret`,[`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-customer-id`,[`config-auth-url`,`config-client-id`,`config-api-url`,`config-access-client-id`,`config-access-client-secret`]).conflicts(`config-client-key`,[`config-auth-url`,`config-client-id`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-client-key`,[`config-api-url`,`config-customer-id`,`config-client-secret`]).conflicts(`config-access-client-id`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-id`,[`config-api-url`,`config-access-client-secret`]).conflicts(`config-access-client-secret`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-secret`,[`config-api-url`,`config-access-client-id`])}const po={command:`edit <integration-id>`,describe:`Updates a configured device posture integration.`,builder:fo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture integrations edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/integration/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({config:{api_url:f(r[`config-api-url`],`config-api-url`,`text`),auth_url:f(r[`config-auth-url`],`config-auth-url`,`text`),client_id:f(r[`config-client-id`],`config-client-id`,`text`),client_secret:f(r[`config-client-secret`],`config-client-secret`,`text`),customer_id:f(r[`config-customer-id`],`config-customer-id`,`text`),client_key:f(r[`config-client-key`],`config-client-key`,`text`),access_client_id:f(r[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:f(r[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:f(r.interval,`interval`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.posture.integrations.edit({...e,account_id:u,integration_id:r[`integration-id`]})),{successLabel:`Updated`});return}let p=d({config:{api_url:f(r[`config-api-url`],`config-api-url`,`text`),auth_url:f(r[`config-auth-url`],`config-auth-url`,`text`),client_id:f(r[`config-client-id`],`config-client-id`,`text`),client_secret:f(r[`config-client-secret`],`config-client-secret`,`text`),customer_id:f(r[`config-customer-id`],`config-customer-id`,`text`),client_key:f(r[`config-client-key`],`config-client-key`,`text`),access_client_id:f(r[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:f(r[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:f(r.interval,`interval`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.devices.posture.integrations.edit({...p,account_id:u,integration_id:r[`integration-id`]})),{successLabel:`Updated`})}};function mo(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ho={command:`get <integration-id>`,describe:`Fetches details for a single device posture integration.`,builder:mo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/integration/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.posture.integrations.get({account_id:l,integration_id:r[`integration-id`]})),{successLabel:`Loaded`})}};function go(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _o={command:`list`,describe:`Fetches the list of device posture integrations for an account.`,builder:go,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/integration`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.posture.integrations.list({account_id:l})),{successLabel:`Loaded`})}},vo={command:`integrations`,describe:`Operations for devices.posture.integrations`,builder:e=>e.command(co).command(uo).command(po).command(ho).command(_o).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function yo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const bo={command:`list`,describe:`Fetches device posture rules for a Zero Trust account.`,builder:yo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.posture.list({account_id:l})),{successLabel:`Loaded`})}};function xo(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`The description of the device posture rule.`}).option(`expiration`,{type:`string`,description:`Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.`}).option(`input-exists`,{type:`boolean`,description:`Whether or not file exists.`}).option(`input-operating-system`,{type:`string`,description:`Operating system.`,choices:[`windows`,`linux`,`mac`,`android`,`ios`,`chromeos`]}).option(`input-path`,{type:`string`,description:`File path.`}).option(`input-sha256`,{type:`string`,description:`SHA-256.`}).option(`input-thumbprint`,{type:`string`,description:`Signing certificate thumbprint.`}).option(`input-id`,{type:`string`,description:`List ID.`}).option(`input-domain`,{type:`string`,description:`Domain.`}).option(`input-operator`,{type:`string`,description:`Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-os-distro-name`,{type:`string`,description:`Operating System Distribution Name (linux only).`}).option(`input-os-distro-revision`,{type:`string`,description:`Version of OS Distribution (linux only).`}).option(`input-os-version-extra`,{type:`string`,description:`Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.`}).option(`input-version`,{type:`string`,description:`Version of OS.`}).option(`input-enabled`,{type:`boolean`,description:`Enabled.`}).option(`input-check-disks`,{type:`string`,array:!0,description:`List of volume names to be checked for encryption.`}).option(`input-require-all`,{type:`boolean`,description:`Whether to check all disks for encryption.`}).option(`input-certificate-id`,{type:`string`,description:`UUID of Cloudflare managed certificate.`}).option(`input-cn`,{type:`string`,description:`Common Name that is protected by the certificate.`}).option(`input-check-private-key`,{type:`boolean`,description:`Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.`}).option(`input-extended-key-usage`,{type:`string`,array:!0,description:`List of values indicating purposes for which the certificate public key can be used.`}).option(`input-locations-paths`,{type:`string`,array:!0,description:`List of paths to check for client certificate on linux.`}).option(`input-locations-trust-stores`,{type:`string`,array:!0,description:`List of trust stores to check for client certificate.`}).option(`input-subject-alternative-names`,{type:`string`,array:!0,description:`List of certificate Subject Alternative Names.`}).option(`input-update-window-days`,{type:`number`,description:`Number of days that the antivirus should be updated within.`}).option(`input-compliance-status`,{type:`string`,description:`Compliance Status.`,choices:[`compliant`,`noncompliant`,`unknown`,`notapplicable`,`ingraceperiod`,`error`]}).option(`input-connection-id`,{type:`string`,description:`Posture Integration ID.`}).option(`input-last-seen`,{type:`string`,description:`For more details on last seen, please refer to the Crowdstrike documentation.`}).option(`input-os`,{type:`string`,description:`Os Version.`}).option(`input-overall`,{type:`string`,description:`Overall.`}).option(`input-sensor-config`,{type:`string`,description:`SensorConfig.`}).option(`input-state`,{type:`string`,description:`For more details on state, please refer to the Crowdstrike documentation.`,choices:[`online`,`offline`,`unknown`]}).option(`input-version-operator`,{type:`string`,description:`Version Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-auth-state`,{type:`string`,array:!0,description:`The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.`}).option(`input-count-operator`,{type:`string`,description:`Count Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-issue-count`,{type:`string`,description:`The Number of Issues.`}).option(`input-eid-last-seen`,{type:`string`,description:`For more details on eid last seen, refer to the Tanium documentation.`}).option(`input-risk-level`,{type:`string`,description:`For more details on risk level, refer to the Tanium documentation.`,choices:[`low`,`medium`,`high`,`critical`]}).option(`input-score-operator`,{type:`string`,description:`Score Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-total-score`,{type:`number`,description:`For more details on total score, refer to the Tanium documentation.`}).option(`input-active-threats`,{type:`number`,description:`The Number of active threats.`}).option(`input-infected`,{type:`boolean`,description:`Whether device is infected.`}).option(`input-is-active`,{type:`boolean`,description:`Whether device is active.`}).option(`input-network-status`,{type:`string`,description:`Network status of device.`,choices:[`connected`,`disconnected`,`disconnecting`,`connecting`]}).option(`input-operational-state`,{type:`string`,description:`Agent operational state.`,choices:[`na`,`partially_disabled`,`auto_fully_disabled`,`fully_disabled`,`auto_partially_disabled`,`disabled_error`,`db_corruption`]}).option(`input-score`,{type:`number`,description:`A value between 0-100 assigned to devices set by the 3rd party posture provider.`}).option(`name`,{type:`string`,description:`The name of the device posture rule.`}).option(`schedule`,{type:`string`,description:"Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`."}).option(`type`,{type:`string`,description:`The type of device posture rule.`,choices:[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`input-exists`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operating-system`,`input-id.input-check-disks.input-require-all.input-certificate-id.input-cn.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-operator.input-os.input-overall.input-sensor-config.input-state.input-version.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-path`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sha256`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-thumbprint`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-id`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-domain`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operator`,[`input-exists`,`input-path`,`input-sha256`,`input-thumbprint`,`input-operating-system`,`input-id`,`input-domain`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`,`input-compliance-status`,`input-connection-id`,`input-auth-state`,`input-count-operator`,`input-issue-count`]).conflicts(`input-os-distro-name`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-distro-revision`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-version-extra`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-version`,[`input-operating-system`,`input-operator`]).conflicts(`input-enabled`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-enabled`,[`input-operating-system`]).conflicts(`input-check-disks`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-require-all`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-certificate-id`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-cn`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-cn`,[`input-certificate-id`]).conflicts(`input-check-private-key`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-check-private-key`,[`input-certificate-id`,`input-operating-system`]).conflicts(`input-extended-key-usage`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-paths`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-trust-stores`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-subject-alternative-names`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-update-window-days`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-compliance-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-connection-id`,[`input-exists`,`input-operating-system`,`input-path`,`input-sha256`,`input-thumbprint`,`input-id`,`input-domain`,`input-operator`,`input-os-distro-name`,`input-os-distro-revision`,`input-os-version-extra`,`input-version`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`]).conflicts(`input-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-overall`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sensor-config`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-auth-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-count-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-issue-count`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-eid-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-risk-level`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-score-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-total-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-active-threats`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-infected`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-is-active`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-network-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-operational-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state`.split(`.`)).implies(`input-score`,[`input-connection-id`,`input-operator`])}const So={command:`update <rule-id>`,describe:`Updates a device posture rule.`,builder:xo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),expiration:f(r.expiration,`expiration`,`text`),input:{exists:r[`input-exists`],operating_system:f(r[`input-operating-system`],`input-operating-system`,`text`),path:f(r[`input-path`],`input-path`,`text`),sha256:f(r[`input-sha256`],`input-sha256`,`text`),thumbprint:f(r[`input-thumbprint`],`input-thumbprint`,`text`),id:f(r[`input-id`],`input-id`,`text`),domain:f(r[`input-domain`],`input-domain`,`text`),operator:f(r[`input-operator`],`input-operator`,`text`),os_distro_name:f(r[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:f(r[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:f(r[`input-os-version-extra`],`input-os-version-extra`,`text`),version:f(r[`input-version`],`input-version`,`text`),enabled:r[`input-enabled`],checkDisks:r[`input-check-disks`],requireAll:r[`input-require-all`],certificate_id:f(r[`input-certificate-id`],`input-certificate-id`,`text`),cn:f(r[`input-cn`],`input-cn`,`text`),check_private_key:r[`input-check-private-key`],extended_key_usage:r[`input-extended-key-usage`],locations:{paths:r[`input-locations-paths`],trust_stores:r[`input-locations-trust-stores`]},subject_alternative_names:r[`input-subject-alternative-names`],update_window_days:r[`input-update-window-days`],compliance_status:f(r[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:f(r[`input-connection-id`],`input-connection-id`,`text`),last_seen:f(r[`input-last-seen`],`input-last-seen`,`text`),os:f(r[`input-os`],`input-os`,`text`),overall:f(r[`input-overall`],`input-overall`,`text`),sensor_config:f(r[`input-sensor-config`],`input-sensor-config`,`text`),state:f(r[`input-state`],`input-state`,`text`),versionOperator:f(r[`input-version-operator`],`input-version-operator`,`text`),auth_state:r[`input-auth-state`],countOperator:f(r[`input-count-operator`],`input-count-operator`,`text`),issue_count:f(r[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:f(r[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:f(r[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:f(r[`input-score-operator`],`input-score-operator`,`text`),total_score:r[`input-total-score`],active_threats:r[`input-active-threats`],infected:r[`input-infected`],is_active:r[`input-is-active`],network_status:f(r[`input-network-status`],`input-network-status`,`text`),operational_state:f(r[`input-operational-state`],`input-operational-state`,`text`),score:r[`input-score`]},name:f(r.name,`name`,`text`),schedule:f(r.schedule,`schedule`,`text`),type:f(r.type,`type`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.posture.update({...e,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await m(`name`,`The name of the device posture rule.`)),r.type===void 0&&(r.type=await h(`type`,`The type of device posture rule.`,[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]));let p=d({description:f(r.description,`description`,`text`),expiration:f(r.expiration,`expiration`,`text`),input:{exists:r[`input-exists`],operating_system:f(r[`input-operating-system`],`input-operating-system`,`text`),path:f(r[`input-path`],`input-path`,`text`),sha256:f(r[`input-sha256`],`input-sha256`,`text`),thumbprint:f(r[`input-thumbprint`],`input-thumbprint`,`text`),id:f(r[`input-id`],`input-id`,`text`),domain:f(r[`input-domain`],`input-domain`,`text`),operator:f(r[`input-operator`],`input-operator`,`text`),os_distro_name:f(r[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:f(r[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:f(r[`input-os-version-extra`],`input-os-version-extra`,`text`),version:f(r[`input-version`],`input-version`,`text`),enabled:r[`input-enabled`],checkDisks:r[`input-check-disks`],requireAll:r[`input-require-all`],certificate_id:f(r[`input-certificate-id`],`input-certificate-id`,`text`),cn:f(r[`input-cn`],`input-cn`,`text`),check_private_key:r[`input-check-private-key`],extended_key_usage:r[`input-extended-key-usage`],locations:{paths:r[`input-locations-paths`],trust_stores:r[`input-locations-trust-stores`]},subject_alternative_names:r[`input-subject-alternative-names`],update_window_days:r[`input-update-window-days`],compliance_status:f(r[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:f(r[`input-connection-id`],`input-connection-id`,`text`),last_seen:f(r[`input-last-seen`],`input-last-seen`,`text`),os:f(r[`input-os`],`input-os`,`text`),overall:f(r[`input-overall`],`input-overall`,`text`),sensor_config:f(r[`input-sensor-config`],`input-sensor-config`,`text`),state:f(r[`input-state`],`input-state`,`text`),versionOperator:f(r[`input-version-operator`],`input-version-operator`,`text`),auth_state:r[`input-auth-state`],countOperator:f(r[`input-count-operator`],`input-count-operator`,`text`),issue_count:f(r[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:f(r[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:f(r[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:f(r[`input-score-operator`],`input-score-operator`,`text`),total_score:r[`input-total-score`],active_threats:r[`input-active-threats`],infected:r[`input-infected`],is_active:r[`input-is-active`],network_status:f(r[`input-network-status`],`input-network-status`,`text`),operational_state:f(r[`input-operational-state`],`input-operational-state`,`text`),score:r[`input-score`]},name:f(r.name,`name`,`text`),schedule:f(r.schedule,`schedule`,`text`),type:f(r.type,`type`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.devices.posture.update({...p,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},Co={command:`posture`,describe:`Operations for devices.posture`,builder:e=>e.command(no).command(io).command(oo).command(bo).command(So).command(vo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function wo(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const To={command:`bulk-delete`,describe:`Deletes a list of WARP registrations.`,builder:wo,handler:async r=>{let i={id:r.id};if(r.dryRun){s({command:`cf zero-trust devices registrations bulk-delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>l.zeroTrust.devices.registrations.bulkDelete({account_id:u,...i})),{successLabel:`Deleted`})}};function Eo(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Do={command:`delete <registration-id>`,describe:`Deletes a WARP registration.`,builder:Eo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices registrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations/${r[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(r[`registration-id`]))}`,pathParams:{"registration-id":String(r[`registration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.registrations.delete({account_id:l,registration_id:r[`registration-id`]})),{successLabel:`Deleted`})}};function Oo(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the registration response. Supported values are: "policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ko={command:`get <registration-id>`,describe:`Fetches a single WARP registration.`,builder:Oo,handler:async r=>{let i={include:r.include};if(r.dryRun){s({command:`cf zero-trust devices registrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations/${r[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(r[`registration-id`]))}`,pathParams:{"registration-id":String(r[`registration-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.registrations.get({account_id:u,registration_id:r[`registration-id`],...i})),{successLabel:`Loaded`})}};function Ao(e){return e.option(`user-id`,{type:`string`,description:`Filter by user ID.`}).option(`seen-after`,{type:`string`,description:`Filter by the last_seen timestamp - returns only registrations last seen after this timestamp.`}).option(`seen-before`,{type:`string`,description:`Filter by the last_seen timestamp - returns only registrations last seen before this timestamp.`}).option(`status`,{type:`string`,description:`Filter by registration status. Defaults to 'active'.`,choices:[`active`,`all`,`revoked`]}).option(`per-page`,{type:`number`,description:`The maximum number of devices to return in a single response.`}).option(`search`,{type:`string`,description:`Filter by registration details.`}).option(`sort-by`,{type:`string`,description:`The registration field to order results by.`,choices:[`id`,`user.name`,`user.email`,`last_seen_at`,`created_at`]}).option(`sort-order`,{type:`string`,description:`Sort direction.`,choices:[`asc`,`desc`]}).option(`cursor`,{type:`string`,description:`Opaque token indicating the starting position when requesting the next set of records. A cursor value can be obtained from the result_info.cursor field in the response.`}).option(`id`,{type:`string`,description:`Filter by registration ID.`}).option(`device-id`,{type:`string`,description:`Filter by WARP device ID.`}).option(`policy-id`,{type:`string`,description:`Filter by the ID of the device settings profile assigned to the registration.`}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the registration response. Supported values are: "policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const jo={command:`list`,describe:`Lists WARP registrations.`,builder:_(Ao),handler:async r=>{let i={"user.id":r[`user-id`],seen_after:r[`seen-after`],seen_before:r[`seen-before`],status:r.status,per_page:r[`per-page`],search:r.search,sort_by:r[`sort-by`],sort_order:r[`sort-order`],cursor:r.cursor,id:r.id,"device.id":r[`device-id`],"policy.id":r[`policy-id`],include:r.include};if(r.dryRun){s({command:`cf zero-trust devices registrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.registrations.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Mo(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to revoke.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const No={command:`revoke`,describe:`Revokes a list of WARP registrations.`,builder:Mo,handler:async r=>{let i={id:r.id};if(r.dryRun){s({command:`cf zero-trust devices registrations revoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations/revoke`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,!await g({force:!!r.force,message:`This operation revokes device registrations destructively.`})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>l.zeroTrust.devices.registrations.revoke({account_id:u,...i})),{successLabel:`Deleted`})}};function Po(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to unrevoke.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fo={command:`unrevoke`,describe:`Unrevokes a list of WARP registrations.`,builder:Po,handler:async r=>{let i={id:r.id};if(r.dryRun){s({command:`cf zero-trust devices registrations unrevoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations/unrevoke`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Creating`,async()=>l.zeroTrust.devices.registrations.unrevoke({account_id:u,...i})),{successLabel:`Created`})}},Io={command:`registrations`,describe:`Operations for devices.registrations`,builder:e=>e.command(To).command(Do).command(ko).command(jo).command(No).command(Fo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Lo(e){return e.option(`disconnect`,{type:`boolean`,description:`Disconnects all devices on the account using Global WARP override.`}).option(`justification`,{type:`string`,description:`Reasoning for setting the Global WARP override state. This will be surfaced in the audit log.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ro={command:`create`,describe:`Sets the Global WARP override state.`,builder:Lo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices resilience global-warp-override create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/resilience/disconnect`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({disconnect:r.disconnect,justification:f(r.justification,`justification`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.resilience.globalWarpOverride.create({...e,account_id:u})),{successLabel:`Created`});return}if(r.disconnect===void 0)throw Error(`--disconnect is required (or pass --body with this field set).`);let p=d({disconnect:r.disconnect,justification:f(r.justification,`justification`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.devices.resilience.globalWarpOverride.create({...p,account_id:u})),{successLabel:`Created`})}};function zo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bo={command:`get`,describe:`Fetch the Global WARP override state.`,builder:zo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices resilience global-warp-override get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/resilience/disconnect`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.resilience.globalWarpOverride.get({account_id:l})),{successLabel:`Loaded`})}},Vo={command:`global-warp-override`,describe:`Operations for devices.resilience.global-warp-override`,builder:e=>e.command(Ro).command(Bo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ho={command:`resilience`,describe:`Operations for devices.resilience`,builder:e=>e.command(Vo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Uo(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Wo={command:`revoke <device-id>`,describe:`Revokes all WARP registrations associated with the specified device.`,builder:Uo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices revoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/physical-devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}/revoke`,pathParams:{"device-id":String(r[`device-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force,message:`This operation revokes a device's session destructively.`})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.revoke({account_id:l,device_id:r[`device-id`]})),{successLabel:`Deleted`})}};function Go(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ko={command:`delete`,describe:`Resets the current device settings for a Zero Trust account.`,builder:Go,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices settings delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.settings.delete({account_id:l})),{successLabel:`Deleted`})}};function qo(e){return e.option(`disable-for-time`,{type:`number`,description:`Sets the time limit, in seconds, that a user can use an override code to bypass WARP.`}).option(`external-emergency-signal-enabled`,{type:`boolean`,description:`Controls whether the external emergency disconnect feature is enabled.`}).option(`external-emergency-signal-fingerprint`,{type:`string`,description:`The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.`}).option(`external-emergency-signal-interval`,{type:`string`,description:`The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.`}).option(`external-emergency-signal-url`,{type:`string`,description:`The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.`}).option(`gateway-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on TCP.`}).option(`gateway-udp-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on UDP.`}).option(`root-certificate-installation-enabled`,{type:`boolean`,description:`Enable installation of cloudflare managed root certificate.`}).option(`use-zt-virtual-ip`,{type:`boolean`,description:`Enable using CGNAT virtual IPv4.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Jo={command:`edit`,describe:`Patches the current device settings for a Zero Trust account.`,builder:qo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({disable_for_time:r[`disable-for-time`],external_emergency_signal_enabled:r[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:f(r[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:f(r[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:f(r[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:r[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:r[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:r[`root-certificate-installation-enabled`],use_zt_virtual_ip:r[`use-zt-virtual-ip`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.settings.edit({body:e,account_id:u})),{successLabel:`Updated`});return}let p=d({disable_for_time:r[`disable-for-time`],external_emergency_signal_enabled:r[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:f(r[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:f(r[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:f(r[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:r[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:r[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:r[`root-certificate-installation-enabled`],use_zt_virtual_ip:r[`use-zt-virtual-ip`]});o(await c(`Updating`,async()=>i.zeroTrust.devices.settings.edit({body:p,account_id:u})),{successLabel:`Updated`})}};function Yo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xo={command:`get`,describe:`Describes the current device settings for a Zero Trust account.`,builder:Yo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.settings.get({account_id:l})),{successLabel:`Loaded`})}};function Zo(e){return e.option(`disable-for-time`,{type:`number`,description:`Sets the time limit, in seconds, that a user can use an override code to bypass WARP.`}).option(`external-emergency-signal-enabled`,{type:`boolean`,description:`Controls whether the external emergency disconnect feature is enabled.`}).option(`external-emergency-signal-fingerprint`,{type:`string`,description:`The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.`}).option(`external-emergency-signal-interval`,{type:`string`,description:`The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.`}).option(`external-emergency-signal-url`,{type:`string`,description:`The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.`}).option(`gateway-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on TCP.`}).option(`gateway-udp-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on UDP.`}).option(`root-certificate-installation-enabled`,{type:`boolean`,description:`Enable installation of cloudflare managed root certificate.`}).option(`use-zt-virtual-ip`,{type:`boolean`,description:`Enable using CGNAT virtual IPv4.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Qo={command:`update`,describe:`Updates the current device settings for a Zero Trust account.`,builder:Zo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({disable_for_time:r[`disable-for-time`],external_emergency_signal_enabled:r[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:f(r[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:f(r[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:f(r[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:r[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:r[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:r[`root-certificate-installation-enabled`],use_zt_virtual_ip:r[`use-zt-virtual-ip`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.settings.update({body:e,account_id:u})),{successLabel:`Updated`});return}let p=d({disable_for_time:r[`disable-for-time`],external_emergency_signal_enabled:r[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:f(r[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:f(r[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:f(r[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:r[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:r[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:r[`root-certificate-installation-enabled`],use_zt_virtual_ip:r[`use-zt-virtual-ip`]});o(await c(`Updating`,async()=>i.zeroTrust.devices.settings.update({body:p,account_id:u})),{successLabel:`Updated`})}},$o={command:`settings`,describe:`Operations for devices.settings`,builder:e=>e.command(Ko).command(Jo).command(Xo).command(Qo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},es={command:`devices`,describe:`Operations for devices`,builder:e=>e.command(pi).command(Di).command(Bi).command(Wo).command(di).command(Ti).command(Ri).command(Zi).command(na).command(eo).command(Co).command(Io).command(Ho).command($o).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ts(e){return e.option(`from`,{type:`string`,description:`Start time for connection period in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for connection period in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`sort-by`,{type:`string`,description:`Type of usage that colos should be sorted by. If unspecified, returns all Cloudflare colos sorted alphabetically.`,choices:[`fleet-status-usage`,`application-tests-usage`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ns={command:`list`,describe:`List Cloudflare colos that account's devices were connected to during a time period, sorted by usage starting from the most used colo. Colos without traffic are also returned and sorted alphabetically.`,builder:_(ts),handler:async r=>{let i={from:r.from,to:r.to,sortBy:r[`sort-by`]};if(r.dryRun){s({command:`cf zero-trust dex colos list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/colos`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.colos.list({account_id:u,...i})),{successLabel:`Loaded`})}},rs={command:`colos`,describe:`Operations for dex.colos`,builder:e=>e.command(ns).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function is(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const as={command:`create`,describe:`Initiate commands for up to 10 devices per account.`,builder:is,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex commands create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/commands`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let u=await a(r),d=r.local?e:await t();if(r.accountId=d,r.body){let e=l(r.body);o(await c(`Creating`,async()=>u.zeroTrust.dex.commands.create({...e,account_id:d})),{successLabel:`Created`});return}o(await c(`Creating`,async()=>i(u,`POST`,`/accounts/${d}/dex/commands`)),{successLabel:`Created`})}};function os(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`search`,{type:`string`,description:`Filter devices by name or email.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ss={command:`list`,describe:`List devices with WARP client support for remote captures which have been connected in the last 1 hour.`,builder:os,handler:async r=>{let i={page:r.page,per_page:r[`per-page`],search:r.search};if(r.dryRun){s({command:`cf zero-trust dex commands eligible-devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/commands/devices`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.commands.eligibleDevices.list({account_id:u,...i})),{successLabel:`Loaded`})}},cs={command:`eligible-devices`,describe:`Operations for dex.commands.eligible-devices`,builder:e=>e.command(ss).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ls(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`}).option(`device-id`,{type:`string`,description:`Unique identifier for a device.`}).option(`user-email`,{type:`string`,description:`Email tied to the device.`}).option(`command-type`,{type:`string`,description:`Optionally filter executed commands by command type.`,choices:[`pcap`,`speed-test`,`warp-diag`]}).option(`status`,{type:`string`,description:`Optionally filter executed commands by status.`,choices:[`PENDING_EXEC`,`PENDING_UPLOAD`,`SUCCESS`,`FAILED`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const us={command:`list`,describe:`Retrieves a paginated list of commands issued to devices under the specified account, optionally filtered by time range, device, or other parameters`,builder:_(ls),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],from:r.from,to:r.to,device_id:r[`device-id`],user_email:r[`user-email`],command_type:r[`command-type`],status:r.status};if(r.dryRun){s({command:`cf zero-trust dex commands list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/commands`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.commands.list({account_id:u,...i})),{successLabel:`Loaded`})}};function ds(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fs={command:`get`,describe:`Retrieves the current quota usage and limits for device commands within a specific account, including the time when the quota will reset`,builder:ds,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex commands quota get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/commands/quota`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dex.commands.quota.get({account_id:l})),{successLabel:`Loaded`})}},ps={command:`quota`,describe:`Operations for dex.commands.quota`,builder:e=>e.command(fs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ms(e){return e.positional(`filename`,{type:`string`,description:"The name of the file to be downloaded, including the `.zip` extension.",demandOption:!0}).option(`command-id`,{type:`string`,description:`Unique identifier for command.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`text`,{type:`boolean`,description:`Decode the response body as UTF-8 text instead of writing raw bytes`,default:!1})}const hs={command:`get <filename>`,describe:`Downloads artifacts for an executed command. Bulk downloads are not supported`,builder:ms,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex commands results get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/commands/${r[`command-id`]==null?`<command-id>`:encodeURIComponent(String(r[`command-id`]))}/downloads/${r.filename==null?`<filename>`:encodeURIComponent(String(r.filename))}`,pathParams:{"command-id":String(r[`command-id`]??``),filename:String(r.filename??``)},bodyKind:`none`});return}await a(r);let i=r.local?e:await t();r.accountId=i;let o=await c(`Loading`,async()=>ee(`/accounts/${i}/dex/commands/${encodeURIComponent(String(r[`command-id`]))}/downloads/${encodeURIComponent(String(r.filename))}`,{method:`GET`,local:r.local===!0,persistTo:r.persistTo}));v(r.text===!0?o.toString(`utf-8`):o)}},gs={command:`results`,describe:`Operations for dex.commands.results`,builder:e=>e.command(hs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},_s={command:`commands`,describe:`Operations for dex.commands`,builder:e=>e.command(as).command(us).command(cs).command(ps).command(gs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function vs(e){return e.option(`since-minutes`,{type:`number`,description:`Number of minutes before current time.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ys={command:`get`,describe:`Get details for live (up to 60 minutes) devices using WARP.`,builder:vs,handler:async r=>{let i={since_minutes:r[`since-minutes`]};if(r.dryRun){s({command:`cf zero-trust dex devices aggregates live get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/fleet-status/live`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.devices.aggregates.live.get({account_id:u,...i})),{successLabel:`Loaded`})}},bs={command:`live`,describe:`Operations for dex.devices.aggregates.live`,builder:e=>e.command(ys).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function xs(e){return e.option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Cloudflare colo airport code.`}).option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ss={command:`get`,describe:`Get aggregate details for devices using WARP, up to 7 days.`,builder:xs,handler:async r=>{let i={to:r.to,from:r.from,colo:r.colo,device_id:r[`device-id`]};if(r.dryRun){s({command:`cf zero-trust dex devices aggregates over-time get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/fleet-status/over-time`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.devices.aggregates.overTime.get({account_id:u,...i})),{successLabel:`Loaded`})}},Cs={command:`over-time`,describe:`Operations for dex.devices.aggregates.over-time`,builder:e=>e.command(Ss).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ws={command:`aggregates`,describe:`Operations for dex.devices.aggregates`,builder:e=>e.command(bs).command(Cs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ts(e){return e.positional(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`since-minutes`,{type:`number`,description:`Number of minutes before current time.`,demandOption:!0}).option(`time-now`,{type:`string`,description:`Current time in ISO format.`}).option(`colo`,{type:`string`,description:`List of data centers to filter results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Es={command:`get <device-id>`,describe:`Get the latest status of a device given device_id from the device_state table.`,builder:Ts,handler:async r=>{let i={since_minutes:r[`since-minutes`],time_now:r[`time-now`],colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}/fleet-status/live`,pathParams:{"device-id":String(r[`device-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.devices.get({account_id:u,device_id:r[`device-id`],...i})),{successLabel:`Loaded`})}};function Ds(e){return e.option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`sort-by`,{type:`string`,description:`Dimension to sort results by.`,choices:[`colo`,`device_id`,`mode`,`platform`,`status`,`timestamp`,`version`]}).option(`colo`,{type:`string`,description:`Cloudflare colo airport code.`}).option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`}).option(`mode`,{type:`string`,description:`The mode under which the WARP client is run.`}).option(`status`,{type:`string`,description:`Network status.`}).option(`platform`,{type:`string`,description:`Operating system.`}).option(`version`,{type:`string`,description:`WARP client version.`}).option(`source`,{type:`string`,description:"Source:\n  * `hourly` - device details aggregated hourly, up to 7 days prior\n  * `last_seen` - device details, up to 60 minutes prior. Time windows exceeding 60 minutes will be rejected from June 1st, 2026. Please use 'hourly' or 'raw' instead for longer time ranges.\n  * `raw` - device details, up to 7 days prior",choices:[`last_seen`,`hourly`,`raw`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Os={command:`list`,describe:`List details of devices using WARP.`,builder:_(Ds),handler:async r=>{let i={to:r.to,from:r.from,page:r.page,per_page:r[`per-page`],sort_by:r[`sort-by`],colo:r.colo,device_id:r[`device-id`],mode:r.mode,status:r.status,platform:r.platform,version:r.version,source:r.source};if(r.dryRun){s({command:`cf zero-trust dex devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/fleet-status/devices`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.devices.list({account_id:u,...i})),{successLabel:`Loaded`})}};function ks(e){return e.positional(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`List of data centers to filter results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const As={command:`get <device-id>`,describe:`Get time-bucketed status metrics for a specific device.`,builder:_(ks),handler:async r=>{let i={from:r.from,to:r.to,interval:r.interval,colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex devices over-time get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}/fleet-status/over-time`,pathParams:{"device-id":String(r[`device-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.devices.overTime.get({account_id:u,device_id:r[`device-id`],...i})),{successLabel:`Loaded`})}},js={command:`over-time`,describe:`Operations for dex.devices.over-time`,builder:e=>e.command(As).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ms={command:`devices`,describe:`Operations for dex.devices`,builder:e=>e.command(Es).command(Os).command(ws).command(js).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ns(e){return e.option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of paginated results. Mutually exclusive with cursor.`}).option(`per-page`,{type:`number`,description:`Number of items per page`,demandOption:!0}).option(`cursor`,{type:`string`,description:`Cursor for cursor-based pagination. Mutually exclusive with page.`}).option(`sort-by`,{type:`string`,description:`The field to sort results by.`,choices:[`time_start`]}).option(`sort-order`,{type:`string`,description:`The order to sort results.`,choices:[`ASC`,`DESC`]}).option(`from`,{type:`string`,description:`Start time for the query in ISO 8601 format.`}).option(`to`,{type:`string`,description:`End time for the query in ISO 8601 format.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ps={command:`list`,describe:`List ISP information observed for a specific device during traceroute tests.`,builder:_(Ns),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],cursor:r.cursor,sort_by:r[`sort-by`],sort_order:r[`sort-order`],from:r.from,to:r.to};if(r.dryRun){s({command:`cf zero-trust dex isps list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}/isps`,pathParams:{"device-id":String(r[`device-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.isps.list({account_id:u,device_id:r[`device-id`],...i})),{successLabel:`Loaded`})}},Fs={command:`isps`,describe:`Operations for dex.isps`,builder:e=>e.command(Ps).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Is(e){return e.option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`test-name`,{type:`string`,description:`Optionally filter results by test name.`}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`registration-id`,{type:`string`,description:`Optionally filter results to a specific device registration. Must be used in combination with a single deviceId.`}).option(`page`,{type:`number`,description:`Page number of paginated results`}).option(`per-page`,{type:`number`,description:`Number of items per page`}).option(`kind`,{type:`string`,description:`Filter by test type.`,choices:[`http`,`traceroute`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ls={command:`list`,describe:`List DEX tests with overview metrics.`,builder:_(Is),handler:async r=>{let i={colo:r.colo,testName:r[`test-name`],deviceId:r[`device-id`],registration_id:r[`registration-id`],page:r.page,per_page:r[`per-page`],kind:r.kind};if(r.dryRun){s({command:`cf zero-trust dex overview tests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/tests/overview`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.overview.tests.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Rs(e){return e.option(`test-name`,{type:`string`,description:`Optionally filter results by test name.`}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zs={command:`get`,describe:`Returns unique count of devices that have run synthetic application monitoring tests in the past 7 days.`,builder:Rs,handler:async r=>{let i={testName:r[`test-name`],deviceId:r[`device-id`]};if(r.dryRun){s({command:`cf zero-trust dex overview tests unique-devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/tests/unique-devices`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.overview.tests.uniqueDevices.get({account_id:u,...i})),{successLabel:`Loaded`})}},Bs={command:`unique-devices`,describe:`Operations for dex.overview.tests.unique-devices`,builder:e=>e.command(zs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Vs={command:`tests`,describe:`Operations for dex.overview.tests`,builder:e=>e.command(Ls).command(Bs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Hs={command:`overview`,describe:`Operations for dex.overview`,builder:e=>e.command(Vs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Us(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`match`,{type:`string`,description:`The wirefilter expression to match.`}).option(`name`,{type:`string`,description:`The name of the Rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ws={command:`create`,describe:`Create a DEX Rule.`,builder:Us,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dex.rules.create({...e,account_id:u})),{successLabel:`Created`});return}r.match===void 0&&(r.match=await m(`match`,`The wirefilter expression to match.`)),r.name===void 0&&(r.name=await m(`name`,`The name of the Rule.`));let p=d({description:f(r.description,`description`,`text`),match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dex.rules.create({...p,account_id:u})),{successLabel:`Created`})}};function Gs(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ks={command:`delete <rule-id>`,describe:`Delete a DEX Rule.`,builder:Gs,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dex.rules.delete({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Deleted`})}};function qs(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Js={command:`get <rule-id>`,describe:`Get details for a DEX Rule.`,builder:qs,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dex.rules.get({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Loaded`})}};function Ys(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`sort-order`,{type:`string`,description:`Sort direction for sort_by property.`,choices:[`ASC`,`DESC`]}).option(`sort-by`,{type:`string`,description:`Which property to sort results by.`,choices:[`name`,`created_at`,`updated_at`]}).option(`name`,{type:`string`,description:`Filter results by rule name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xs={command:`list`,describe:`List DEX Rules.`,builder:_(Ys),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],sort_order:r[`sort-order`],sort_by:r[`sort-by`],name:r.name};if(r.dryRun){s({command:`cf zero-trust dex rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/rules`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.rules.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Zs(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`match`,{type:`string`,description:`The wirefilter expression to match.`}).option(`name`,{type:`string`,description:`The name of the Rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Qs={command:`update <rule-id>`,describe:`Update a DEX Rule.`,builder:Zs,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex rules update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dex.rules.update({...e,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),match:f(r.match,`match`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dex.rules.update({...p,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},$s={command:`rules`,describe:`Operations for dex.rules`,builder:e=>e.command(Ws).command(Ks).command(Js).command(Xs).command(Qs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ec(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const tc={command:`get <test-id>`,describe:`Get test details and aggregate performance metrics for an http test for a given time period between 1 hour and 7 days.`,builder:_(ec),handler:async r=>{let i={deviceId:r[`device-id`],from:r.from,to:r.to,interval:r.interval,colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex test-results http get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/http-tests/${r[`test-id`]==null?`<test-id>`:encodeURIComponent(String(r[`test-id`]))}`,pathParams:{"test-id":String(r[`test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.testResults.http.get({account_id:u,test_id:r[`test-id`],...i})),{successLabel:`Loaded`})}};function nc(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const rc={command:`get <test-id>`,describe:`Get percentiles for an http test for a given time period between 1 hour and 7 days.`,builder:nc,handler:async r=>{let i={deviceId:r[`device-id`],from:r.from,to:r.to,colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex test-results http percentiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/http-tests/${r[`test-id`]==null?`<test-id>`:encodeURIComponent(String(r[`test-id`]))}/percentiles`,pathParams:{"test-id":String(r[`test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.testResults.http.percentiles.get({account_id:u,test_id:r[`test-id`],...i})),{successLabel:`Loaded`})}},ic={command:`percentiles`,describe:`Operations for dex.test-results.http.percentiles`,builder:e=>e.command(rc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ac={command:`http`,describe:`Operations for dex.test-results.http`,builder:e=>e.command(tc).command(ic).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function oc(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sc={command:`get <test-id>`,describe:`Get test details and aggregate performance metrics for a traceroute test for a given time period between 1 hour and 7 days.`,builder:_(oc),handler:async r=>{let i={deviceId:r[`device-id`],from:r.from,to:r.to,interval:r.interval,colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex test-results traceroute get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/traceroute-tests/${r[`test-id`]==null?`<test-id>`:encodeURIComponent(String(r[`test-id`]))}`,pathParams:{"test-id":String(r[`test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.testResults.traceroute.get({account_id:u,test_id:r[`test-id`],...i})),{successLabel:`Loaded`})}};function cc(e){return e.positional(`test-result-id`,{type:`string`,description:`Unique identifier for a specific traceroute test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lc={command:`get <test-result-id>`,describe:`Get a breakdown of hops and performance metrics for a specific traceroute test run`,builder:cc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex test-results traceroute network-path get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/traceroute-test-results/${r[`test-result-id`]==null?`<test-result-id>`:encodeURIComponent(String(r[`test-result-id`]))}/network-path`,pathParams:{"test-result-id":String(r[`test-result-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dex.testResults.traceroute.networkPath.get({account_id:l,test_result_id:r[`test-result-id`]})),{successLabel:`Loaded`})}},uc={command:`network-path`,describe:`Operations for dex.test-results.traceroute.network-path`,builder:e=>e.command(lc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function dc(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fc={command:`get <test-id>`,describe:`Get percentiles for a traceroute test for a given time period between 1 hour and 7 days.`,builder:dc,handler:async r=>{let i={deviceId:r[`device-id`],from:r.from,to:r.to,colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex test-results traceroute percentiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/traceroute-tests/${r[`test-id`]==null?`<test-id>`:encodeURIComponent(String(r[`test-id`]))}/percentiles`,pathParams:{"test-id":String(r[`test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.testResults.traceroute.percentiles.get({account_id:u,test_id:r[`test-id`],...i})),{successLabel:`Loaded`})}},pc={command:`percentiles`,describe:`Operations for dex.test-results.traceroute.percentiles`,builder:e=>e.command(fc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},mc={command:`traceroute`,describe:`Operations for dex.test-results.traceroute`,builder:e=>e.command(sc).command(uc).command(pc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},hc={command:`test-results`,describe:`Operations for dex.test-results`,builder:e=>e.command(ac).command(mc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function gc(e){return e.option(`data-host`,{type:`string`,description:`The desired endpoint to test.`}).option(`data-kind`,{type:`string`,description:`The type of test.`,choices:[`http`,`traceroute`]}).option(`data-method`,{type:`string`,description:`The HTTP request method type.`,choices:[`GET`]}).option(`description`,{type:`string`,description:`Additional details about the test.`}).option(`enabled`,{type:`boolean`,description:`Determines whether or not the test is active.`}).option(`interval`,{type:`string`,description:`How often the test will run.`}).option(`name`,{type:`string`,description:`The name of the DEX test. Must be unique.`}).option(`targeted`,{type:`boolean`,description:`The targeted field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _c={command:`create`,describe:`Create a DEX test.`,builder:gc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex tests create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/dex_tests`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({data:{host:f(r[`data-host`],`data-host`,`text`),kind:f(r[`data-kind`],`data-kind`,`text`),method:f(r[`data-method`],`data-method`,`text`)},description:f(r.description,`description`,`text`),enabled:r.enabled,interval:f(r.interval,`interval`,`text`),name:f(r.name,`name`,`text`),targeted:r.targeted}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dex.tests.create({body:e,account_id:u})),{successLabel:`Created`});return}if(r[`data-host`]===void 0&&(r[`data-host`]=await m(`data-host`,`The desired endpoint to test.`)),r[`data-kind`]===void 0&&(r[`data-kind`]=await h(`data-kind`,`The type of test.`,[`http`,`traceroute`])),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.interval===void 0&&(r.interval=await m(`interval`,`How often the test will run.`)),r.name===void 0&&(r.name=await m(`name`,`The name of the DEX test. Must be unique.`));let p=d({data:{host:f(r[`data-host`],`data-host`,`text`),kind:f(r[`data-kind`],`data-kind`,`text`),method:f(r[`data-method`],`data-method`,`text`)},description:f(r.description,`description`,`text`),enabled:r.enabled,interval:f(r.interval,`interval`,`text`),name:f(r.name,`name`,`text`),targeted:r.targeted});o(await c(`Creating`,async()=>i.zeroTrust.dex.tests.create({body:p,account_id:u})),{successLabel:`Created`})}};function vc(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const yc={command:`delete <dex-test-id>`,describe:`Delete a Device DEX test. Returns the remaining device dex tests for the account.`,builder:vc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex tests delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/dex_tests/${r[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(r[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(r[`dex-test-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dex.tests.delete({account_id:l,dex_test_id:r[`dex-test-id`]})),{successLabel:`Deleted`})}};function bc(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xc={command:`get <dex-test-id>`,describe:`Fetch a single DEX test.`,builder:bc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex tests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/dex_tests/${r[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(r[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(r[`dex-test-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dex.tests.get({account_id:l,dex_test_id:r[`dex-test-id`]})),{successLabel:`Loaded`})}};function Sc(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`test-name`,{type:`string`,description:`Filter by test name.`}).option(`kind`,{type:`string`,description:`Filter by test type.`,choices:[`http`,`traceroute`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cc={command:`list`,describe:`Fetch all DEX tests.`,builder:_(Sc),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],testName:r[`test-name`],kind:r.kind};if(r.dryRun){s({command:`cf zero-trust dex tests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/dex_tests`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.tests.list({account_id:u,...i})),{successLabel:`Loaded`})}};function wc(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Device to filter traceroute result runs to.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Tc={command:`get <test-id>`,describe:`Get a breakdown of metrics by hop for individual traceroute test runs.`,builder:_(wc),handler:async r=>{let i={deviceId:r[`device-id`],from:r.from,to:r.to,interval:r.interval};if(r.dryRun){s({command:`cf zero-trust dex tests network-path get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/traceroute-tests/${r[`test-id`]==null?`<test-id>`:encodeURIComponent(String(r[`test-id`]))}/network-path`,pathParams:{"test-id":String(r[`test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.tests.networkPath.get({account_id:u,test_id:r[`test-id`],...i})),{successLabel:`Loaded`})}},Ec={command:`network-path`,describe:`Operations for dex.tests.network-path`,builder:e=>e.command(Tc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Dc(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`data-host`,{type:`string`,description:`The desired endpoint to test.`}).option(`data-kind`,{type:`string`,description:`The type of test.`,choices:[`http`,`traceroute`]}).option(`data-method`,{type:`string`,description:`The HTTP request method type.`,choices:[`GET`]}).option(`description`,{type:`string`,description:`Additional details about the test.`}).option(`enabled`,{type:`boolean`,description:`Determines whether or not the test is active.`}).option(`interval`,{type:`string`,description:`How often the test will run.`}).option(`name`,{type:`string`,description:`The name of the DEX test. Must be unique.`}).option(`targeted`,{type:`boolean`,description:`The targeted field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Oc={command:`update <dex-test-id>`,describe:`Update a DEX test.`,builder:Dc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex tests update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/dex_tests/${r[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(r[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(r[`dex-test-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({data:{host:f(r[`data-host`],`data-host`,`text`),kind:f(r[`data-kind`],`data-kind`,`text`),method:f(r[`data-method`],`data-method`,`text`)},description:f(r.description,`description`,`text`),enabled:r.enabled,interval:f(r.interval,`interval`,`text`),name:f(r.name,`name`,`text`),targeted:r.targeted}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dex.tests.update({body:e,account_id:u,dex_test_id:r[`dex-test-id`]})),{successLabel:`Updated`});return}if(r[`data-host`]===void 0&&(r[`data-host`]=await m(`data-host`,`The desired endpoint to test.`)),r[`data-kind`]===void 0&&(r[`data-kind`]=await h(`data-kind`,`The type of test.`,[`http`,`traceroute`])),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.interval===void 0&&(r.interval=await m(`interval`,`How often the test will run.`)),r.name===void 0&&(r.name=await m(`name`,`The name of the DEX test. Must be unique.`));let p=d({data:{host:f(r[`data-host`],`data-host`,`text`),kind:f(r[`data-kind`],`data-kind`,`text`),method:f(r[`data-method`],`data-method`,`text`)},description:f(r.description,`description`,`text`),enabled:r.enabled,interval:f(r.interval,`interval`,`text`),name:f(r.name,`name`,`text`),targeted:r.targeted});o(await c(`Updating`,async()=>i.zeroTrust.dex.tests.update({body:p,account_id:u,dex_test_id:r[`dex-test-id`]})),{successLabel:`Updated`})}},kc={command:`tests`,describe:`Operations for dex.tests`,builder:e=>e.command(_c).command(yc).command(xc).command(Cc).command(Oc).command(Ec).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ac(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`type`,{type:`string`,description:`Filter events by type 'config' or 'toggle'.`,choices:[`config`,`toggle`]}).option(`toggle`,{type:`string`,description:`Filter events by type toggle value. Applicable to type='toggle' events only.`,choices:[`on`,`off`]}).option(`config-name`,{type:`string`,description:`Filter events by WARP configuration name changed from or to. Applicable to type='config' events only.`}).option(`account-name`,{type:`string`,description:`Filter events by account name.`}).option(`sort-order`,{type:`string`,description:`Sort response by event timestamp.`,choices:[`ASC`,`DESC`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const jc={command:`list`,describe:`List WARP configuration and enablement toggle change events by device.`,builder:_(Ac),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],from:r.from,to:r.to,type:r.type,toggle:r.toggle,config_name:r[`config-name`],account_name:r[`account-name`],sort_order:r[`sort-order`]};if(r.dryRun){s({command:`cf zero-trust dex warp-change-events list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/warp-change-events`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.warpChangeEvents.list({account_id:u,...i})),{successLabel:`Loaded`})}},Mc={command:`warp-change-events`,describe:`Operations for dex.warp-change-events`,builder:e=>e.command(jc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Nc={command:`dex`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(rs).command(_s).command(Ms).command(Fs).command(Hs).command($s).command(hc).command(kc).command(Mc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Pc(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`topic`,{type:`string`,description:`The topic field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new custom prompt topic to create.`})}const Fc={command:`create`,describe:`Creates a DLP custom prompt topic entry.`,builder:Pc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp custom-prompt-topics create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/custom_prompt_topics`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),profile_id:f(r[`profile-id`],`profile-id`,`text`),topic:f(r.topic,`topic`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.customPromptTopics.create({...e,account_id:u})),{successLabel:`Created`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await m(`name`,`The name field`)),r.topic===void 0&&(r.topic=await m(`topic`,`The topic field`));let p=d({description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),profile_id:f(r[`profile-id`],`profile-id`,`text`),topic:f(r.topic,`topic`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.customPromptTopics.create({...p,account_id:u})),{successLabel:`Created`})}};function Ic(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Lc={command:`delete <entry-id>`,describe:`Deletes a DLP custom prompt topic entry.`,builder:Ic,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp custom-prompt-topics delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/custom_prompt_topics/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.customPromptTopics.delete({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Deleted`})}};function Rc(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zc={command:`get <entry-id>`,describe:`Fetches a DLP custom prompt topic entry by ID.`,builder:Rc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp custom-prompt-topics get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/custom_prompt_topics/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.customPromptTopics.get({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Loaded`})}};function Bc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vc={command:`list`,describe:`Lists all DLP custom prompt topic entries in an account.`,builder:Bc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp custom-prompt-topics list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/custom_prompt_topics`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.customPromptTopics.list({account_id:l})),{successLabel:`Loaded`})}};function Hc(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`topic`,{type:`string`,description:`The topic field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the custom prompt topic.`})}const Uc={command:`update <entry-id>`,describe:`Updates a DLP custom prompt topic entry.`,builder:Hc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp custom-prompt-topics update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/custom_prompt_topics/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),topic:f(r.topic,`topic`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.customPromptTopics.update({...e,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await m(`name`,`The name field`)),r.topic===void 0&&(r.topic=await m(`topic`,`The topic field`));let p=d({description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),topic:f(r.topic,`topic`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.customPromptTopics.update({...p,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`})}},Wc={command:`custom-prompt-topics`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Fc).command(Lc).command(zc).command(Vc).command(Uc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $(e){return e.option(`data-tags`,{type:`string`,array:!0,description:`The data_tags field`}).option(`description`,{type:`string`,description:`The description field`}).option(`expression`,{type:`string`,description:`The expression field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new data class.`})}const Gc={command:`create`,describe:`Creates a data class for use in DLP profiles.`,builder:$,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-classes create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_classes`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({data_tags:r[`data-tags`],description:f(r.description,`description`,`text`),expression:f(r.expression,`expression`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataClasses.create({...e,account_id:u})),{successLabel:`Created`});return}if(r[`data-tags`]===void 0)throw Error(`--data-tags is required (or pass --body with this field set).`);r.expression===void 0&&(r.expression=await m(`expression`,`The expression field`)),r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({data_tags:r[`data-tags`],description:f(r.description,`description`,`text`),expression:f(r.expression,`expression`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataClasses.create({...p,account_id:u})),{successLabel:`Created`})}};function Kc(e){return e.positional(`data-class-id`,{type:`string`,description:`Data class ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const qc={command:`delete <data-class-id>`,describe:`Deletes a data class from the account.`,builder:Kc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-classes delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_classes/${r[`data-class-id`]==null?`<data-class-id>`:encodeURIComponent(String(r[`data-class-id`]))}`,pathParams:{"data-class-id":String(r[`data-class-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.dataClasses.delete({account_id:l,data_class_id:r[`data-class-id`]})),{successLabel:`Deleted`})}};function Jc(e){return e.positional(`data-class-id`,{type:`string`,description:`Data class ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yc={command:`get <data-class-id>`,describe:`Gets the configuration for a data class.`,builder:Jc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-classes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_classes/${r[`data-class-id`]==null?`<data-class-id>`:encodeURIComponent(String(r[`data-class-id`]))}`,pathParams:{"data-class-id":String(r[`data-class-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataClasses.get({account_id:l,data_class_id:r[`data-class-id`]})),{successLabel:`Loaded`})}};function Xc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zc={command:`list`,describe:`Lists data classes configured for the account.`,builder:Xc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-classes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_classes`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataClasses.list({account_id:l})),{successLabel:`Loaded`})}};function Qc(e){return e.positional(`data-class-id`,{type:`string`,description:`Data class ID`,demandOption:!0}).option(`data-tags`,{type:`string`,array:!0,description:`The data_tags field`}).option(`description`,{type:`string`,description:`The description field`}).option(`expression`,{type:`string`,description:`The expression field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the data class to update.`})}const $c={command:`update <data-class-id>`,describe:`Updates the configuration for a data class.`,builder:Qc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-classes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_classes/${r[`data-class-id`]==null?`<data-class-id>`:encodeURIComponent(String(r[`data-class-id`]))}`,pathParams:{"data-class-id":String(r[`data-class-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({data_tags:r[`data-tags`],description:f(r.description,`description`,`text`),expression:f(r.expression,`expression`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataClasses.update({...e,account_id:u,data_class_id:r[`data-class-id`]})),{successLabel:`Updated`});return}let p=d({data_tags:r[`data-tags`],description:f(r.description,`description`,`text`),expression:f(r.expression,`expression`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataClasses.update({...p,account_id:u,data_class_id:r[`data-class-id`]})),{successLabel:`Updated`})}},el={command:`data-classes`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Gc).command(qc).command(Yc).command(Zc).command($c).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function tl(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`template-id`,{type:`string`,description:`The template_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new data tag category.`})}const nl={command:`create`,describe:`Creates a data tag category, optionally from a template.`,builder:tl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-categories create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),template_id:f(r[`template-id`],`template-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataTagCategories.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),template_id:f(r[`template-id`],`template-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataTagCategories.create({...p,account_id:u})),{successLabel:`Created`})}};function rl(e){return e.positional(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const il={command:`delete <category-id>`,describe:`Deletes a data tag category and its tags.`,builder:rl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-categories delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.dataTagCategories.delete({account_id:l,category_id:r[`category-id`]})),{successLabel:`Deleted`})}};function al(e){return e.positional(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ol={command:`get <category-id>`,describe:`Gets a data tag category and its tags.`,builder:al,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-categories get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTagCategories.get({account_id:l,category_id:r[`category-id`]})),{successLabel:`Loaded`})}};function sl(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const cl={command:`list`,describe:`Lists data tag categories configured for the account.`,builder:sl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-categories list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTagCategories.list({account_id:l})),{successLabel:`Loaded`})}};function ll(e){return e.positional(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the data tag category to update.`})}const ul={command:`update <category-id>`,describe:`Updates a data tag category and its tags.`,builder:ll,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-categories update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataTagCategories.update({...e,account_id:u,category_id:r[`category-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataTagCategories.update({...p,account_id:u,category_id:r[`category-id`]})),{successLabel:`Updated`})}},dl={command:`data-tag-categories`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(nl).command(il).command(ol).command(cl).command(ul).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function fl(e){return e.positional(`template-id`,{type:`string`,description:`Template ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pl={command:`get <template-id>`,describe:`Gets an available data tag category template.`,builder:fl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-category-templates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_category_templates/${r[`template-id`]==null?`<template-id>`:encodeURIComponent(String(r[`template-id`]))}`,pathParams:{"template-id":String(r[`template-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTagCategoryTemplates.get({account_id:l,template_id:r[`template-id`]})),{successLabel:`Loaded`})}};function ml(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const hl={command:`list`,describe:`Lists available data tag category templates.`,builder:ml,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-category-templates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_category_templates`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTagCategoryTemplates.list({account_id:l})),{successLabel:`Loaded`})}},gl={command:`data-tag-category-templates`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(pl).command(hl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function _l(e){return e.positional(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new data tag.`})}const vl={command:`create <category-id>`,describe:`Creates a data tag in a category.`,builder:_l,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tags create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}/data_tags`,pathParams:{"category-id":String(r[`category-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataTags.create({body:e,account_id:u,category_id:r[`category-id`]})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataTags.create({body:p,account_id:u,category_id:r[`category-id`]})),{successLabel:`Created`})}};function yl(e){return e.positional(`tag-id`,{type:`string`,description:`Tag ID`,demandOption:!0}).option(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const bl={command:`delete <tag-id>`,describe:`Deletes a data tag from a category.`,builder:yl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tags delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}/data_tags/${r[`tag-id`]==null?`<tag-id>`:encodeURIComponent(String(r[`tag-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``),"tag-id":String(r[`tag-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.dataTags.delete({account_id:l,category_id:r[`category-id`],tag_id:r[`tag-id`]})),{successLabel:`Deleted`})}};function xl(e){return e.positional(`tag-id`,{type:`string`,description:`Tag ID`,demandOption:!0}).option(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sl={command:`get <tag-id>`,describe:`Gets a data tag from a category.`,builder:xl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tags get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}/data_tags/${r[`tag-id`]==null?`<tag-id>`:encodeURIComponent(String(r[`tag-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``),"tag-id":String(r[`tag-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTags.get({account_id:l,category_id:r[`category-id`],tag_id:r[`tag-id`]})),{successLabel:`Loaded`})}};function Cl(e){return e.option(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wl={command:`list`,describe:`Lists data tags in a category.`,builder:Cl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tags list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}/data_tags`,pathParams:{"category-id":String(r[`category-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTags.list({account_id:l,category_id:r[`category-id`]})),{successLabel:`Loaded`})}};function Tl(e){return e.positional(`tag-id`,{type:`string`,description:`Tag ID`,demandOption:!0}).option(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the data tag to update.`})}const El={command:`update <tag-id>`,describe:`Updates a data tag in a category.`,builder:Tl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tags update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}/data_tags/${r[`tag-id`]==null?`<tag-id>`:encodeURIComponent(String(r[`tag-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``),"tag-id":String(r[`tag-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataTags.update({...e,account_id:u,category_id:r[`category-id`],tag_id:r[`tag-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataTags.update({...p,account_id:u,category_id:r[`category-id`],tag_id:r[`tag-id`]})),{successLabel:`Updated`})}},Dl={command:`data-tags`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(vl).command(bl).command(Sl).command(wl).command(El).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ol(e){return e.option(`case-sensitive`,{type:`boolean`,description:`Only applies to custom word lists.
+import{t as e}from"./local-Be3lg_9E.mjs";import{f as t,g as n,h as r}from"./oauth-DuEONNgC.mjs";import{a as i,r as a}from"./auth-D3X9HYhD.mjs";import{t as o}from"./output-Ccqw2WOb.mjs";import{t as s}from"./dry-run-DL2V6yFm.mjs";import{t as c}from"./progress-BqQcF5QH.mjs";import{i as l,n as u,r as d,t as f}from"./body-parser-BshbixEq.mjs";import{n as p,t as m}from"./input-validation-QDIYu7Vb.mjs";import{a as h,i as g,n as _}from"./prompt-B0sWIs9c.mjs";import{t as v}from"./cli-types-DAYeL_Mj.mjs";import{n as ee,t as te}from"./raw-fetch-Cc-MjHeL.mjs";function y(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const b={command:`create <app-id>`,describe:`Generates a new short-lived certificate CA and public key.`,builder:y,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications cas create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/ca`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Creating`,async()=>l.zeroTrust.access.applications.cas.create({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`]})),{successLabel:`Created`})}};function x(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const S={command:`delete <app-id>`,describe:`Deletes a short-lived certificate CA.`,builder:x,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications cas delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/ca`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(u===`zones`?i.zoneId=d:i.accountId=d,!await _({force:!!i.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>l.zeroTrust.access.applications.cas.delete({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`]})),{successLabel:`Deleted`})}};function C(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const w={command:`get <app-id>`,describe:`Fetches a short-lived certificate CA and its public key.`,builder:C,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications cas get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/ca`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.access.applications.cas.get({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`]})),{successLabel:`Loaded`})}};function T(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const E={command:`list`,describe:`Lists short-lived certificate CAs and their public keys.`,builder:T,handler:async i=>{let l={page:i.page,per_page:i[`per-page`]};if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications cas list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/ca`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},query:l,bodyKind:`none`});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();d===`zones`?i.zoneId=f:i.accountId=f,o(await c(`Loading`,async()=>u.zeroTrust.access.applications.cas.list({account_or_zone:d,account_or_zone_id:f,...l})),{successLabel:`Loaded`})}},D={command:`cas`,describe:`Operations for access.applications.cas`,builder:e=>e.command(b).command(S).command(w).command(E).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function O(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const k={command:`create`,describe:`Adds a new application to Access.`,builder:O,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?void 0:u(i.body)});return}let l=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=f:i.accountId=f,i.body){let e=u(i.body);o(await c(`Creating`,async()=>l.zeroTrust.access.applications.create({body:e,account_or_zone:d,account_or_zone_id:f})),{successLabel:`Created`});return}if(i.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function A(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const j={command:`delete <app-id>`,describe:`Deletes an application from Access.`,builder:A,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(u===`zones`?i.zoneId=d:i.accountId=d,!await _({force:!!i.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>l.zeroTrust.access.applications.delete({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`]})),{successLabel:`Deleted`})}};function M(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const N={command:`get <app-id>`,describe:`Fetches information about an Access application.`,builder:M,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.access.applications.get({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`]})),{successLabel:`Loaded`})}};function P(e){return e.option(`name`,{type:`string`,description:`The name of the app.`}).option(`domain`,{type:`string`,description:`The domain of the app.`}).option(`aud`,{type:`string`,description:`The aud of the app.`}).option(`target-attributes`,{type:`string`,description:`Target Criteria attributes in key=value format.`}).option(`exact`,{type:`boolean`,description:`True for only exact string matches against passed name/domain query parameters.`}).option(`search`,{type:`string`,description:`Search for apps by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const F={command:`list`,describe:`Lists all Access applications in an account or zone.`,builder:P,handler:async i=>{let l={name:i.name,domain:i.domain,aud:i.aud,target_attributes:i[`target-attributes`],exact:i.exact,search:i.search,page:i.page,per_page:i[`per-page`]};if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},query:l,bodyKind:`none`});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();d===`zones`?i.zoneId=f:i.accountId=f,o(await c(`Loading`,async()=>u.zeroTrust.access.applications.list({account_or_zone:d,account_or_zone_id:f,...l})),{successLabel:`Loaded`})}};function I(e){return e.positional(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const L={command:`create <app-id>`,describe:`Creates a policy applying exclusive to a single application that defines the users or groups who can reach it. We recommend creating a reusable policy instead and subsequently referencing its ID in the application's 'policies' array.`,builder:I,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/policies`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?void 0:u(i.body)});return}let l=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=f:i.accountId=f,i.body){let e=u(i.body);o(await c(`Creating`,async()=>l.zeroTrust.access.applications.policies.create({body:e,account_or_zone:d,account_or_zone_id:f,app_id:i[`app-id`]})),{successLabel:`Created`});return}if(i.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function R(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const z={command:`delete <policy-id>`,describe:`Deletes an Access policy specific to an application. To delete a reusable policy, use the /account or zones/{account or zone_id}/policies/{uid} endpoint.`,builder:R,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/policies/${i[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(i[`policy-id`]))}`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"policy-id":String(i[`policy-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(u===`zones`?i.zoneId=d:i.accountId=d,!await _({force:!!i.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>l.zeroTrust.access.applications.policies.delete({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`],policy_id:i[`policy-id`]})),{successLabel:`Deleted`})}};function B(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const V={command:`get <policy-id>`,describe:`Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.`,builder:B,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/policies/${i[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(i[`policy-id`]))}`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"policy-id":String(i[`policy-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.access.applications.policies.get({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`],policy_id:i[`policy-id`]})),{successLabel:`Loaded`})}};function H(e){return e.option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const U={command:`list`,describe:`Lists Access policies configured for an application. Returns both exclusively scoped and reusable policies used by the application.`,builder:H,handler:async i=>{let l={page:i.page,per_page:i[`per-page`]};if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/policies`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},query:l,bodyKind:`none`});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();d===`zones`?i.zoneId=f:i.accountId=f,o(await c(`Loading`,async()=>u.zeroTrust.access.applications.policies.list({account_or_zone:d,account_or_zone_id:f,app_id:i[`app-id`],...l})),{successLabel:`Loaded`})}};function W(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const G={command:`update <policy-id>`,describe:`Updates an Access policy specific to an application. To update a reusable policy, use the /account or zones/{account or zone_id}/policies/{uid} endpoint.`,builder:W,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/policies/${i[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(i[`policy-id`]))}`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"policy-id":String(i[`policy-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?void 0:u(i.body)});return}let l=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=f:i.accountId=f,i.body){let e=u(i.body);o(await c(`Updating`,async()=>l.zeroTrust.access.applications.policies.update({body:e,account_or_zone:d,account_or_zone_id:f,app_id:i[`app-id`],policy_id:i[`policy-id`]})),{successLabel:`Updated`});return}if(i.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},K={command:`policies`,describe:`Operations for access.applications.policies`,builder:e=>e.command(L).command(z).command(V).command(U).command(G).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function q(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const J={command:`create`,describe:`Starts an Access policy test.`,builder:q,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications policy-tests create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policy-tests`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.applications.policyTests.create({...e,account_id:l})),{successLabel:`Created`});return}o(await c(`Creating`,async()=>i.zeroTrust.access.applications.policyTests.create({account_id:l})),{successLabel:`Created`})}};function Y(e){return e.positional(`policy-test-id`,{type:`string`,description:`The UUID of the policy test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const X={command:`get <policy-test-id>`,describe:`Fetches the current status of a given Access policy test.`,builder:Y,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access applications policy-tests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policy-tests/${r[`policy-test-id`]==null?`<policy-test-id>`:encodeURIComponent(String(r[`policy-test-id`]))}`,pathParams:{"policy-test-id":String(r[`policy-test-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.applications.policyTests.get({account_id:l,policy_test_id:r[`policy-test-id`]})),{successLabel:`Loaded`})}};function Z(e){return e.option(`policy-test-id`,{type:`string`,description:`The UUID of the policy test.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`status`,{type:`string`,description:`Filter users by their policy evaluation status.`,choices:[`success`,`fail`,`error`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Q={command:`list`,describe:`Fetches a single page of user results from an Access policy test.`,builder:v(Z),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],status:r.status};if(r.dryRun){s({command:`cf zero-trust access applications policy-tests users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policy-tests/${r[`policy-test-id`]==null?`<policy-test-id>`:encodeURIComponent(String(r[`policy-test-id`]))}/users`,pathParams:{"policy-test-id":String(r[`policy-test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.applications.policyTests.users.list({account_id:u,policy_test_id:r[`policy-test-id`],...i})),{successLabel:`Loaded`})}},ne={command:`users`,describe:`Operations for access.applications.policy-tests.users`,builder:e=>e.command(Q).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},re={command:`policy-tests`,describe:`Operations for access.applications.policy-tests`,builder:e=>e.command(J).command(X).command(ne).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ie(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ae={command:`revoke-tokens <app-id>`,describe:`Revokes all tokens issued for an application.`,builder:ie,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications revoke-tokens`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/revoke_tokens`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(u===`zones`?i.zoneId=d:i.accountId=d,!await _({force:!!i.force,message:`This operation invalidates every service token for the app.`})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>l.zeroTrust.access.applications.revokeTokens({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`]})),{successLabel:`Deleted`})}};function oe(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const se={command:`edit <app-id>`,describe:`Updates Access application settings.`,builder:oe,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/settings`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?f({allow_iframe:i[`allow-iframe`],skip_interstitial:i[`skip-interstitial`]}):u(i.body)});return}let l=await a(i),d=i.zone===void 0?`accounts`:`zones`,p=d===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=p:i.accountId=p,i.body){let e=u(i.body);o(await c(`Updating`,async()=>l.zeroTrust.access.applications.settings.edit({body:e,account_or_zone:d,account_or_zone_id:p,app_id:i[`app-id`]})),{successLabel:`Updated`});return}let m=f({allow_iframe:i[`allow-iframe`],skip_interstitial:i[`skip-interstitial`]});o(await c(`Updating`,async()=>l.zeroTrust.access.applications.settings.edit({body:m,account_or_zone:d,account_or_zone_id:p,app_id:i[`app-id`]})),{successLabel:`Updated`})}};function ce(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const le={command:`update <app-id>`,describe:`Updates Access application settings.`,builder:ce,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/settings`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?f({allow_iframe:i[`allow-iframe`],skip_interstitial:i[`skip-interstitial`]}):u(i.body)});return}let l=await a(i),d=i.zone===void 0?`accounts`:`zones`,p=d===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=p:i.accountId=p,i.body){let e=u(i.body);o(await c(`Updating`,async()=>l.zeroTrust.access.applications.settings.update({body:e,account_or_zone:d,account_or_zone_id:p,app_id:i[`app-id`]})),{successLabel:`Updated`});return}let m=f({allow_iframe:i[`allow-iframe`],skip_interstitial:i[`skip-interstitial`]});o(await c(`Updating`,async()=>l.zeroTrust.access.applications.settings.update({body:m,account_or_zone:d,account_or_zone_id:p,app_id:i[`app-id`]})),{successLabel:`Updated`})}},ue={command:`settings`,describe:`Operations for access.applications.settings`,builder:e=>e.command(se).command(le).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function de(e){return e.positional(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const fe={command:`update <app-id>`,describe:`Updates an Access application.`,builder:de,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?void 0:u(i.body)});return}let l=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=f:i.accountId=f,i.body){let e=u(i.body);o(await c(`Updating`,async()=>l.zeroTrust.access.applications.update({body:e,account_or_zone:d,account_or_zone_id:f,app_id:i[`app-id`]})),{successLabel:`Updated`});return}if(i.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function pe(e){return e.option(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const me={command:`list`,describe:`Tests if a specific user has permission to access an application.`,builder:pe,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access applications user-policy-checks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/user_policy_checks`,pathParams:{"account-or-zone":String(t),"app-id":String(i[`app-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.access.applications.userPolicyChecks.list({account_or_zone:u,account_or_zone_id:d,app_id:i[`app-id`]})),{successLabel:`Loaded`})}},he={command:`user-policy-checks`,describe:`Operations for access.applications.user-policy-checks`,builder:e=>e.command(me).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ge={command:`applications`,describe:`Operations for access.applications`,builder:e=>e.command(k).command(j).command(N).command(F).command(ae).command(fe).command(D).command(K).command(re).command(ue).command(he).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function _e(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ve={command:`list`,describe:`Returns a list of Authenticator Device AAGUIDs for MFA configuration.`,builder:_e,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access authenticator-device-aaguids list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/authenticator_device_aaguids`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.authenticatorDeviceAaguids.list({account_id:l})),{successLabel:`Loaded`})}},ye={command:`authenticator-device-aaguids`,describe:`Operations for access.authenticator-device-aaguids`,builder:e=>e.command(ve).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function be(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xe={command:`create <bookmark-id>`,describe:`Create a new Bookmark application.`,builder:be,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access bookmarks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/bookmarks/${r[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(r[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(r[`bookmark-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.access.bookmarks.create({account_id:l,bookmark_id:r[`bookmark-id`]})),{successLabel:`Created`})}};function Se(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ce={command:`delete <bookmark-id>`,describe:`Deletes a Bookmark application.`,builder:Se,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access bookmarks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/bookmarks/${r[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(r[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(r[`bookmark-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.bookmarks.delete({account_id:l,bookmark_id:r[`bookmark-id`]})),{successLabel:`Deleted`})}};function we(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Te={command:`get <bookmark-id>`,describe:`Fetches a single Bookmark application.`,builder:we,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access bookmarks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/bookmarks/${r[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(r[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(r[`bookmark-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.bookmarks.get({account_id:l,bookmark_id:r[`bookmark-id`]})),{successLabel:`Loaded`})}};function Ee(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const De={command:`list`,describe:`Lists Bookmark applications.`,builder:Ee,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access bookmarks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/bookmarks`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.bookmarks.list({account_id:l})),{successLabel:`Loaded`})}};function Oe(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ke={command:`update <bookmark-id>`,describe:`Updates a configured Bookmark application.`,builder:Oe,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access bookmarks update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/bookmarks/${r[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(r[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(r[`bookmark-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Updating`,async()=>i.zeroTrust.access.bookmarks.update({account_id:l,bookmark_id:r[`bookmark-id`]})),{successLabel:`Updated`})}},Ae={command:`bookmarks`,describe:`Operations for access.bookmarks`,builder:e=>e.command(xe).command(Ce).command(Te).command(De).command(ke).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function je(e){return e.option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`certificate`,{type:`string`,description:`The certificate content.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Me={command:`create`,describe:`Adds a new mTLS root certificate to Access.`,builder:je,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/certificates`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?f({associated_hostnames:i[`associated-hostnames`],certificate:p(i.certificate,`certificate`,`text`),name:p(i.name,`name`,`text`)}):u(i.body)});return}let l=await a(i),d=i.zone===void 0?`accounts`:`zones`,m=d===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=m:i.accountId=m,i.body){let e=u(i.body);o(await c(`Creating`,async()=>l.zeroTrust.access.certificates.create({...e,account_or_zone:d,account_or_zone_id:m})),{successLabel:`Created`});return}i.certificate===void 0&&(i.certificate=await h(`certificate`,`The certificate content.`)),i.name===void 0&&(i.name=await h(`name`,`The name of the certificate.`));let g=f({associated_hostnames:i[`associated-hostnames`],certificate:p(i.certificate,`certificate`,`text`),name:p(i.name,`name`,`text`)});o(await c(`Creating`,async()=>l.zeroTrust.access.certificates.create({...g,account_or_zone:d,account_or_zone_id:m})),{successLabel:`Created`})}};function Ne(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Pe={command:`delete <certificate-id>`,describe:`Deletes an mTLS certificate.`,builder:Ne,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/certificates/${i[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(i[`certificate-id`]))}`,pathParams:{"account-or-zone":String(t),"certificate-id":String(i[`certificate-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(u===`zones`?i.zoneId=d:i.accountId=d,!await _({force:!!i.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>l.zeroTrust.access.certificates.delete({account_or_zone:u,account_or_zone_id:d,certificate_id:i[`certificate-id`]})),{successLabel:`Deleted`})}};function Fe(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ie={command:`get <certificate-id>`,describe:`Fetches a single mTLS certificate.`,builder:Fe,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/certificates/${i[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(i[`certificate-id`]))}`,pathParams:{"account-or-zone":String(t),"certificate-id":String(i[`certificate-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.access.certificates.get({account_or_zone:u,account_or_zone_id:d,certificate_id:i[`certificate-id`]})),{successLabel:`Loaded`})}};function Le(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Re={command:`list`,describe:`Lists all mTLS root certificates.`,builder:Le,handler:async i=>{let l={page:i.page,per_page:i[`per-page`]};if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/certificates`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},query:l,bodyKind:`none`});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();d===`zones`?i.zoneId=f:i.accountId=f,o(await c(`Loading`,async()=>u.zeroTrust.access.certificates.list({account_or_zone:d,account_or_zone_id:f,...l})),{successLabel:`Loaded`})}};function ze(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Be={command:`get`,describe:`List all mTLS hostname settings for this account or zone.`,builder:ze,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access certificates settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/certificates/settings`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.access.certificates.settings.get({account_or_zone:u,account_or_zone_id:d})),{successLabel:`Loaded`})}};function Ve(e){return e.option(`settings`,{type:`string`,description:`The settings field. Provide as a JSON array of objects or @path/to/file.json.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const He={command:`update`,describe:`Updates an mTLS certificate's hostname settings.`,builder:Ve,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access certificates settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/certificates/settings`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?f({settings:d(i.settings,`settings`)}):u(i.body)});return}let l=await a(i),p=i.zone===void 0?`accounts`:`zones`,m=p===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(p===`zones`?i.zoneId=m:i.accountId=m,i.body){let e=u(i.body);o(await c(`Updating`,async()=>l.zeroTrust.access.certificates.settings.update({...e,account_or_zone:p,account_or_zone_id:m})),{successLabel:`Updated`});return}if(i.settings===void 0)throw Error(`--settings is required (or pass --body with this field set).`);let h=f({settings:d(i.settings,`settings`)});o(await c(`Updating`,async()=>l.zeroTrust.access.certificates.settings.update({...h,account_or_zone:p,account_or_zone_id:m})),{successLabel:`Updated`})}},Ue={command:`settings`,describe:`Operations for access.certificates.settings`,builder:e=>e.command(Be).command(He).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function We(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ge={command:`update <certificate-id>`,describe:`Updates a configured mTLS certificate.`,builder:We,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access certificates update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/certificates/${i[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(i[`certificate-id`]))}`,pathParams:{"account-or-zone":String(t),"certificate-id":String(i[`certificate-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?f({associated_hostnames:i[`associated-hostnames`],name:p(i.name,`name`,`text`)}):u(i.body)});return}let l=await a(i),d=i.zone===void 0?`accounts`:`zones`,m=d===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=m:i.accountId=m,i.body){let e=u(i.body);o(await c(`Updating`,async()=>l.zeroTrust.access.certificates.update({...e,account_or_zone:d,account_or_zone_id:m,certificate_id:i[`certificate-id`]})),{successLabel:`Updated`});return}if(i[`associated-hostnames`]===void 0)throw Error(`--associated-hostnames is required (or pass --body with this field set).`);let h=f({associated_hostnames:i[`associated-hostnames`],name:p(i.name,`name`,`text`)});o(await c(`Updating`,async()=>l.zeroTrust.access.certificates.update({...h,account_or_zone:d,account_or_zone_id:m,certificate_id:i[`certificate-id`]})),{successLabel:`Updated`})}},Ke={command:`certificates`,describe:`Operations for access.certificates`,builder:e=>e.command(Me).command(Pe).command(Ie).command(Re).command(Ge).command(Ue).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function qe(e){return e.option(`app-count`,{type:`number`,description:`Number of apps the custom page is assigned to.`}).option(`contract-version`,{type:`number`,description:`Contract version of the page's Liquid template. Present (>= 1) marks a sanitized template; absent or 0 marks a legacy page served verbatim.`}).option(`custom-html`,{type:`string`,description:`Custom page HTML.`}).option(`name`,{type:`string`,description:`Custom page name.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`,`login`,`interstitial`]}).option(`uid`,{type:`string`,description:`UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Je={command:`create`,describe:`Create a custom page`,builder:qe,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access custom-pages create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({app_count:r[`app-count`],contract_version:r[`contract-version`],custom_html:p(r[`custom-html`],`custom-html`,`text`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`),uid:p(r.uid,`uid`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.customPages.create({body:e,account_id:l})),{successLabel:`Created`});return}r[`custom-html`]===void 0&&(r[`custom-html`]=await h(`custom-html`,`Custom page HTML.`)),r.name===void 0&&(r.name=await h(`name`,`Custom page name.`)),r.type===void 0&&(r.type=await g(`type`,`Custom page type.`,[`identity_denied`,`forbidden`,`login`,`interstitial`]));let d=f({app_count:r[`app-count`],contract_version:r[`contract-version`],custom_html:p(r[`custom-html`],`custom-html`,`text`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`),uid:p(r.uid,`uid`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.customPages.create({body:d,account_id:l})),{successLabel:`Created`})}};function Ye(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Xe={command:`delete <custom-page-id>`,describe:`Delete a custom page`,builder:Ye,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access custom-pages delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages/${r[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(r[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(r[`custom-page-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.customPages.delete({account_id:l,custom_page_id:r[`custom-page-id`]})),{successLabel:`Deleted`})}};function Ze(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qe={command:`get <custom-page-id>`,describe:`Fetches a custom page and also returns its HTML.`,builder:Ze,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access custom-pages get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages/${r[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(r[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(r[`custom-page-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.customPages.get({account_id:l,custom_page_id:r[`custom-page-id`]})),{successLabel:`Loaded`})}};function $e(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const et={command:`list`,describe:`List custom pages`,builder:$e,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access custom-pages list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.customPages.list({account_id:u,...i})),{successLabel:`Loaded`})}};function tt(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-count`,{type:`number`,description:`Number of apps the custom page is assigned to.`}).option(`contract-version`,{type:`number`,description:`Contract version of the page's Liquid template. Present (>= 1) marks a sanitized template; absent or 0 marks a legacy page served verbatim.`}).option(`custom-html`,{type:`string`,description:`Custom page HTML.`}).option(`name`,{type:`string`,description:`Custom page name.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`,`login`,`interstitial`]}).option(`uid`,{type:`string`,description:`UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const nt={command:`update <custom-page-id>`,describe:`Update a custom page`,builder:tt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access custom-pages update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages/${r[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(r[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(r[`custom-page-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({app_count:r[`app-count`],contract_version:r[`contract-version`],custom_html:p(r[`custom-html`],`custom-html`,`text`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`),uid:p(r.uid,`uid`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.customPages.update({body:e,account_id:l,custom_page_id:r[`custom-page-id`]})),{successLabel:`Updated`});return}r[`custom-html`]===void 0&&(r[`custom-html`]=await h(`custom-html`,`Custom page HTML.`)),r.name===void 0&&(r.name=await h(`name`,`Custom page name.`)),r.type===void 0&&(r.type=await g(`type`,`Custom page type.`,[`identity_denied`,`forbidden`,`login`,`interstitial`]));let d=f({app_count:r[`app-count`],contract_version:r[`contract-version`],custom_html:p(r[`custom-html`],`custom-html`,`text`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`),uid:p(r.uid,`uid`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.access.customPages.update({body:d,account_id:l,custom_page_id:r[`custom-page-id`]})),{successLabel:`Updated`})}};function rt(e){return e.option(`template`,{type:`string`,description:`The Liquid template to validate.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`,`login`,`interstitial`]}).option(`version`,{type:`number`,description:`Contract version to validate against; omit for the latest.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A template to validate without persisting it.`})}const it={command:`validate`,describe:`Validate a Liquid template and return its errors and warnings without persisting it.`,builder:rt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access custom-pages validate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/custom_pages/validate`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({template:p(r.template,`template`,`text`),type:p(r.type,`type`,`text`),version:r.version}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.customPages.validate({...e,account_id:l})),{successLabel:`Created`});return}r.template===void 0&&(r.template=await h(`template`,`The Liquid template to validate.`)),r.type===void 0&&(r.type=await g(`type`,`Custom page type.`,[`identity_denied`,`forbidden`,`login`,`interstitial`]));let d=f({template:p(r.template,`template`,`text`),type:p(r.type,`type`,`text`),version:r.version});o(await c(`Creating`,async()=>i.zeroTrust.access.customPages.validate({...d,account_id:l})),{successLabel:`Created`})}},at={command:`custom-pages`,describe:`Operations for access.custom-pages`,builder:e=>e.command(Je).command(Xe).command(Qe).command(et).command(nt).command(it).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ot(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const st={command:`create`,describe:`Adds a new SSH Certificate Authority (CA).`,builder:ot,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access gateway-ca create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/gateway_ca`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.access.gatewayCa.create({account_id:l})),{successLabel:`Created`})}};function ct(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const lt={command:`delete <certificate-id>`,describe:`Deletes an SSH Certificate Authority.`,builder:ct,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access gateway-ca delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/gateway_ca/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.gatewayCa.delete({account_id:l,certificate_id:r[`certificate-id`]})),{successLabel:`Deleted`})}};function ut(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dt={command:`list`,describe:`Lists SSH Certificate Authorities (CA).`,builder:ut,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access gateway-ca list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/gateway_ca`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.gatewayCa.list({account_id:l})),{successLabel:`Loaded`})}},ft={command:`gateway-ca`,describe:`Operations for access.gateway-ca`,builder:e=>e.command(st).command(lt).command(dt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pt(e){return e.option(`exclude`,{type:`string`,description:`Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules. Provide as a JSON array of objects or @path/to/file.json.`}).option(`include`,{type:`string`,description:`Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules. Provide as a JSON array of objects or @path/to/file.json.`}).option(`is-default`,{type:`boolean`,description:`Whether this is the default group`}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`require`,{type:`string`,description:`Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules. Provide as a JSON array of objects or @path/to/file.json.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const mt={command:`create`,describe:`Creates a new Access group.`,builder:pt,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/groups`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?f({exclude:d(i.exclude,`exclude`),include:d(i.include,`include`),is_default:i[`is-default`],name:p(i.name,`name`,`text`),require:d(i.require,`require`)}):u(i.body)});return}let l=await a(i),m=i.zone===void 0?`accounts`:`zones`,g=m===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(m===`zones`?i.zoneId=g:i.accountId=g,i.body){let e=u(i.body);o(await c(`Creating`,async()=>l.zeroTrust.access.groups.create({...e,account_or_zone:m,account_or_zone_id:g})),{successLabel:`Created`});return}if(i.include===void 0)throw Error(`--include is required (or pass --body with this field set).`);i.name===void 0&&(i.name=await h(`name`,`The name of the Access group.`));let _=f({exclude:d(i.exclude,`exclude`),include:d(i.include,`include`),is_default:i[`is-default`],name:p(i.name,`name`,`text`),require:d(i.require,`require`)});o(await c(`Creating`,async()=>l.zeroTrust.access.groups.create({..._,account_or_zone:m,account_or_zone_id:g})),{successLabel:`Created`})}};function ht(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const gt={command:`delete <group-id>`,describe:`Deletes an Access group.`,builder:ht,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/groups/${i[`group-id`]==null?`<group-id>`:encodeURIComponent(String(i[`group-id`]))}`,pathParams:{"account-or-zone":String(t),"group-id":String(i[`group-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(u===`zones`?i.zoneId=d:i.accountId=d,!await _({force:!!i.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>l.zeroTrust.access.groups.delete({account_or_zone:u,account_or_zone_id:d,group_id:i[`group-id`]})),{successLabel:`Deleted`})}};function _t(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const vt={command:`get <group-id>`,describe:`Fetches a single Access group.`,builder:_t,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/groups/${i[`group-id`]==null?`<group-id>`:encodeURIComponent(String(i[`group-id`]))}`,pathParams:{"account-or-zone":String(t),"group-id":String(i[`group-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.access.groups.get({account_or_zone:u,account_or_zone_id:d,group_id:i[`group-id`]})),{successLabel:`Loaded`})}};function yt(e){return e.option(`name`,{type:`string`,description:`The name of the group.`}).option(`search`,{type:`string`,description:`Search for groups by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const bt={command:`list`,describe:`Lists all Access groups.`,builder:yt,handler:async i=>{let l={name:i.name,search:i.search,page:i.page,per_page:i[`per-page`]};if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/groups`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},query:l,bodyKind:`none`});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();d===`zones`?i.zoneId=f:i.accountId=f,o(await c(`Loading`,async()=>u.zeroTrust.access.groups.list({account_or_zone:d,account_or_zone_id:f,...l})),{successLabel:`Loaded`})}};function xt(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`exclude`,{type:`string`,description:`Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules. Provide as a JSON array of objects or @path/to/file.json.`}).option(`include`,{type:`string`,description:`Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules. Provide as a JSON array of objects or @path/to/file.json.`}).option(`is-default`,{type:`boolean`,description:`Whether this is the default group`}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`require`,{type:`string`,description:`Rules evaluated with an AND logical operator. To match a policy, a user must meet all of the Require rules. Provide as a JSON array of objects or @path/to/file.json.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const St={command:`update <group-id>`,describe:`Updates a configured Access group.`,builder:xt,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/groups/${i[`group-id`]==null?`<group-id>`:encodeURIComponent(String(i[`group-id`]))}`,pathParams:{"account-or-zone":String(t),"group-id":String(i[`group-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?f({exclude:d(i.exclude,`exclude`),include:d(i.include,`include`),is_default:i[`is-default`],name:p(i.name,`name`,`text`),require:d(i.require,`require`)}):u(i.body)});return}let l=await a(i),m=i.zone===void 0?`accounts`:`zones`,g=m===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(m===`zones`?i.zoneId=g:i.accountId=g,i.body){let e=u(i.body);o(await c(`Updating`,async()=>l.zeroTrust.access.groups.update({...e,account_or_zone:m,account_or_zone_id:g,group_id:i[`group-id`]})),{successLabel:`Updated`});return}if(i.include===void 0)throw Error(`--include is required (or pass --body with this field set).`);i.name===void 0&&(i.name=await h(`name`,`The name of the Access group.`));let _=f({exclude:d(i.exclude,`exclude`),include:d(i.include,`include`),is_default:i[`is-default`],name:p(i.name,`name`,`text`),require:d(i.require,`require`)});o(await c(`Updating`,async()=>l.zeroTrust.access.groups.update({..._,account_or_zone:m,account_or_zone_id:g,group_id:i[`group-id`]})),{successLabel:`Updated`})}},Ct={command:`groups`,describe:`Operations for access.groups`,builder:e=>e.command(mt).command(gt).command(vt).command(bt).command(St).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function wt(e){return e.option(`idp-id`,{type:`string`,description:`UID of the identity provider to federate. Must be an existing identity provider in this account. One-time pin and Cloudflare-managed identity providers cannot be federated.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Tt={command:`create`,describe:`Creates an IdP federation grant for the specified identity provider, making it available for federation to other accounts in the same Cloudflare organization. The account must belong to a Cloudflare organization. One-time pin and Cloudflare-managed identity providers cannot be federated. An account can federate at most five identity providers at a time.`,builder:wt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access idp-federation-grants create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/idp_federation_grants`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({idp_id:p(r[`idp-id`],`idp-id`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.idpFederationGrants.create({...e,account_id:l})),{successLabel:`Created`});return}r[`idp-id`]===void 0&&(r[`idp-id`]=await h(`idp-id`,`UID of the identity provider to federate. Must be an existing identity provider in this account. One-time pin and Cloudflare-managed identity providers cannot be federated.`));let d=f({idp_id:p(r[`idp-id`],`idp-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.idpFederationGrants.create({...d,account_id:l})),{successLabel:`Created`})}};function Et(e){return e.positional(`grant-id`,{type:`string`,description:`UID of the IdP federation grant.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Dt={command:`delete <grant-id>`,describe:`Deletes an IdP federation grant. The identity provider remains in the account, but it is no longer available for federation to other accounts.`,builder:Et,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access idp-federation-grants delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/idp_federation_grants/${r[`grant-id`]==null?`<grant-id>`:encodeURIComponent(String(r[`grant-id`]))}`,pathParams:{"grant-id":String(r[`grant-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.idpFederationGrants.delete({account_id:l,grant_id:r[`grant-id`]})),{successLabel:`Deleted`})}};function Ot(e){return e.positional(`grant-id`,{type:`string`,description:`UID of the IdP federation grant.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const kt={command:`get <grant-id>`,describe:`Retrieves a single IdP federation grant by its UID.`,builder:Ot,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access idp-federation-grants get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/idp_federation_grants/${r[`grant-id`]==null?`<grant-id>`:encodeURIComponent(String(r[`grant-id`]))}`,pathParams:{"grant-id":String(r[`grant-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.idpFederationGrants.get({account_id:l,grant_id:r[`grant-id`]})),{successLabel:`Loaded`})}};function At(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const jt={command:`list`,describe:`Lists the IdP federation grants owned by the account.`,builder:At,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access idp-federation-grants list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/idp_federation_grants`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.idpFederationGrants.list({account_id:l})),{successLabel:`Loaded`})}},Mt={command:`idp-federation-grants`,describe:`Operations for access.idp-federation-grants`,builder:e=>e.command(Tt).command(Dt).command(kt).command(jt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Nt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pt={command:`get`,describe:`Gets the Access key rotation settings for an account.`,builder:Nt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access keys get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/keys`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.keys.get({account_id:l})),{successLabel:`Loaded`})}};function Ft(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const It={command:`rotate`,describe:`Perfoms a key rotation for an account.`,builder:Ft,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access keys rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/keys/rotate`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.access.keys.rotate({account_id:l})),{successLabel:`Created`})}};function Lt(e){return e.option(`key-rotation-interval-days`,{type:`number`,description:`The number of days between key rotations.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Rt={command:`update`,describe:`Updates the Access key rotation settings for an account.`,builder:Lt,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access keys update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/keys`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({key_rotation_interval_days:r[`key-rotation-interval-days`]}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.keys.update({...e,account_id:l})),{successLabel:`Updated`});return}if(r[`key-rotation-interval-days`]===void 0)throw Error(`--key-rotation-interval-days is required (or pass --body with this field set).`);let d=f({key_rotation_interval_days:r[`key-rotation-interval-days`]});o(await c(`Updating`,async()=>i.zeroTrust.access.keys.update({...d,account_id:l})),{successLabel:`Updated`})}},zt={command:`keys`,describe:`Operations for access.keys`,builder:e=>e.command(Pt).command(It).command(Rt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bt(e){return e.option(`limit`,{type:`number`,description:`The maximum number of log entries to retrieve.`}).option(`direction`,{type:`string`,description:`The chronological sorting order for the logs.`,choices:[`desc`,`asc`]}).option(`since`,{type:`string`,description:`The earliest event timestamp to query.`}).option(`until`,{type:`string`,description:`The latest event timestamp to query.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`email`,{type:`string`,description:"Filter by user email. Match mode is controlled by `emailOp` (preferred) or the legacy `email_exact` flag.\n- Default (no `emailOp`, `email_exact=false` or unset): substring match — `email=@example.com` returns all events with that domain.\n- Exact match: set `emailOp=eq` (preferred) or `email_exact=true` — e.g. `email=user@example.com&email_exact=true` returns only that user.\n- Explicit substring match: set `emailOp=contains` (without `email_exact=true`). When both are set, `email_exact=true` takes precedence and the match is exact.\n- Exclusion: set `emailOp=neq`. With `email_exact=true` this is an exact-value exclusion; without it, a fuzzy substring exclusion."}).option(`email-exact`,{type:`boolean`,description:"When true, `email` is matched exactly instead of substring matching."}).option(`user-id`,{type:`string`,description:"Deprecated. Accepted for backward compatibility but no longer applied\nas a filter. Use `email` instead."}).option(`allowed-op`,{type:`string`,description:"Operator for the `allowed` filter.",choices:[`eq`,`neq`]}).option(`country-code-op`,{type:`string`,description:"Operator for the `country_code` filter.",choices:[`eq`,`neq`]}).option(`app-type-op`,{type:`string`,description:"Operator for the `app_type` filter.",choices:[`eq`,`neq`]}).option(`app-uid-op`,{type:`string`,description:"Operator for the `app_uid` filter.",choices:[`eq`,`neq`]}).option(`ray-id-op`,{type:`string`,description:"Operator for the `ray_id` filter.",choices:[`eq`,`neq`]}).option(`email-op`,{type:`string`,description:"Operator for the `email` filter.\n`contains` performs a substring (case-sensitive) match. When `email_exact=true`\nis also set, `email_exact` takes precedence and `contains` is ignored.",choices:[`eq`,`neq`,`contains`]}).option(`idp-op`,{type:`string`,description:"Operator for the `idp` filter.",choices:[`eq`,`neq`]}).option(`non-identity-op`,{type:`string`,description:"Operator for the `non_identity` filter.",choices:[`eq`,`neq`]}).option(`user-id-op`,{type:`string`,description:"Deprecated. Accepted for backward compatibility but no longer applied\nas a filter (the `user_id` parameter is itself deprecated).",choices:[`eq`,`neq`]}).option(`fields`,{type:`string`,description:`Comma-separated list of fields to include in the response.
+When omitted, all fields are returned.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vt={command:`list`,describe:`Gets a list of Access authentication audit logs for an account.`,builder:v(Bt),handler:async r=>{let i={limit:r.limit,direction:r.direction,since:r.since,until:r.until,page:r.page,per_page:r[`per-page`],email:r.email,email_exact:r[`email-exact`],user_id:r[`user-id`],allowedOp:r[`allowed-op`],country_codeOp:r[`country-code-op`],app_typeOp:r[`app-type-op`],app_uidOp:r[`app-uid-op`],ray_idOp:r[`ray-id-op`],emailOp:r[`email-op`],idpOp:r[`idp-op`],non_identityOp:r[`non-identity-op`],user_idOp:r[`user-id-op`],fields:r.fields};if(r.dryRun){s({command:`cf zero-trust access logs access-requests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/logs/access_requests`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.logs.accessRequests.list({account_id:u,...i})),{successLabel:`Loaded`})}},Ht={command:`access-requests`,describe:`Operations for access.logs.access-requests`,builder:e=>e.command(Vt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ut(e){return e.positional(`knock-request-id`,{type:`string`,description:`Knock request ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Wt={command:`get <knock-request-id>`,describe:`Gets an account-scoped Access JIT request summary and its lifecycle events in chronological order.`,builder:Ut,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access logs jit-requests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/logs/jit_requests/${r[`knock-request-id`]==null?`<knock-request-id>`:encodeURIComponent(String(r[`knock-request-id`]))}`,pathParams:{"knock-request-id":String(r[`knock-request-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.logs.jitRequests.get({account_id:l,knock_request_id:r[`knock-request-id`]})),{successLabel:`Loaded`})}};function Gt(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`status`,{type:`string`,description:"JIT request status. `SPENT` is deprecated and interpreted as `APPROVED`.",choices:[`PENDING`,`APPROVED`,`DENIED`,`CANCELED`,`SPENT`]}).option(`search`,{type:`string`,description:`Case-insensitive search over request ID, requester email, application audience, and application hostname.`}).option(`since`,{type:`string`,description:`The earliest request timestamp to query. Defaults to 366 days before the current time.`}).option(`until`,{type:`string`,description:`The latest request timestamp to query. Defaults to the current time.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kt={command:`list`,describe:`Lists account-wide Access JIT request logs reconstructed from request lifecycle events.`,builder:v(Gt),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],status:r.status,search:r.search,since:r.since,until:r.until};if(r.dryRun){s({command:`cf zero-trust access logs jit-requests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/logs/jit_requests`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.logs.jitRequests.list({account_id:u,...i})),{successLabel:`Loaded`})}},qt={command:`jit-requests`,describe:`Operations for access.logs.jit-requests`,builder:e=>e.command(Wt).command(Kt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Jt(e){return e.option(`limit`,{type:`number`,description:`The maximum number of update logs to retrieve.`}).option(`direction`,{type:`string`,description:`The chronological order used to sort the logs.`,choices:[`desc`,`asc`]}).option(`since`,{type:`string`,description:`the timestamp of the earliest update log.`}).option(`until`,{type:`string`,description:`the timestamp of the most-recent update log.`}).option(`idp-id`,{type:`string`,description:`The unique Id of the IdP that has SCIM enabled.`,demandOption:!0}).option(`status`,{type:`string`,description:`The status of the SCIM request.`}).option(`resource-type`,{type:`string`,description:`The resource type of the SCIM request.`}).option(`request-method`,{type:`string`,description:`The request method of the SCIM request.`}).option(`resource-user-email`,{type:`string`,description:"The email address of the SCIM User resource. Pass once for a single\nlookup (`?resource_user_email=A`) or repeat the parameter\n(`?resource_user_email=A&resource_user_email=B`) to filter by multiple\nemails in one request."}).option(`resource-group-name`,{type:`string`,description:"The display name of the SCIM Group resource. Pass once for a single\nlookup (`?resource_group_name=A`) or repeat the parameter\n(`?resource_group_name=A&resource_group_name=B`) to filter by multiple\ngroup names in one request."}).option(`cf-resource-id`,{type:`string`,description:"The unique Cloudflare-generated Id of the SCIM resource. Pass once for\na single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to filter by multiple resources\nin one request."}).option(`idp-resource-id`,{type:`string`,description:"The IdP-generated Id of the SCIM resource. Pass once for a single\nlookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to filter by multiple\nresources in one request."}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yt={command:`list`,describe:`Lists Access SCIM update logs that maintain a record of updates made to User and Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:v(Jt),handler:async r=>{let i={limit:r.limit,direction:r.direction,since:r.since,until:r.until,idp_id:r[`idp-id`],status:r.status,resource_type:r[`resource-type`],request_method:r[`request-method`],resource_user_email:r[`resource-user-email`],resource_group_name:r[`resource-group-name`],cf_resource_id:r[`cf-resource-id`],idp_resource_id:r[`idp-resource-id`],page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access logs scim updates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/logs/scim/updates`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.logs.scim.updates.list({account_id:u,...i})),{successLabel:`Loaded`})}},Xt={command:`updates`,describe:`Operations for access.logs.scim.updates`,builder:e=>e.command(Yt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Zt={command:`scim`,describe:`Operations for access.logs.scim`,builder:e=>e.command(Xt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Qt={command:`logs`,describe:`Operations for access.logs`,builder:e=>e.command(Ht).command(qt).command(Zt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $t(e){return e.option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`exclude`,{type:`string`,description:`Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules. Provide as a JSON array of objects or @path/to/file.json.`}).option(`include`,{type:`string`,description:`Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules. Provide as a JSON array of objects or @path/to/file.json.`}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`require`,{type:`string`,description:`Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules. Provide as a JSON array of objects or @path/to/file.json.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const en={command:`create`,describe:`Creates a new Access reusable policy.`,builder:$t,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policies`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({decision:p(r.decision,`decision`,`text`),exclude:d(r.exclude,`exclude`),include:d(r.include,`include`),name:p(r.name,`name`,`text`),require:d(r.require,`require`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.policies.create({body:e,account_id:l})),{successLabel:`Created`});return}if(r.decision===void 0&&(r.decision=await g(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),r.include===void 0)throw Error(`--include is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await h(`name`,`The name of the Access policy.`));let m=f({decision:p(r.decision,`decision`,`text`),exclude:d(r.exclude,`exclude`),include:d(r.include,`include`),name:p(r.name,`name`,`text`),require:d(r.require,`require`)});o(await c(`Creating`,async()=>i.zeroTrust.access.policies.create({body:m,account_id:l})),{successLabel:`Created`})}};function tn(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const nn={command:`delete <policy-id>`,describe:`Deletes an Access reusable policy.`,builder:tn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policies/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.policies.delete({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Deleted`})}};function rn(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const an={command:`get <policy-id>`,describe:`Fetches a single Access reusable policy.`,builder:rn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policies/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.policies.get({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Loaded`})}};function on(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sn={command:`list`,describe:`Lists Access reusable policies.`,builder:on,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policies`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.policies.list({account_id:u,...i})),{successLabel:`Loaded`})}};function cn(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`exclude`,{type:`string`,description:`Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules. Provide as a JSON array of objects or @path/to/file.json.`}).option(`include`,{type:`string`,description:`Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules. Provide as a JSON array of objects or @path/to/file.json.`}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`require`,{type:`string`,description:`Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules. Provide as a JSON array of objects or @path/to/file.json.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ln={command:`update <policy-id>`,describe:`Updates a Access reusable policy.`,builder:cn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/policies/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({decision:p(r.decision,`decision`,`text`),exclude:d(r.exclude,`exclude`),include:d(r.include,`include`),name:p(r.name,`name`,`text`),require:d(r.require,`require`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.policies.update({body:e,account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}if(r.decision===void 0&&(r.decision=await g(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),r.include===void 0)throw Error(`--include is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await h(`name`,`The name of the Access policy.`));let m=f({decision:p(r.decision,`decision`,`text`),exclude:d(r.exclude,`exclude`),include:d(r.include,`include`),name:p(r.name,`name`,`text`),require:d(r.require,`require`)});o(await c(`Updating`,async()=>i.zeroTrust.access.policies.update({body:m,account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Updated`})}},un={command:`policies`,describe:`Operations for access.policies`,builder:e=>e.command(en).command(nn).command(an).command(sn).command(ln).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function dn(e){return e.positional(`saml-cert-set-id`,{type:`string`,description:`UID of the SAML certificate set.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fn={command:`get-pem <saml-cert-set-id>`,describe:`Downloads the current SAML encryption certificate's public key in PEM format for the specified certificate set. This endpoint is useful for providing the certificate to Identity Providers for SAML assertion encryption configuration.`,builder:dn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access saml-certificates get-pem`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/saml_certificates/${r[`saml-cert-set-id`]==null?`<saml-cert-set-id>`:encodeURIComponent(String(r[`saml-cert-set-id`]))}/pem`,pathParams:{"saml-cert-set-id":String(r[`saml-cert-set-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.samlCertificates.getPem({account_id:l,saml_cert_set_id:r[`saml-cert-set-id`]})),{successLabel:`Loaded`})}};function pn(e){return e.positional(`saml-cert-set-id`,{type:`string`,description:`UID of the SAML certificate set.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const mn={command:`get <saml-cert-set-id>`,describe:`Retrieves a specific SAML encryption certificate set by its UID, including both current and previous certificates if available.`,builder:pn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access saml-certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/saml_certificates/${r[`saml-cert-set-id`]==null?`<saml-cert-set-id>`:encodeURIComponent(String(r[`saml-cert-set-id`]))}`,pathParams:{"saml-cert-set-id":String(r[`saml-cert-set-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.samlCertificates.get({account_id:l,saml_cert_set_id:r[`saml-cert-set-id`]})),{successLabel:`Loaded`})}};function hn(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`per-page`,{type:`number`,description:`Maximum number of results per page.`}).option(`id`,{type:`string`,description:`Filter by SAML certificate set UID. Accepts a comma-separated list of UIDs.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gn={command:`list`,describe:`Returns a paginated list of the organization's SAML encryption certificate sets. Each certificate set includes the current and (if present) previous certificates.`,builder:hn,handler:async r=>{let i={page:r.page,per_page:r[`per-page`],id:r.id};if(r.dryRun){s({command:`cf zero-trust access saml-certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/saml_certificates`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.samlCertificates.list({account_id:u,...i})),{successLabel:`Loaded`})}};function _n(e){return e.positional(`saml-cert-set-id`,{type:`string`,description:`UID of the SAML certificate set to rotate.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const vn={command:`rotate <saml-cert-set-id>`,describe:`Rotates the SAML encryption certificates within the specified certificate set. This generates a new certificate and moves the current certificate to the previous slot. If a previous certificate exists, it will be deactivated and removed. This endpoint ensures zero-downtime rotation by maintaining both current and previous certificates during the transition period, allowing IdPs time to update their configurations. Automated rotation happens 30 days before a current certificate's expiration.`,builder:_n,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access saml-certificates rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/saml_certificates/${r[`saml-cert-set-id`]==null?`<saml-cert-set-id>`:encodeURIComponent(String(r[`saml-cert-set-id`]))}/rotate`,pathParams:{"saml-cert-set-id":String(r[`saml-cert-set-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.access.samlCertificates.rotate({account_id:l,saml_cert_set_id:r[`saml-cert-set-id`]})),{successLabel:`Created`})}},yn={command:`saml-certificates`,describe:`Operations for access.saml-certificates`,builder:e=>e.command(mn).command(fn).command(gn).command(vn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bn(e){return e.option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.",default:1}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).",default:`8760h`}).option(`enabled`,{type:`boolean`,description:"Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous `client_secret` stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xn={command:`create`,describe:`Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token.`,builder:bn,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access service-tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/service_tokens`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?f({client_secret_version:i[`client-secret-version`],duration:p(i.duration,`duration`,`text`),enabled:i.enabled,name:p(i.name,`name`,`text`),previous_client_secret_expires_at:p(i[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):u(i.body)});return}let l=await a(i),d=i.zone===void 0?`accounts`:`zones`,m=d===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=m:i.accountId=m,i.body){let e=u(i.body);o(await c(`Creating`,async()=>l.zeroTrust.access.serviceTokens.create({...e,account_or_zone:d,account_or_zone_id:m})),{successLabel:`Created`});return}i.name===void 0&&(i.name=await h(`name`,`The name of the service token.`));let g=f({client_secret_version:i[`client-secret-version`],duration:p(i.duration,`duration`,`text`),enabled:i.enabled,name:p(i.name,`name`,`text`),previous_client_secret_expires_at:p(i[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});o(await c(`Creating`,async()=>l.zeroTrust.access.serviceTokens.create({...g,account_or_zone:d,account_or_zone_id:m})),{successLabel:`Created`})}};function Sn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Cn={command:`delete <service-token-id>`,describe:`Deletes a service token.`,builder:Sn,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access service-tokens delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/service_tokens/${i[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(i[`service-token-id`]))}`,pathParams:{"account-or-zone":String(t),"service-token-id":String(i[`service-token-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(u===`zones`?i.zoneId=d:i.accountId=d,!await _({force:!!i.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>l.zeroTrust.access.serviceTokens.delete({account_or_zone:u,account_or_zone_id:d,service_token_id:i[`service-token-id`]})),{successLabel:`Deleted`})}};function wn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Tn={command:`get <service-token-id>`,describe:`Fetches a single service token.`,builder:wn,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access service-tokens get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/service_tokens/${i[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(i[`service-token-id`]))}`,pathParams:{"account-or-zone":String(t),"service-token-id":String(i[`service-token-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.access.serviceTokens.get({account_or_zone:u,account_or_zone_id:d,service_token_id:i[`service-token-id`]})),{successLabel:`Loaded`})}};function En(e){return e.option(`name`,{type:`string`,description:`The name of the service token.`}).option(`search`,{type:`string`,description:`Search for service tokens by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dn={command:`list`,describe:`Lists all service tokens.`,builder:En,handler:async i=>{let l={name:i.name,search:i.search,page:i.page,per_page:i[`per-page`]};if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access service-tokens list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/service_tokens`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},query:l,bodyKind:`none`});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();d===`zones`?i.zoneId=f:i.accountId=f,o(await c(`Loading`,async()=>u.zeroTrust.access.serviceTokens.list({account_or_zone:d,account_or_zone_id:f,...l})),{successLabel:`Loaded`})}};function On(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const kn={command:`refresh <service-token-id>`,describe:`Refreshes the expiration of a service token.`,builder:On,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access service-tokens refresh`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/service_tokens/${r[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(r[`service-token-id`]))}/refresh`,pathParams:{"service-token-id":String(r[`service-token-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.access.serviceTokens.refresh({account_id:l,service_token_id:r[`service-token-id`]})),{successLabel:`Created`})}};function An(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. If not provided, it defaults to the current timestamp in order to immediately expire the previous secret."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const jn={command:`rotate <service-token-id>`,describe:`Generates a new Client Secret for a service token and revokes the old one.`,builder:An,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access service-tokens rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/service_tokens/${r[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(r[`service-token-id`]))}/rotate`,pathParams:{"service-token-id":String(r[`service-token-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({previous_client_secret_expires_at:p(r[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.serviceTokens.rotate({...e,account_id:l,service_token_id:r[`service-token-id`]})),{successLabel:`Created`});return}let d=f({previous_client_secret_expires_at:p(r[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.serviceTokens.rotate({...d,account_id:l,service_token_id:r[`service-token-id`]})),{successLabel:`Created`})}};function Mn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`."}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h)."}).option(`enabled`,{type:`boolean`,description:"Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous `client_secret` stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Nn={command:`update <service-token-id>`,describe:`Updates a configured service token.`,builder:Mn,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust access service-tokens update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/service_tokens/${i[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(i[`service-token-id`]))}`,pathParams:{"account-or-zone":String(t),"service-token-id":String(i[`service-token-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?f({client_secret_version:i[`client-secret-version`],duration:p(i.duration,`duration`,`text`),enabled:i.enabled,name:p(i.name,`name`,`text`),previous_client_secret_expires_at:p(i[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):u(i.body)});return}let l=await a(i),d=i.zone===void 0?`accounts`:`zones`,m=d===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=m:i.accountId=m,i.body){let e=u(i.body);o(await c(`Updating`,async()=>l.zeroTrust.access.serviceTokens.update({...e,account_or_zone:d,account_or_zone_id:m,service_token_id:i[`service-token-id`]})),{successLabel:`Updated`});return}let h=f({client_secret_version:i[`client-secret-version`],duration:p(i.duration,`duration`,`text`),enabled:i.enabled,name:p(i.name,`name`,`text`),previous_client_secret_expires_at:p(i[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});o(await c(`Updating`,async()=>l.zeroTrust.access.serviceTokens.update({...h,account_or_zone:d,account_or_zone_id:m,service_token_id:i[`service-token-id`]})),{successLabel:`Updated`})}},Pn={command:`service-tokens`,describe:`Operations for access.service-tokens`,builder:e=>e.command(xn).command(Cn).command(Tn).command(Dn).command(kn).command(jn).command(Nn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Fn(e){return e.option(`name`,{type:`string`,description:`The name of the tag`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const In={command:`create`,describe:`Create a tag`,builder:Fn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access tags create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/tags`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.tags.create({...e,account_id:l})),{successLabel:`Created`});return}let d=f({name:p(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.tags.create({...d,account_id:l})),{successLabel:`Created`})}};function Ln(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Rn={command:`delete <tag-name>`,describe:`Delete a tag`,builder:Ln,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access tags delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/tags/${r[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(r[`tag-name`]))}`,pathParams:{"tag-name":String(r[`tag-name`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.tags.delete({account_id:l,tag_name:r[`tag-name`]})),{successLabel:`Deleted`})}};function zn(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bn={command:`get <tag-name>`,describe:`Get a tag`,builder:zn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access tags get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/tags/${r[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(r[`tag-name`]))}`,pathParams:{"tag-name":String(r[`tag-name`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.tags.get({account_id:l,tag_name:r[`tag-name`]})),{successLabel:`Loaded`})}};function Vn(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Hn={command:`list`,describe:`List tags`,builder:Vn,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access tags list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/tags`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.tags.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Un(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`name`,{type:`string`,description:`The name of the tag`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A tag`})}const Wn={command:`update <tag-name>`,describe:`Update a tag`,builder:Un,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access tags update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/tags/${r[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(r[`tag-name`]))}`,pathParams:{"tag-name":String(r[`tag-name`]??``)},bodyKind:`json`,body:r.body===void 0?f({name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.tags.update({...e,account_id:l,tag_name:r[`tag-name`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await h(`name`,`The name of the tag`));let d=f({name:p(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.access.tags.update({...d,account_id:l,tag_name:r[`tag-name`]})),{successLabel:`Updated`})}},Gn={command:`tags`,describe:`Operations for access.tags`,builder:e=>e.command(In).command(Rn).command(Bn).command(Hn).command(Wn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Kn(e){return e.positional(`nonce`,{type:`string`,description:`Nonce`,demandOption:!0}).option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qn={command:`get <nonce>`,describe:`Get an active session for a single user.`,builder:Kn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users active-sessions get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/active_sessions/${r.nonce==null?`<nonce>`:encodeURIComponent(String(r.nonce))}`,pathParams:{"user-id":String(r[`user-id`]??``),nonce:String(r.nonce??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.users.activeSessions.get({account_id:l,user_id:r[`user-id`],nonce:r.nonce})),{successLabel:`Loaded`})}};function Jn(e){return e.option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yn={command:`list`,describe:`Get active sessions for a single user.`,builder:Jn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users active-sessions list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/active_sessions`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.users.activeSessions.list({account_id:l,user_id:r[`user-id`]})),{successLabel:`Loaded`})}},Xn={command:`active-sessions`,describe:`Operations for access.users.active-sessions`,builder:e=>e.command(qn).command(Yn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Zn(e){return e.option(`email`,{type:`string`,description:`The email of the user.`}).option(`name`,{type:`string`,description:`The name of the user.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Qn={command:`create`,describe:`Creates a new user.`,builder:Zn,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({email:p(r.email,`email`,`text`),name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.access.users.create({...e,account_id:l})),{successLabel:`Created`});return}r.email===void 0&&(r.email=await h(`email`,`The email of the user.`));let d=f({email:p(r.email,`email`,`text`),name:p(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.access.users.create({...d,account_id:l})),{successLabel:`Created`})}};function $n(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const er={command:`delete <user-id>`,describe:`Deletes a specific user for an account. This will also revoke any active seats and tokens for the user.`,builder:$n,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.access.users.delete({account_id:l,user_id:r[`user-id`]})),{successLabel:`Deleted`})}};function tr(e){return e.option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const nr={command:`list`,describe:`Get all failed login attempts for a single user.`,builder:tr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users failed-logins list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/failed_logins`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.users.failedLogins.list({account_id:l,user_id:r[`user-id`]})),{successLabel:`Loaded`})}},rr={command:`failed-logins`,describe:`Operations for access.users.failed-logins`,builder:e=>e.command(nr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ir(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ar={command:`get <user-id>`,describe:`Gets a specific user for an account.`,builder:ir,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.users.get({account_id:l,user_id:r[`user-id`]})),{successLabel:`Loaded`})}};function or(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sr={command:`get <user-id>`,describe:`Get last seen identity for a single user.`,builder:or,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users last-seen-identity get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/last_seen_identity`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.access.users.lastSeenIdentity.get({account_id:l,user_id:r[`user-id`]})),{successLabel:`Loaded`})}},cr={command:`last-seen-identity`,describe:`Operations for access.users.last-seen-identity`,builder:e=>e.command(sr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function lr(e){return e.option(`name`,{type:`string`,description:`The name of the user.`}).option(`email`,{type:`string`,description:`The email of the user.`}).option(`search`,{type:`string`,description:`Search for users by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ur={command:`list`,describe:`Gets a list of users for an account.`,builder:lr,handler:async r=>{let i={name:r.name,email:r.email,search:r.search,page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust access users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.access.users.list({account_id:u,...i})),{successLabel:`Loaded`})}};function dr(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`email`,{type:`string`,description:`The email of the user.`}).option(`name`,{type:`string`,description:`The name of the user.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const fr={command:`update <user-id>`,describe:`Updates a specific user's name for an account. Requires the user's current email as confirmation (email cannot be changed).`,builder:dr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust access users update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({email:p(r.email,`email`,`text`),name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.access.users.update({...e,account_id:l,user_id:r[`user-id`]})),{successLabel:`Updated`});return}r.email===void 0&&(r.email=await h(`email`,`The email of the user.`)),r.name===void 0&&(r.name=await h(`name`,`The name of the user.`));let d=f({email:p(r.email,`email`,`text`),name:p(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.access.users.update({...d,account_id:l,user_id:r[`user-id`]})),{successLabel:`Updated`})}},pr={command:`users`,describe:`Operations for access.users`,builder:e=>e.command(Qn).command(er).command(ar).command(ur).command(fr).command(Xn).command(rr).command(cr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},mr={command:`access`,describe:`Operations for access`,builder:e=>e.command(ge).command(ye).command(Ae).command(Ke).command(at).command(ft).command(Ct).command(Mt).command(zt).command(Qt).command(un).command(yn).command(Pn).command(Gn).command(pr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function hr(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gr={command:`update <policy-id>`,describe:`Converts an application-scoped policy to a reusable policy. The policy will no longer be exclusively scoped to the application. Further updates to the policy should go through the /accounts/{account_id}/policies/{uid} endpoint.`,builder:hr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust apps policies make reusable update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}/policies/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/make_reusable`,pathParams:{"app-id":String(r[`app-id`]??``),"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Updating`,async()=>i.zeroTrust.apps.policies.make.reusable.update({account_id:l,app_id:r[`app-id`],policy_id:r[`policy-id`]})),{successLabel:`Updated`})}},_r={command:`reusable`,describe:`Operations for apps.policies.make.reusable`,builder:e=>e.command(gr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},vr={command:`make`,describe:`Operations for apps.policies.make`,builder:e=>e.command(_r).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},yr={command:`policies`,describe:`Operations for apps.policies`,builder:e=>e.command(vr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function br(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xr={command:`list`,describe:`Retrieve the statuses of your applications.`,builder:br,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust apps review status list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/apps/review_status`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.apps.review.status.list({account_id:l})),{successLabel:`Loaded`})}};function Sr(e){return e.option(`approved-apps`,{type:`string`,array:!0,description:`Contains the ids of the approved applications.`}).option(`in-review-apps`,{type:`string`,array:!0,description:`Contains the ids of the applications in review.`}).option(`unapproved-apps`,{type:`string`,array:!0,description:`Contains the ids of the unapproved applications.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Cr={command:`update`,describe:`Update the statuses of your applications.`,builder:Sr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust apps review status update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/apps/review_status`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({approved_apps:r[`approved-apps`],in_review_apps:r[`in-review-apps`],unapproved_apps:r[`unapproved-apps`]}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.apps.review.status.update({...e,account_id:l})),{successLabel:`Updated`});return}if(r[`approved-apps`]===void 0)throw Error(`--approved-apps is required (or pass --body with this field set).`);if(r[`in-review-apps`]===void 0)throw Error(`--in-review-apps is required (or pass --body with this field set).`);if(r[`unapproved-apps`]===void 0)throw Error(`--unapproved-apps is required (or pass --body with this field set).`);let d=f({approved_apps:r[`approved-apps`],in_review_apps:r[`in-review-apps`],unapproved_apps:r[`unapproved-apps`]});o(await c(`Updating`,async()=>i.zeroTrust.apps.review.status.update({...d,account_id:l})),{successLabel:`Updated`})}},wr={command:`status`,describe:`Operations for apps.review.status`,builder:e=>e.command(xr).command(Cr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Tr={command:`review`,describe:`Operations for apps.review`,builder:e=>e.command(wr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Er={command:`apps`,describe:`Operations for apps`,builder:e=>e.command(yr).command(Tr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Dr(e){return e.option(`application-id`,{type:`string`,description:`Application/vendor identifier.`,demandOption:!0}).option(`page`,{type:`number`,description:`A page number within the paginated result set.`}).option(`page-size`,{type:`number`,description:`Number of results to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Or={command:`list`,describe:`Returns available auth methods for the specified vendor, including credential schema, instructions, and example payloads. Use this to understand what credentials are required before calling POST /v2/integrations.`,builder:v(Dr),handler:async r=>{let i={page:r.page,page_size:r[`page-size`]};if(r.dryRun){s({command:`cf zero-trust casb applications authMethods list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/applications/${r[`application-id`]==null?`<application-id>`:encodeURIComponent(String(r[`application-id`]))}/auth-methods`,pathParams:{"application-id":String(r[`application-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.casb.applications.authMethods.list({account_id:u,application_id:r[`application-id`],...i})),{successLabel:`Loaded`})}},kr={command:`authMethods`,describe:`Operations for casb.applications.authMethods`,builder:e=>e.command(Or).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ar(e){return e.positional(`application-id`,{type:`string`,description:`Application/vendor identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const jr={command:`get <application-id>`,describe:`Returns full application details including auth methods, use cases, and permissions.`,builder:v(Ar),handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb applications get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/applications/${r[`application-id`]==null?`<application-id>`:encodeURIComponent(String(r[`application-id`]))}`,pathParams:{"application-id":String(r[`application-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.casb.applications.get({account_id:l,application_id:r[`application-id`]})),{successLabel:`Loaded`})}};function Mr(e){return e.option(`environment`,{type:`string`,description:`Filter by supported environment (standard, fedramp).`}).option(`page`,{type:`number`,description:`A page number within the paginated result set.`}).option(`page-size`,{type:`number`,description:`Number of results to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Nr={command:`list`,describe:`Returns a list of available applications with use cases and permissions.`,builder:Mr,handler:async r=>{let i={environment:r.environment,page:r.page,page_size:r[`page-size`]};if(r.dryRun){s({command:`cf zero-trust casb applications list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/applications`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.casb.applications.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Pr(e){return e.option(`application-id`,{type:`string`,description:`Application/vendor identifier.`,demandOption:!0}).option(`auth-method`,{type:`string`,description:`Filter by auth method id. Get available ids from GET /v2/applications.`}).option(`environment`,{type:`string`,description:`Filter by environment.`,choices:[`fedramp`,`standard`]}).option(`page`,{type:`number`,description:`A page number within the paginated result set.`}).option(`page-size`,{type:`number`,description:`Number of results to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fr={command:`list`,describe:`Returns all available setup flows for the application, one per auth method.`,builder:v(Pr),handler:async r=>{let i={auth_method:r[`auth-method`],environment:r.environment,page:r.page,page_size:r[`page-size`]};if(r.dryRun){s({command:`cf zero-trust casb applications setupFlows list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/applications/${r[`application-id`]==null?`<application-id>`:encodeURIComponent(String(r[`application-id`]))}/setup-flows`,pathParams:{"application-id":String(r[`application-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.casb.applications.setupFlows.list({account_id:u,application_id:r[`application-id`],...i})),{successLabel:`Loaded`})}},Ir={command:`setupFlows`,describe:`Operations for casb.applications.setupFlows`,builder:e=>e.command(Fr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Lr={command:`applications`,describe:`Operations for casb.applications`,builder:e=>e.command(jr).command(Nr).command(kr).command(Ir).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Rr(e){return e.option(`application`,{type:`string`,description:"Vendor/application slug (e.g., GOOGLE_WORKSPACE).\n\n* `ANTHROPIC` - ANTHROPIC\n* `AWS` - AWS\n* `BITBUCKET` - BITBUCKET\n* `BOX` - BOX\n* `CONFLUENCE` - CONFLUENCE\n* `DROPBOX` - DROPBOX\n* `GITHUB` - GITHUB\n* `GOOGLE_CLOUD_PLATFORM` - GOOGLE_CLOUD_PLATFORM\n* `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE\n* `JIRA` - JIRA\n* `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL\n* `OPENAI` - OPENAI\n* `SALESFORCE` - SALESFORCE\n* `SERVICENOW` - SERVICENOW\n* `SLACK` - SLACK",choices:[`ANTHROPIC`,`AWS`,`BITBUCKET`,`BOX`,`CONFLUENCE`,`DROPBOX`,`GITHUB`,`GOOGLE_CLOUD_PLATFORM`,`GOOGLE_WORKSPACE`,`JIRA`,`MICROSOFT_INTERNAL`,`OPENAI`,`SALESFORCE`,`SERVICENOW`,`SLACK`]}).option(`auth-method`,{type:`string`,description:`Authentication method slug (uses default if omitted).`}).option(`dlp-profiles`,{type:`string`,array:!0,description:`List of DLP profile IDs to associate.`}).option(`name`,{type:`string`,description:`Name of the integration.`}).option(`permissions`,{type:`string`,array:!0,description:`List of permission scopes (uses policy defaults if empty).`}).option(`use-cases`,{type:`string`,array:!0,description:`List of use case or feature slugs to enroll (e.g., ['casb', 'ces', 'auto_remediation']).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Serializer for v2 integration create requests.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const zr={command:`create`,describe:"Creates a new integration for the specified application. Integration creation with OAuth is not supported by API at the moment. For other auth methods, use `GET /v2/applications/{application_id}/credential-guide` to see the required credential structure and example payloads for each vendor.",builder:Rr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({application:p(r.application,`application`,`text`),auth_method:p(r[`auth-method`],`auth-method`,`text`),dlp_profiles:r[`dlp-profiles`],name:p(r.name,`name`,`text`),permissions:r.permissions,use_cases:r[`use-cases`]}):u(r.body)});return}let d=await a(r),_=r.local?e:await t();if(r.accountId=_,r.file){let e=m(r.file);o(await c(`Creating`,async()=>i(d,`POST`,`/accounts/${_}/one/integrations`,{body:e,headers:{"Content-Type":`text/plain;charset=UTF-8`}})),{successLabel:`Created`});return}if(r.body){let e=u(r.body);o(await c(`Creating`,async()=>i(d,`POST`,`/accounts/${_}/one/integrations`,{body:e})),{successLabel:`Created`});return}r.application===void 0&&(r.application=await g(`application`,"Vendor/application slug (e.g., GOOGLE_WORKSPACE).  * `ANTHROPIC` - ANTHROPIC * `AWS` - AWS * `BITBUCKET` - BITBUCKET * `BOX` - BOX * `CONFLUENCE` - CONFLUENCE * `DROPBOX` - DROPBOX * `GITHUB` - GITHUB * `GOOGLE_CLOUD_PLATFORM` - GOOGLE_CLOUD_PLATFORM * `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE * `JIRA` - JIRA * `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL * `OPENAI` - OPENAI * `SALESFORCE` - SALESFORCE * `SERVICENOW` - SERVICENOW * `SLACK` - SLACK",[`ANTHROPIC`,`AWS`,`BITBUCKET`,`BOX`,`CONFLUENCE`,`DROPBOX`,`GITHUB`,`GOOGLE_CLOUD_PLATFORM`,`GOOGLE_WORKSPACE`,`JIRA`,`MICROSOFT_INTERNAL`,`OPENAI`,`SALESFORCE`,`SERVICENOW`,`SLACK`])),r.name===void 0&&(r.name=await h(`name`,`Name of the integration.`));let v={};r.application!==void 0&&l(v,[`application`],p(r.application,`application`,`text`)),r[`auth-method`]!==void 0&&l(v,[`auth_method`],p(r[`auth-method`],`auth-method`,`text`)),r[`dlp-profiles`]!==void 0&&l(v,[`dlp_profiles`],r[`dlp-profiles`]),r.name!==void 0&&l(v,[`name`],p(r.name,`name`,`text`)),r.permissions!==void 0&&l(v,[`permissions`],r.permissions),r[`use-cases`]!==void 0&&l(v,[`use_cases`],r[`use-cases`]),o(await c(`Creating`,async()=>i(d,`POST`,`/accounts/${_}/one/integrations`,{body:Object.keys(v).length>0?v:void 0})),{successLabel:`Created`})}};function Br(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Vr={command:`delete <id>`,describe:`Delete an integration by soft-deleting it.`,builder:Br,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations/${r.id==null?`<id>`:encodeURIComponent(String(r.id))}`,pathParams:{id:String(r.id??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.casb.integrations.delete({account_id:l,id:r.id})),{successLabel:`Deleted`})}};function Hr(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ur={command:`get <id>`,describe:`Returns full integration details including use cases and permissions.`,builder:Hr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations/${r.id==null?`<id>`:encodeURIComponent(String(r.id))}`,pathParams:{id:String(r.id??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.casb.integrations.get({account_id:l,id:r.id})),{successLabel:`Loaded`})}};function Wr(e){return e.option(`application`,{type:`string`,description:`Filter by application/vendor (e.g., GOOGLE_WORKSPACE, MICROSOFT_INTERNAL).`}).option(`direction`,{type:`string`,description:`Direction to order results.`,choices:[`asc`,`desc`]}).option(`dlp-enabled`,{type:`boolean`,description:`Filter by DLP enabled status (true/false).`}).option(`order`,{type:`string`,description:`Field to order results by.`,choices:[`application`,`created`,`name`,`status`]}).option(`page`,{type:`number`,description:`Page number within the paginated result set.`}).option(`page-size`,{type:`number`,description:`Number of results per page.`}).option(`search`,{type:`string`,description:`Search integrations by name or application.`}).option(`status`,{type:`string`,description:`Filter by integration status.`,choices:[`Healthy`,`Initializing`,`Offline`,`Unhealthy`]}).option(`use-cases`,{type:`string`,description:`Filter by enabled use cases (e.g., casb, ces). Matches integrations enrolled in any of the specified values. Can be specified multiple times.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gr={command:`list`,describe:`Returns a paginated list of integrations for the account.`,builder:v(Wr),handler:async r=>{let i={application:r.application,direction:r.direction,dlp_enabled:r[`dlp-enabled`],order:r.order,page:r.page,page_size:r[`page-size`],search:r.search,status:r.status,use_cases:r[`use-cases`]};if(r.dryRun){s({command:`cf zero-trust casb integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.casb.integrations.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Kr(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qr={command:`pause <id>`,describe:`Pauses an integration, stopping all crawlers.`,builder:Kr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations pause`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations/${r.id==null?`<id>`:encodeURIComponent(String(r.id))}/pause`,pathParams:{id:String(r.id??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.casb.integrations.pause({account_id:l,id:r.id})),{successLabel:`Created`})}};function Jr(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yr={command:`resume <id>`,describe:`Resumes a paused integration, restarting crawlers.`,builder:Jr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations resume`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations/${r.id==null?`<id>`:encodeURIComponent(String(r.id))}/resume`,pathParams:{id:String(r.id??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.casb.integrations.resume({account_id:l,id:r.id})),{successLabel:`Created`})}};function Xr(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dlp-profiles`,{type:`string`,array:!0,description:`List of DLP profile IDs to associate with the integration.`}).option(`name`,{type:`string`,description:`Name of the integration.`}).option(`permissions`,{type:`string`,array:!0,description:`List of permission scopes granted to the integration.`}).option(`use-cases`,{type:`string`,array:!0,description:`List of use case or feature slugs to enroll (e.g., ['casb', 'ces', 'auto_remediation']).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Serializer for v2 integration PATCH requests.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Zr={command:`update <id>`,describe:`Updates an integration's name, permissions, DLP profiles, use cases, or credentials.`,builder:Xr,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust casb integrations update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/one/integrations/${r.id==null?`<id>`:encodeURIComponent(String(r.id))}`,pathParams:{id:String(r.id??``)},bodyKind:`json`,body:r.body===void 0?f({dlp_profiles:r[`dlp-profiles`],name:p(r.name,`name`,`text`),permissions:r.permissions,use_cases:r[`use-cases`]}):u(r.body)});return}let d=await a(r),h=r.local?e:await t();if(r.accountId=h,r.file){let e=m(r.file);o(await c(`Updating`,async()=>i(d,`PATCH`,`/accounts/${h}/one/integrations/${encodeURIComponent(String(r.id))}`,{body:e,headers:{"Content-Type":`text/plain;charset=UTF-8`}})),{successLabel:`Updated`});return}if(r.body){let e=u(r.body);o(await c(`Updating`,async()=>i(d,`PATCH`,`/accounts/${h}/one/integrations/${encodeURIComponent(String(r.id))}`,{body:e})),{successLabel:`Updated`});return}let g={};r[`dlp-profiles`]!==void 0&&l(g,[`dlp_profiles`],r[`dlp-profiles`]),r.name!==void 0&&l(g,[`name`],p(r.name,`name`,`text`)),r.permissions!==void 0&&l(g,[`permissions`],r.permissions),r[`use-cases`]!==void 0&&l(g,[`use_cases`],r[`use-cases`]),o(await c(`Updating`,async()=>i(d,`PATCH`,`/accounts/${h}/one/integrations/${encodeURIComponent(String(r.id))}`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Updated`})}},Qr={command:`integrations`,describe:`Operations for casb.integrations`,builder:e=>e.command(zr).command(Vr).command(Ur).command(Gr).command(qr).command(Yr).command(Zr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},$r={command:`casb`,describe:`Operations for casb`,builder:e=>e.command(Lr).command(Qr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ei(e){return e.option(`icmp-proxy-enabled`,{type:`boolean`,description:`A flag to enable the ICMP proxy for the account network.`}).option(`offramp-warp-enabled`,{type:`boolean`,description:`A flag to enable WARP to WARP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ti={command:`edit`,describe:`Updates the Zero Trust Connectivity Settings for the given account.`,builder:ei,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust connectivity-settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zerotrust/connectivity_settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({icmp_proxy_enabled:r[`icmp-proxy-enabled`],offramp_warp_enabled:r[`offramp-warp-enabled`]}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.connectivitySettings.edit({...e,account_id:l})),{successLabel:`Updated`});return}let d=f({icmp_proxy_enabled:r[`icmp-proxy-enabled`],offramp_warp_enabled:r[`offramp-warp-enabled`]});o(await c(`Updating`,async()=>i.zeroTrust.connectivitySettings.edit({...d,account_id:l})),{successLabel:`Updated`})}};function ni(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ri={command:`get`,describe:`Gets the Zero Trust Connectivity Settings for the given account.`,builder:ni,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust connectivity-settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zerotrust/connectivity_settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.connectivitySettings.get({account_id:l})),{successLabel:`Loaded`})}},ii={command:`connectivity-settings`,describe:`Operations for connectivity-settings`,builder:e=>e.command(ti).command(ri).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ai(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const oi={command:`list`,describe:`Retrieves a list of all available target environments with their display names. This endpoint is in Beta.`,builder:ai,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices client target environments list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/client-versions/target-environments`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.client.target.environments.list({account_id:l})),{successLabel:`Loaded`})}},si={command:`environments`,describe:`Operations for devices.client.target.environments`,builder:e=>e.command(oi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ci={command:`target`,describe:`Operations for devices.client.target`,builder:e=>e.command(si).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function li(e){return e.option(`target-environment`,{type:`string`,description:`The target environment for the client version (e.g., windows, macos).`,demandOption:!0}).option(`release-track`,{type:`string`,description:`The release track (ga for General Availability, beta for Beta releases).`,choices:[`ga`,`beta`],demandOption:!0}).option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The maximum number of versions to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ui={command:`list`,describe:`Lists available WARP client versions for a specific target environment and release track. This endpoint is in Beta.`,builder:v(li),handler:async r=>{let i={target_environment:r[`target-environment`],release_track:r[`release-track`],page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust devices client versions list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/client-versions`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.client.versions.list({account_id:u,...i})),{successLabel:`Loaded`})}},di={command:`versions`,describe:`Operations for devices.client.versions`,builder:e=>e.command(ui).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},fi={command:`client`,describe:`Operations for devices.client`,builder:e=>e.command(ci).command(di).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pi(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const mi={command:`delete <device-id>`,describe:`Deletes a WARP device.`,builder:pi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/physical-devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}`,pathParams:{"device-id":String(r[`device-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.delete({account_id:l,device_id:r[`device-id`]})),{successLabel:`Deleted`})}};function hi(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for the deployment group.`}).option(`policy-ids`,{type:`string`,array:!0,description:`Contains an optional list of policy IDs assigned to a group.`}).option(`version-config`,{type:`string`,description:`Contains at least one version configuration. Provide as a JSON array of objects or @path/to/file.json.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const gi={command:`create`,describe:`Creates a new deployment group. Policy IDs must be unique across all deployment groups. This endpoint is in Beta.`,builder:hi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices deployment groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/deployment-groups`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({name:p(r.name,`name`,`text`),policy_ids:r[`policy-ids`],version_config:d(r[`version-config`],`version-config`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.deployment.groups.create({...e,account_id:l})),{successLabel:`Created`});return}if(r.name===void 0&&(r.name=await h(`name`,`A user-friendly name for the deployment group.`)),r[`version-config`]===void 0)throw Error(`--version-config is required (or pass --body with this field set).`);let m=f({name:p(r.name,`name`,`text`),policy_ids:r[`policy-ids`],version_config:d(r[`version-config`],`version-config`)});o(await c(`Creating`,async()=>i.zeroTrust.devices.deployment.groups.create({...m,account_id:l})),{successLabel:`Created`})}};function _i(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const vi={command:`delete <group-id>`,describe:`Deletes a deployment group. Associated policies no longer apply and devices stop receiving version targets. This endpoint is in Beta.`,builder:_i,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices deployment groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/deployment-groups/${r[`group-id`]==null?`<group-id>`:encodeURIComponent(String(r[`group-id`]))}`,pathParams:{"group-id":String(r[`group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.deployment.groups.delete({account_id:l,group_id:r[`group-id`]})),{successLabel:`Deleted`})}};function yi(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const bi={command:`get <group-id>`,describe:`Fetches a single deployment group by its ID. This endpoint is in Beta.`,builder:yi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices deployment groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/deployment-groups/${r[`group-id`]==null?`<group-id>`:encodeURIComponent(String(r[`group-id`]))}`,pathParams:{"group-id":String(r[`group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.deployment.groups.get({account_id:l,group_id:r[`group-id`]})),{successLabel:`Loaded`})}};function xi(e){return e.option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The maximum number of deployment groups to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Si={command:`list`,describe:`Lists all deployment groups for an account. Use deployment groups to assign target WARP client versions to specific devices. This endpoint is in Beta.`,builder:xi,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust devices deployment groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/deployment-groups`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.deployment.groups.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Ci(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for the deployment group.`}).option(`policy-ids`,{type:`string`,array:!0,description:`Replaces the entire list of policy IDs.`}).option(`version-config`,{type:`string`,description:`Replaces the entire version_config array. Provide as a JSON array of objects or @path/to/file.json.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const wi={command:`update <group-id>`,describe:`Updates a deployment group. Returns 409 if any newly added policy IDs already belong to another deployment group. This endpoint is in Beta.`,builder:Ci,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices deployment groups update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/deployment-groups/${r[`group-id`]==null?`<group-id>`:encodeURIComponent(String(r[`group-id`]))}`,pathParams:{"group-id":String(r[`group-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({name:p(r.name,`name`,`text`),policy_ids:r[`policy-ids`],version_config:d(r[`version-config`],`version-config`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.deployment.groups.update({...e,account_id:l,group_id:r[`group-id`]})),{successLabel:`Updated`});return}let m=f({name:p(r.name,`name`,`text`),policy_ids:r[`policy-ids`],version_config:d(r[`version-config`],`version-config`)});o(await c(`Updating`,async()=>i.zeroTrust.devices.deployment.groups.update({...m,account_id:l,group_id:r[`group-id`]})),{successLabel:`Updated`})}},Ti={command:`groups`,describe:`Operations for devices.deployment.groups`,builder:e=>e.command(gi).command(vi).command(bi).command(Si).command(wi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ei={command:`deployment`,describe:`Operations for devices.deployment`,builder:e=>e.command(Ti).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Di(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the device response. Supported values are: "last_seen_registration.policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Oi={command:`get <device-id>`,describe:`Fetches a single WARP device.`,builder:Di,handler:async r=>{let i={include:r.include};if(r.dryRun){s({command:`cf zero-trust devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/physical-devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}`,pathParams:{"device-id":String(r[`device-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.get({account_id:u,device_id:r[`device-id`],...i})),{successLabel:`Loaded`})}};function ki(e){return e.option(`description`,{type:`string`,description:`An optional description of the Device IP profile.`}).option(`enabled`,{type:`boolean`,description:`Whether the Device IP profile will be applied to matching devices.`,default:!0}).option(`match`,{type:`string`,description:`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`}).option(`name`,{type:`string`,description:`A user-friendly name for the Device IP profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.`}).option(`subnet-id`,{type:`string`,description:`The ID of the Subnet.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ai={command:`create`,describe:`Creates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.`,builder:ki,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices ip-profiles create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/ip-profiles`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),enabled:r.enabled,match:p(r.match,`match`,`text`),name:p(r.name,`name`,`text`),precedence:r.precedence,subnet_id:p(r[`subnet-id`],`subnet-id`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.ipProfiles.create({...e,account_id:l})),{successLabel:`Created`});return}if(r.match===void 0&&(r.match=await h(`match`,`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`)),r.name===void 0&&(r.name=await h(`name`,`A user-friendly name for the Device IP profile.`)),r.precedence===void 0)throw Error(`--precedence is required (or pass --body with this field set).`);r[`subnet-id`]===void 0&&(r[`subnet-id`]=await h(`subnet-id`,`The ID of the Subnet.`));let d=f({description:p(r.description,`description`,`text`),enabled:r.enabled,match:p(r.match,`match`,`text`),name:p(r.name,`name`,`text`),precedence:r.precedence,subnet_id:p(r[`subnet-id`],`subnet-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.devices.ipProfiles.create({...d,account_id:l})),{successLabel:`Created`})}};function ji(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Mi={command:`delete <profile-id>`,describe:`Delete a WARP Device IP profile.`,builder:ji,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices ip-profiles delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/ip-profiles/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.ipProfiles.delete({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Deleted`})}};function Ni(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pi={command:`get <profile-id>`,describe:`Fetches a single WARP Device IP profile.`,builder:Ni,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices ip-profiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/ip-profiles/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.ipProfiles.get({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Loaded`})}};function Fi(e){return e.option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The number of IP profiles to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ii={command:`list`,describe:`Lists WARP Device IP profiles.`,builder:Fi,handler:async r=>{let i={page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust devices ip-profiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/ip-profiles`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.ipProfiles.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Li(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`description`,{type:`string`,description:`An optional description of the Device IP profile.`}).option(`enabled`,{type:`boolean`,description:`Whether the Device IP profile is enabled.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`}).option(`name`,{type:`string`,description:`A user-friendly name for the Device IP profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.`}).option(`subnet-id`,{type:`string`,description:`The ID of the Subnet.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ri={command:`update <profile-id>`,describe:`Updates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.`,builder:Li,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices ip-profiles update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/ip-profiles/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),enabled:r.enabled,match:p(r.match,`match`,`text`),name:p(r.name,`name`,`text`),precedence:r.precedence,subnet_id:p(r[`subnet-id`],`subnet-id`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.ipProfiles.update({...e,account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Updated`});return}let d=f({description:p(r.description,`description`,`text`),enabled:r.enabled,match:p(r.match,`match`,`text`),name:p(r.name,`name`,`text`),precedence:r.precedence,subnet_id:p(r[`subnet-id`],`subnet-id`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.devices.ipProfiles.update({...d,account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Updated`})}},zi={command:`ip-profiles`,describe:`Operations for devices.ip-profiles`,builder:e=>e.command(Ai).command(Mi).command(Pi).command(Ii).command(Ri).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bi(e){return e.option(`cursor`,{type:`string`,description:`Opaque token indicating the starting position when requesting the next set of records. A cursor value can be obtained from the result_info.cursor field in the response.`}).option(`sort-by`,{type:`string`,description:`The device field to order results by.`,choices:[`name`,`id`,`client_version`,`last_seen_user.email`,`last_seen_at`,`active_registrations`,`created_at`]}).option(`sort-order`,{type:`string`,description:`Sort direction.`,choices:[`asc`,`desc`]}).option(`last-seen-user-email`,{type:`string`,description:`Filter by the last seen user's email.`}).option(`seen-after`,{type:`string`,description:`Filter by the last_seen timestamp - returns only devices last seen after this timestamp.`}).option(`seen-before`,{type:`string`,description:`Filter by the last_seen timestamp - returns only devices last seen before this timestamp.`}).option(`per-page`,{type:`number`,description:`The maximum number of devices to return in a single response.`}).option(`search`,{type:`string`,description:`Search by device details.`}).option(`active-registrations`,{type:`string`,description:`Include or exclude devices with active registrations. The default is "only" - return only devices with active registrations.`,choices:[`include`,`only`,`exclude`]}).option(`id`,{type:`string`,description:`Filter by a one or more device IDs.`}).option(`last-seen-registration-policy-id`,{type:`string`,description:`Filter by the ID of the device settings profile assigned to the device registration.`}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the device response. Supported values are: "last_seen_registration.policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vi={command:`list`,describe:`Lists WARP devices.`,builder:v(Bi),handler:async r=>{let i={cursor:r.cursor,sort_by:r[`sort-by`],sort_order:r[`sort-order`],"last_seen_user.email":r[`last-seen-user-email`],seen_after:r[`seen-after`],seen_before:r[`seen-before`],per_page:r[`per-page`],search:r.search,active_registrations:r[`active-registrations`],id:r.id,"last_seen_registration.policy.id":r[`last-seen-registration-policy-id`],include:r.include};if(r.dryRun){s({command:`cf zero-trust devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/physical-devices`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Hi(e){return e.option(`config-sha256`,{type:`string`,description:`The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.`}).option(`config-tls-sockaddr`,{type:`string`,description:`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`}).option(`name`,{type:`string`,description:`The name of the device managed network. This name must be unique.`}).option(`type`,{type:`string`,description:`The type of device managed network.`,choices:[`tls`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ui={command:`create`,describe:`Creates a new device managed network.`,builder:Hi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/networks`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({config:{sha256:p(r[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:p(r[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.networks.create({...e,account_id:l})),{successLabel:`Created`});return}r[`config-tls-sockaddr`]===void 0&&(r[`config-tls-sockaddr`]=await h(`config-tls-sockaddr`,`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`)),r.name===void 0&&(r.name=await h(`name`,`The name of the device managed network. This name must be unique.`)),r.type===void 0&&(r.type=await g(`type`,`The type of device managed network.`,[`tls`]));let d=f({config:{sha256:p(r[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:p(r[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.devices.networks.create({...d,account_id:l})),{successLabel:`Created`})}};function Wi(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Gi={command:`delete <network-id>`,describe:`Deletes a device managed network and fetches a list of the remaining device managed networks for an account.`,builder:Wi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/networks/${r[`network-id`]==null?`<network-id>`:encodeURIComponent(String(r[`network-id`]))}`,pathParams:{"network-id":String(r[`network-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.networks.delete({account_id:l,network_id:r[`network-id`]})),{successLabel:`Deleted`})}};function Ki(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qi={command:`get <network-id>`,describe:`Fetches details for a single managed network.`,builder:Ki,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices networks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/networks/${r[`network-id`]==null?`<network-id>`:encodeURIComponent(String(r[`network-id`]))}`,pathParams:{"network-id":String(r[`network-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.networks.get({account_id:l,network_id:r[`network-id`]})),{successLabel:`Loaded`})}};function Ji(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yi={command:`list`,describe:`Fetches a list of managed networks for an account.`,builder:Ji,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices networks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/networks`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.networks.list({account_id:l})),{successLabel:`Loaded`})}};function Xi(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`config-sha256`,{type:`string`,description:`The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.`}).option(`config-tls-sockaddr`,{type:`string`,description:`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`}).option(`name`,{type:`string`,description:`The name of the device managed network. This name must be unique.`}).option(`type`,{type:`string`,description:`The type of device managed network.`,choices:[`tls`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`config-sha256`,`config-tls-sockaddr`].some(t=>e[t]!==void 0)){let t=[`config-tls-sockaddr`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --config-* flag is set`)}return!0})}const Zi={command:`update <network-id>`,describe:`Updates a configured device managed network.`,builder:Xi,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices networks update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/networks/${r[`network-id`]==null?`<network-id>`:encodeURIComponent(String(r[`network-id`]))}`,pathParams:{"network-id":String(r[`network-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({config:{sha256:p(r[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:p(r[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.networks.update({...e,account_id:l,network_id:r[`network-id`]})),{successLabel:`Updated`});return}let d=f({config:{sha256:p(r[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:p(r[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.devices.networks.update({...d,account_id:l,network_id:r[`network-id`]})),{successLabel:`Updated`})}},Qi={command:`networks`,describe:`Operations for devices.networks`,builder:e=>e.command(Ui).command(Gi).command(qi).command(Yi).command(Zi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $i(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ea={command:`get <registration-id>`,describe:`Fetches one-time use admin override codes for a registration. This relies on the **Admin Override** setting being enabled in your device configuration.`,builder:$i,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices override-codes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations/${r[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(r[`registration-id`]))}/override_codes`,pathParams:{"registration-id":String(r[`registration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.overrideCodes.get({account_id:l,registration_id:r[`registration-id`]})),{successLabel:`Loaded`})}};function ta(e){return e.option(`device-id`,{type:`string`,description:`Registration ID. Equal to Device ID except for accounts which enabled [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/).`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const na={command:`list`,describe:`Fetches a one-time use admin override code for a device. This relies on the **Admin Override** setting being enabled in your device configuration. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated:** please use GET /accounts/{account_id}/devices/registrations/{registration_id}/override_codes instead.`,builder:ta,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices override-codes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}/override_codes`,pathParams:{"device-id":String(r[`device-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.overrideCodes.list({account_id:l,device_id:r[`device-id`]})),{successLabel:`Loaded`})}},ra={command:`override-codes`,describe:`Operations for devices.override-codes`,builder:e=>e.command(ea).command(na).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ia(e){return e.option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`,default:!1}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`,default:!1}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`,default:!0}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`,default:0}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`,default:180}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`.",default:!1}).option(`dns-search-suffixes`,{type:`string`,description:`List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear. Provide as a JSON array of objects or @path/to/file.json.`}).option(`enabled`,{type:`boolean`,description:`Whether the policy will be applied to matching devices.`,default:!0}).option(`exclude`,{type:`string`,description:`List of routes excluded in the WARP client's tunnel. Both 'exclude' and 'include' cannot be set in the same request. Provide as a JSON array of objects or @path/to/file.json.`}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`,default:!1}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`include`,{type:`string`,description:`List of routes included in the WARP client's tunnel. Both 'exclude' and 'include' cannot be set in the same request. Provide as a JSON array of objects or @path/to/file.json.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`}).option(`name`,{type:`string`,description:`The name of the device settings profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`,default:!0}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`,default:!1}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`,default:``}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`,default:!1}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`,default:``}).option(`uninstall-protection`,{type:`boolean`,description:`Determines whether uninstalling the WARP client requires an override code. (Windows only).`,default:!1}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const aa={command:`create`,describe:`Creates a device settings profile to be applied to certain devices matching the criteria.`,builder:ia,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],disable_auto_fallback:r[`disable-auto-fallback`],dns_search_suffixes:d(r[`dns-search-suffixes`],`dns-search-suffixes`),enabled:r.enabled,exclude:d(r.exclude,`exclude`),exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},include:d(r.include,`include`),lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],match:p(r.match,`match`,`text`),name:p(r.name,`name`,`text`),precedence:r.precedence,register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:p(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:p(r[`tunnel-protocol`],`tunnel-protocol`,`text`),uninstall_protection:r[`uninstall-protection`],virtual_networks:{allowed:r[`virtual-networks-allowed`],default:p(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.policies.custom.create({...e,account_id:l})),{successLabel:`Created`});return}if(r.match===void 0&&(r.match=await h(`match`,`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`)),r.name===void 0&&(r.name=await h(`name`,`The name of the device settings profile.`)),r.precedence===void 0)throw Error(`--precedence is required (or pass --body with this field set).`);let m=f({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],disable_auto_fallback:r[`disable-auto-fallback`],dns_search_suffixes:d(r[`dns-search-suffixes`],`dns-search-suffixes`),enabled:r.enabled,exclude:d(r.exclude,`exclude`),exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},include:d(r.include,`include`),lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],match:p(r.match,`match`,`text`),name:p(r.name,`name`,`text`),precedence:r.precedence,register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:p(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:p(r[`tunnel-protocol`],`tunnel-protocol`,`text`),uninstall_protection:r[`uninstall-protection`],virtual_networks:{allowed:r[`virtual-networks-allowed`],default:p(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}});o(await c(`Creating`,async()=>i.zeroTrust.devices.policies.custom.create({...m,account_id:l})),{successLabel:`Created`})}};function oa(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const sa={command:`delete <policy-id>`,describe:`Deletes a device settings profile and fetches a list of the remaining profiles for an account.`,builder:oa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.policies.custom.delete({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Deleted`})}};function ca(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`}).option(`description`,{type:`string`,description:`A description of the policy.`}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`."}).option(`dns-search-suffixes`,{type:`string`,description:`List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear. Provide as a JSON array of objects or @path/to/file.json.`}).option(`enabled`,{type:`boolean`,description:`Whether the policy will be applied to matching devices.`}).option(`exclude`,{type:`string`,description:`List of routes excluded in the WARP client's tunnel. Both 'exclude' and 'include' cannot be set in the same request. Provide as a JSON array of objects or @path/to/file.json.`}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`include`,{type:`string`,description:`List of routes included in the WARP client's tunnel. Both 'exclude' and 'include' cannot be set in the same request. Provide as a JSON array of objects or @path/to/file.json.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`}).option(`name`,{type:`string`,description:`The name of the device settings profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`}).option(`uninstall-protection`,{type:`boolean`,description:`Determines whether uninstalling the WARP client requires an override code. (Windows only).`}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const la={command:`edit <policy-id>`,describe:`Updates a configured device settings profile.`,builder:ca,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],description:p(r.description,`description`,`text`),disable_auto_fallback:r[`disable-auto-fallback`],dns_search_suffixes:d(r[`dns-search-suffixes`],`dns-search-suffixes`),enabled:r.enabled,exclude:d(r.exclude,`exclude`),exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},include:d(r.include,`include`),lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],match:p(r.match,`match`,`text`),name:p(r.name,`name`,`text`),precedence:r.precedence,register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:p(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:p(r[`tunnel-protocol`],`tunnel-protocol`,`text`),uninstall_protection:r[`uninstall-protection`],virtual_networks:{allowed:r[`virtual-networks-allowed`],default:p(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.custom.edit({...e,account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}let m=f({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],description:p(r.description,`description`,`text`),disable_auto_fallback:r[`disable-auto-fallback`],dns_search_suffixes:d(r[`dns-search-suffixes`],`dns-search-suffixes`),enabled:r.enabled,exclude:d(r.exclude,`exclude`),exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},include:d(r.include,`include`),lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],match:p(r.match,`match`,`text`),name:p(r.name,`name`,`text`),precedence:r.precedence,register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:p(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:p(r[`tunnel-protocol`],`tunnel-protocol`,`text`),uninstall_protection:r[`uninstall-protection`],virtual_networks:{allowed:r[`virtual-networks-allowed`],default:p(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}});o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.custom.edit({...m,account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Updated`})}};function ua(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const da={command:`get <policy-id>`,describe:`Fetches the list of routes excluded from the WARP client's tunnel for a specific device settings profile.`,builder:ua,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom excludes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/exclude`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.custom.excludes.get({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Loaded`})}};function fa(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pa={command:`update <policy-id>`,describe:`Sets the list of routes excluded from the WARP client's tunnel for a specific device settings profile.`,builder:fa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom excludes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/exclude`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?void 0:u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.custom.excludes.update({body:e,account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},ma={command:`excludes`,describe:`Operations for devices.policies.custom.excludes`,builder:e=>e.command(da).command(pa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ha(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ga={command:`get <policy-id>`,describe:`Fetches the list of domains to bypass Gateway DNS resolution from a specified device settings profile. These domains will use the specified local DNS resolver instead.`,builder:ha,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom fallback-domains get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/fallback_domains`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.custom.fallbackDomains.get({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Loaded`})}};function _a(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const va={command:`update <policy-id>`,describe:`Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. This will only apply to the specified device settings profile.`,builder:_a,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom fallback-domains update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/fallback_domains`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?void 0:u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.custom.fallbackDomains.update({body:e,account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},ya={command:`fallback-domains`,describe:`Operations for devices.policies.custom.fallback-domains`,builder:e=>e.command(ga).command(va).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ba(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xa={command:`get <policy-id>`,describe:`Fetches a device settings profile by ID.`,builder:ba,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.custom.get({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Loaded`})}};function Sa(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ca={command:`get <policy-id>`,describe:`Fetches the list of routes included in the WARP client's tunnel for a specific device settings profile.`,builder:Sa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom includes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/include`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.custom.includes.get({account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Loaded`})}};function wa(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ta={command:`update <policy-id>`,describe:`Sets the list of routes included in the WARP client's tunnel for a specific device settings profile.`,builder:wa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom includes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}/include`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?void 0:u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.custom.includes.update({body:e,account_id:l,policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ea={command:`includes`,describe:`Operations for devices.policies.custom.includes`,builder:e=>e.command(Ca).command(Ta).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Da(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Oa={command:`list`,describe:`Fetches a list of the device settings profiles for an account.`,builder:Da,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies custom list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policies`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.custom.list({account_id:l})),{successLabel:`Loaded`})}},ka={command:`custom`,describe:`Operations for devices.policies.custom`,builder:e=>e.command(aa).command(sa).command(la).command(xa).command(Oa).command(ma).command(ya).command(Ea).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Aa(e){return e.option(`enabled`,{type:`boolean`,description:`The current status of the device policy certificate provisioning feature for WARP clients.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ja={command:`edit`,describe:`Enable Zero Trust Clients to provision a certificate, containing a x509 subject, and referenced by Access device posture policies when the client visits MTLS protected domains. This facilitates device posture without a WARP session.`,builder:Aa,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust devices policies default certificates edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/devices/policy/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?f({enabled:e.enabled}):u(e.body)});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=u(e.body);o(await c(`Updating`,async()=>t.zeroTrust.devices.policies.default.certificates.edit({body:r,zone_id:n})),{successLabel:`Updated`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let i=f({enabled:e.enabled});o(await c(`Updating`,async()=>t.zeroTrust.devices.policies.default.certificates.edit({body:i,zone_id:n})),{successLabel:`Updated`})}};function Ma(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Na={command:`get`,describe:`Fetches device certificate provisioning.`,builder:Ma,handler:async e=>{if(e.dryRun){s({command:`cf zero-trust devices policies default certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/devices/policy/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await a(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,o(await c(`Loading`,async()=>t.zeroTrust.devices.policies.default.certificates.get({zone_id:n})),{successLabel:`Loaded`})}},Pa={command:`certificates`,describe:`Operations for devices.policies.default.certificates`,builder:e=>e.command(ja).command(Na).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Fa(e){return e.option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`."}).option(`dns-search-suffixes`,{type:`string`,description:`List of DNS search suffixes to apply to clients. Suffixes are evaluated in order. Use an empty array to clear. Provide as a JSON array of objects or @path/to/file.json.`}).option(`exclude`,{type:`string`,description:`List of routes excluded in the WARP client's tunnel. Both 'exclude' and 'include' cannot be set in the same request. Provide as a JSON array of objects or @path/to/file.json.`}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`include`,{type:`string`,description:`List of routes included in the WARP client's tunnel. Both 'exclude' and 'include' cannot be set in the same request. Provide as a JSON array of objects or @path/to/file.json.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`}).option(`uninstall-protection`,{type:`boolean`,description:`Determines whether uninstalling the WARP client requires an override code. (Windows only).`}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const Ia={command:`edit`,describe:`Updates the default device settings profile for an account.`,builder:Fa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],disable_auto_fallback:r[`disable-auto-fallback`],dns_search_suffixes:d(r[`dns-search-suffixes`],`dns-search-suffixes`),exclude:d(r.exclude,`exclude`),exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},include:d(r.include,`include`),lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:p(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:p(r[`tunnel-protocol`],`tunnel-protocol`,`text`),uninstall_protection:r[`uninstall-protection`],virtual_networks:{allowed:r[`virtual-networks-allowed`],default:p(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.default.edit({...e,account_id:l})),{successLabel:`Updated`});return}let m=f({allow_mode_switch:r[`allow-mode-switch`],allow_updates:r[`allow-updates`],allowed_to_leave:r[`allowed-to-leave`],auto_connect:r[`auto-connect`],captive_portal:r[`captive-portal`],disable_auto_fallback:r[`disable-auto-fallback`],dns_search_suffixes:d(r[`dns-search-suffixes`],`dns-search-suffixes`),exclude:d(r.exclude,`exclude`),exclude_office_ips:r[`exclude-office-ips`],global_acceleration:{api_endpoints:r[`global-acceleration-api-endpoints`],enabled:r[`global-acceleration-enabled`],masque_endpoints:r[`global-acceleration-masque-endpoints`],wireguard_endpoints:r[`global-acceleration-wireguard-endpoints`]},include:d(r.include,`include`),lan_allow_minutes:r[`lan-allow-minutes`],lan_allow_subnet_size:r[`lan-allow-subnet-size`],register_interface_ip_with_dns:r[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:r[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(r[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:r[`service-mode-v2-port`]},support_url:p(r[`support-url`],`support-url`,`text`),switch_locked:r[`switch-locked`],tunnel_protocol:p(r[`tunnel-protocol`],`tunnel-protocol`,`text`),uninstall_protection:r[`uninstall-protection`],virtual_networks:{allowed:r[`virtual-networks-allowed`],default:p(r[`virtual-networks-default`],`virtual-networks-default`,`text`)}});o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.default.edit({...m,account_id:l})),{successLabel:`Updated`})}};function La(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ra={command:`get`,describe:`Fetches the list of routes excluded from the WARP client's tunnel.`,builder:La,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default excludes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/exclude`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.default.excludes.get({account_id:l})),{successLabel:`Loaded`})}};function za(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ba={command:`update`,describe:`Sets the list of routes excluded from the WARP client's tunnel.`,builder:za,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default excludes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/exclude`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.default.excludes.update({body:e,account_id:l})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Va={command:`excludes`,describe:`Operations for devices.policies.default.excludes`,builder:e=>e.command(Ra).command(Ba).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ha(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ua={command:`get`,describe:`Fetches a list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.`,builder:Ha,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default fallback-domains get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/fallback_domains`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.default.fallbackDomains.get({account_id:l})),{successLabel:`Loaded`})}};function Wa(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ga={command:`update`,describe:`Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.`,builder:Wa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default fallback-domains update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/fallback_domains`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.default.fallbackDomains.update({body:e,account_id:l})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ka={command:`fallback-domains`,describe:`Operations for devices.policies.default.fallback-domains`,builder:e=>e.command(Ua).command(Ga).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function qa(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ja={command:`get`,describe:`Fetches the default device settings profile for an account.`,builder:qa,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.default.get({account_id:l})),{successLabel:`Loaded`})}};function Ya(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xa={command:`get`,describe:`Fetches the list of routes included in the WARP client's tunnel.`,builder:Ya,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default includes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/include`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.policies.default.includes.get({account_id:l})),{successLabel:`Loaded`})}};function Za(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Qa={command:`update`,describe:`Sets the list of routes included in the WARP client's tunnel.`,builder:Za,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices policies default includes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/policy/include`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.policies.default.includes.update({body:e,account_id:l})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},$a={command:`includes`,describe:`Operations for devices.policies.default.includes`,builder:e=>e.command(Xa).command(Qa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},eo={command:`default`,describe:`Operations for devices.policies.default`,builder:e=>e.command(Ia).command(Ja).command(Pa).command(Va).command(Ka).command($a).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},to={command:`policies`,describe:`Operations for devices.policies`,builder:e=>e.command(ka).command(eo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function no(e){return e.option(`description`,{type:`string`,description:`The description of the device posture rule.`}).option(`expiration`,{type:`string`,description:`Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.`}).option(`input-exists`,{type:`boolean`,description:`Whether or not file exists.`}).option(`input-operating-system`,{type:`string`,description:`Operating system.`,choices:[`windows`,`linux`,`mac`,`android`,`ios`,`chromeos`]}).option(`input-path`,{type:`string`,description:`File path.`}).option(`input-sha256`,{type:`string`,description:`SHA-256.`}).option(`input-thumbprint`,{type:`string`,description:`Signing certificate thumbprint.`}).option(`input-id`,{type:`string`,description:`List ID.`}).option(`input-domain`,{type:`string`,description:`Domain.`}).option(`input-operator`,{type:`string`,description:`Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-os-distro-name`,{type:`string`,description:`Operating System Distribution Name (linux only).`}).option(`input-os-distro-revision`,{type:`string`,description:`Version of OS Distribution (linux only).`}).option(`input-os-version-extra`,{type:`string`,description:`Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.`}).option(`input-version`,{type:`string`,description:`Version of OS.`}).option(`input-enabled`,{type:`boolean`,description:`Enabled.`}).option(`input-check-disks`,{type:`string`,array:!0,description:`List of volume names to be checked for encryption.`}).option(`input-require-all`,{type:`boolean`,description:`Whether to check all disks for encryption.`}).option(`input-certificate-id`,{type:`string`,description:`UUID of Cloudflare managed certificate.`}).option(`input-cn`,{type:`string`,description:`Common Name that is protected by the certificate.`}).option(`input-check-private-key`,{type:`boolean`,description:`Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.`}).option(`input-extended-key-usage`,{type:`string`,array:!0,description:`List of values indicating purposes for which the certificate public key can be used.`}).option(`input-locations-paths`,{type:`string`,array:!0,description:`List of paths to check for client certificate on linux.`}).option(`input-locations-trust-stores`,{type:`string`,array:!0,description:`List of trust stores to check for client certificate.`}).option(`input-subject-alternative-names`,{type:`string`,array:!0,description:`List of certificate Subject Alternative Names.`}).option(`input-update-window-days`,{type:`number`,description:`Number of days that the antivirus should be updated within.`}).option(`input-compliance-status`,{type:`string`,description:`Compliance Status.`,choices:[`compliant`,`noncompliant`,`unknown`,`notapplicable`,`ingraceperiod`,`error`]}).option(`input-connection-id`,{type:`string`,description:`Posture Integration ID.`}).option(`input-last-seen`,{type:`string`,description:`For more details on last seen, please refer to the Crowdstrike documentation.`}).option(`input-os`,{type:`string`,description:`Os Version.`}).option(`input-overall`,{type:`string`,description:`Overall.`}).option(`input-sensor-config`,{type:`string`,description:`SensorConfig.`}).option(`input-state`,{type:`string`,description:`For more details on state, please refer to the Crowdstrike documentation.`,choices:[`online`,`offline`,`unknown`]}).option(`input-version-operator`,{type:`string`,description:`Version Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-auth-state`,{type:`string`,array:!0,description:`The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.`}).option(`input-count-operator`,{type:`string`,description:`Count Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-issue-count`,{type:`string`,description:`The Number of Issues.`}).option(`input-eid-last-seen`,{type:`string`,description:`For more details on eid last seen, refer to the Tanium documentation.`}).option(`input-risk-level`,{type:`string`,description:`For more details on risk level, refer to the Tanium documentation.`,choices:[`low`,`medium`,`high`,`critical`]}).option(`input-score-operator`,{type:`string`,description:`Score Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-total-score`,{type:`number`,description:`For more details on total score, refer to the Tanium documentation.`}).option(`input-active-threats`,{type:`number`,description:`The Number of active threats.`}).option(`input-infected`,{type:`boolean`,description:`Whether device is infected.`}).option(`input-is-active`,{type:`boolean`,description:`Whether device is active.`}).option(`input-network-status`,{type:`string`,description:`Network status of device.`,choices:[`connected`,`disconnected`,`disconnecting`,`connecting`]}).option(`input-operational-state`,{type:`string`,description:`Agent operational state.`,choices:[`na`,`partially_disabled`,`auto_fully_disabled`,`fully_disabled`,`auto_partially_disabled`,`disabled_error`,`db_corruption`]}).option(`input-score`,{type:`number`,description:`A value between 0-100 assigned to devices set by the 3rd party posture provider.`}).option(`match`,{type:`string`,description:`The conditions that the client must match to run the rule. Provide as a JSON array of objects or @path/to/file.json.`}).option(`name`,{type:`string`,description:`The name of the device posture rule.`}).option(`schedule`,{type:`string`,description:"Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`."}).option(`type`,{type:`string`,description:`The type of device posture rule.`,choices:[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`input-exists`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operating-system`,`input-id.input-check-disks.input-require-all.input-certificate-id.input-cn.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-operator.input-os.input-overall.input-sensor-config.input-state.input-version.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-path`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sha256`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-thumbprint`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-id`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-domain`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operator`,[`input-exists`,`input-path`,`input-sha256`,`input-thumbprint`,`input-operating-system`,`input-id`,`input-domain`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`,`input-compliance-status`,`input-connection-id`,`input-auth-state`,`input-count-operator`,`input-issue-count`]).conflicts(`input-os-distro-name`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-distro-revision`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-version-extra`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-version`,[`input-operating-system`,`input-operator`]).conflicts(`input-enabled`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-enabled`,[`input-operating-system`]).conflicts(`input-check-disks`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-require-all`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-certificate-id`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-cn`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-cn`,[`input-certificate-id`]).conflicts(`input-check-private-key`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-check-private-key`,[`input-certificate-id`,`input-operating-system`]).conflicts(`input-extended-key-usage`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-paths`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-trust-stores`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-subject-alternative-names`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-update-window-days`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-compliance-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-connection-id`,[`input-exists`,`input-operating-system`,`input-path`,`input-sha256`,`input-thumbprint`,`input-id`,`input-domain`,`input-operator`,`input-os-distro-name`,`input-os-distro-revision`,`input-os-version-extra`,`input-version`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`]).conflicts(`input-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-overall`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sensor-config`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-auth-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-count-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-issue-count`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-eid-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-risk-level`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-score-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-total-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-active-threats`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-infected`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-is-active`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-network-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-operational-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state`.split(`.`)).implies(`input-score`,[`input-connection-id`,`input-operator`])}const ro={command:`create`,describe:`Creates a new device posture rule.`,builder:no,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),expiration:p(r.expiration,`expiration`,`text`),input:{exists:r[`input-exists`],operating_system:p(r[`input-operating-system`],`input-operating-system`,`text`),path:p(r[`input-path`],`input-path`,`text`),sha256:p(r[`input-sha256`],`input-sha256`,`text`),thumbprint:p(r[`input-thumbprint`],`input-thumbprint`,`text`),id:p(r[`input-id`],`input-id`,`text`),domain:p(r[`input-domain`],`input-domain`,`text`),operator:p(r[`input-operator`],`input-operator`,`text`),os_distro_name:p(r[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:p(r[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:p(r[`input-os-version-extra`],`input-os-version-extra`,`text`),version:p(r[`input-version`],`input-version`,`text`),enabled:r[`input-enabled`],checkDisks:r[`input-check-disks`],requireAll:r[`input-require-all`],certificate_id:p(r[`input-certificate-id`],`input-certificate-id`,`text`),cn:p(r[`input-cn`],`input-cn`,`text`),check_private_key:r[`input-check-private-key`],extended_key_usage:r[`input-extended-key-usage`],locations:{paths:r[`input-locations-paths`],trust_stores:r[`input-locations-trust-stores`]},subject_alternative_names:r[`input-subject-alternative-names`],update_window_days:r[`input-update-window-days`],compliance_status:p(r[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:p(r[`input-connection-id`],`input-connection-id`,`text`),last_seen:p(r[`input-last-seen`],`input-last-seen`,`text`),os:p(r[`input-os`],`input-os`,`text`),overall:p(r[`input-overall`],`input-overall`,`text`),sensor_config:p(r[`input-sensor-config`],`input-sensor-config`,`text`),state:p(r[`input-state`],`input-state`,`text`),versionOperator:p(r[`input-version-operator`],`input-version-operator`,`text`),auth_state:r[`input-auth-state`],countOperator:p(r[`input-count-operator`],`input-count-operator`,`text`),issue_count:p(r[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:p(r[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:p(r[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:p(r[`input-score-operator`],`input-score-operator`,`text`),total_score:r[`input-total-score`],active_threats:r[`input-active-threats`],infected:r[`input-infected`],is_active:r[`input-is-active`],network_status:p(r[`input-network-status`],`input-network-status`,`text`),operational_state:p(r[`input-operational-state`],`input-operational-state`,`text`),score:r[`input-score`]},match:d(r.match,`match`),name:p(r.name,`name`,`text`),schedule:p(r.schedule,`schedule`,`text`),type:p(r.type,`type`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.posture.create({...e,account_id:l})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await h(`name`,`The name of the device posture rule.`)),r.type===void 0&&(r.type=await g(`type`,`The type of device posture rule.`,[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]));let m=f({description:p(r.description,`description`,`text`),expiration:p(r.expiration,`expiration`,`text`),input:{exists:r[`input-exists`],operating_system:p(r[`input-operating-system`],`input-operating-system`,`text`),path:p(r[`input-path`],`input-path`,`text`),sha256:p(r[`input-sha256`],`input-sha256`,`text`),thumbprint:p(r[`input-thumbprint`],`input-thumbprint`,`text`),id:p(r[`input-id`],`input-id`,`text`),domain:p(r[`input-domain`],`input-domain`,`text`),operator:p(r[`input-operator`],`input-operator`,`text`),os_distro_name:p(r[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:p(r[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:p(r[`input-os-version-extra`],`input-os-version-extra`,`text`),version:p(r[`input-version`],`input-version`,`text`),enabled:r[`input-enabled`],checkDisks:r[`input-check-disks`],requireAll:r[`input-require-all`],certificate_id:p(r[`input-certificate-id`],`input-certificate-id`,`text`),cn:p(r[`input-cn`],`input-cn`,`text`),check_private_key:r[`input-check-private-key`],extended_key_usage:r[`input-extended-key-usage`],locations:{paths:r[`input-locations-paths`],trust_stores:r[`input-locations-trust-stores`]},subject_alternative_names:r[`input-subject-alternative-names`],update_window_days:r[`input-update-window-days`],compliance_status:p(r[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:p(r[`input-connection-id`],`input-connection-id`,`text`),last_seen:p(r[`input-last-seen`],`input-last-seen`,`text`),os:p(r[`input-os`],`input-os`,`text`),overall:p(r[`input-overall`],`input-overall`,`text`),sensor_config:p(r[`input-sensor-config`],`input-sensor-config`,`text`),state:p(r[`input-state`],`input-state`,`text`),versionOperator:p(r[`input-version-operator`],`input-version-operator`,`text`),auth_state:r[`input-auth-state`],countOperator:p(r[`input-count-operator`],`input-count-operator`,`text`),issue_count:p(r[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:p(r[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:p(r[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:p(r[`input-score-operator`],`input-score-operator`,`text`),total_score:r[`input-total-score`],active_threats:r[`input-active-threats`],infected:r[`input-infected`],is_active:r[`input-is-active`],network_status:p(r[`input-network-status`],`input-network-status`,`text`),operational_state:p(r[`input-operational-state`],`input-operational-state`,`text`),score:r[`input-score`]},match:d(r.match,`match`),name:p(r.name,`name`,`text`),schedule:p(r.schedule,`schedule`,`text`),type:p(r.type,`type`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.devices.posture.create({...m,account_id:l})),{successLabel:`Created`})}};function io(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ao={command:`delete <rule-id>`,describe:`Deletes a device posture rule.`,builder:io,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.posture.delete({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Deleted`})}};function oo(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const so={command:`get <rule-id>`,describe:`Fetches a single device posture rule.`,builder:oo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.posture.get({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Loaded`})}};function co(e){return e.option(`config-api-url`,{type:`string`,description:`The Workspace One API URL provided in the Workspace One Admin Dashboard.`}).option(`config-auth-url`,{type:`string`,description:`The Workspace One Authorization URL depending on your region.`}).option(`config-client-id`,{type:`string`,description:`The Workspace One client ID provided in the Workspace One Admin Dashboard.`}).option(`config-client-secret`,{type:`string`,description:`The Workspace One client secret provided in the Workspace One Admin Dashboard.`}).option(`config-customer-id`,{type:`string`,description:`The Crowdstrike customer ID.`}).option(`config-client-key`,{type:`string`,description:`The Uptycs client secret.`}).option(`config-access-client-id`,{type:`string`,description:"If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`."}).option(`config-access-client-secret`,{type:`string`,description:"If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`."}).option(`interval`,{type:`string`,description:"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`)."}).option(`name`,{type:`string`,description:`The name of the device posture integration.`}).option(`type`,{type:`string`,description:`The type of device posture integration.`,choices:[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`config-api-url`,[`config-customer-id`,`config-client-id`,`config-client-secret`]).conflicts(`config-auth-url`,[`config-customer-id`,`config-client-key`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-auth-url`,[`config-api-url`,`config-client-id`,`config-client-secret`]).conflicts(`config-client-id`,[`config-client-key`,`config-customer-id`,`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-client-secret`,[`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-customer-id`,[`config-auth-url`,`config-client-id`,`config-api-url`,`config-access-client-id`,`config-access-client-secret`]).conflicts(`config-client-key`,[`config-auth-url`,`config-client-id`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-client-key`,[`config-api-url`,`config-customer-id`,`config-client-secret`]).conflicts(`config-access-client-id`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-id`,[`config-api-url`,`config-access-client-secret`]).conflicts(`config-access-client-secret`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-secret`,[`config-api-url`,`config-access-client-id`])}const lo={command:`create`,describe:`Create a new device posture integration.`,builder:co,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/integration`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({config:{api_url:p(r[`config-api-url`],`config-api-url`,`text`),auth_url:p(r[`config-auth-url`],`config-auth-url`,`text`),client_id:p(r[`config-client-id`],`config-client-id`,`text`),client_secret:p(r[`config-client-secret`],`config-client-secret`,`text`),customer_id:p(r[`config-customer-id`],`config-customer-id`,`text`),client_key:p(r[`config-client-key`],`config-client-key`,`text`),access_client_id:p(r[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:p(r[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:p(r.interval,`interval`,`text`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.posture.integrations.create({...e,account_id:l})),{successLabel:`Created`});return}r.interval===void 0&&(r.interval=await h(`interval`,"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`).")),r.name===void 0&&(r.name=await h(`name`,`The name of the device posture integration.`)),r.type===void 0&&(r.type=await g(`type`,`The type of device posture integration.`,[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]));let d=f({config:{api_url:p(r[`config-api-url`],`config-api-url`,`text`),auth_url:p(r[`config-auth-url`],`config-auth-url`,`text`),client_id:p(r[`config-client-id`],`config-client-id`,`text`),client_secret:p(r[`config-client-secret`],`config-client-secret`,`text`),customer_id:p(r[`config-customer-id`],`config-customer-id`,`text`),client_key:p(r[`config-client-key`],`config-client-key`,`text`),access_client_id:p(r[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:p(r[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:p(r.interval,`interval`,`text`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.devices.posture.integrations.create({...d,account_id:l})),{successLabel:`Created`})}};function uo(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const fo={command:`delete <integration-id>`,describe:`Delete a configured device posture integration.`,builder:uo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/integration/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.posture.integrations.delete({account_id:l,integration_id:r[`integration-id`]})),{successLabel:`Deleted`})}};function po(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`config-api-url`,{type:`string`,description:`The Workspace One API URL provided in the Workspace One Admin Dashboard.`}).option(`config-auth-url`,{type:`string`,description:`The Workspace One Authorization URL depending on your region.`}).option(`config-client-id`,{type:`string`,description:`The Workspace One client ID provided in the Workspace One Admin Dashboard.`}).option(`config-client-secret`,{type:`string`,description:`The Workspace One client secret provided in the Workspace One Admin Dashboard.`}).option(`config-customer-id`,{type:`string`,description:`The Crowdstrike customer ID.`}).option(`config-client-key`,{type:`string`,description:`The Uptycs client secret.`}).option(`config-access-client-id`,{type:`string`,description:"If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`."}).option(`config-access-client-secret`,{type:`string`,description:"If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`."}).option(`interval`,{type:`string`,description:"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`)."}).option(`name`,{type:`string`,description:`The name of the device posture integration.`}).option(`type`,{type:`string`,description:`The type of device posture integration.`,choices:[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`config-api-url`,[`config-customer-id`,`config-client-id`,`config-client-secret`]).conflicts(`config-auth-url`,[`config-customer-id`,`config-client-key`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-auth-url`,[`config-api-url`,`config-client-id`,`config-client-secret`]).conflicts(`config-client-id`,[`config-client-key`,`config-customer-id`,`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-client-secret`,[`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-customer-id`,[`config-auth-url`,`config-client-id`,`config-api-url`,`config-access-client-id`,`config-access-client-secret`]).conflicts(`config-client-key`,[`config-auth-url`,`config-client-id`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-client-key`,[`config-api-url`,`config-customer-id`,`config-client-secret`]).conflicts(`config-access-client-id`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-id`,[`config-api-url`,`config-access-client-secret`]).conflicts(`config-access-client-secret`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-secret`,[`config-api-url`,`config-access-client-id`])}const mo={command:`edit <integration-id>`,describe:`Updates a configured device posture integration.`,builder:po,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture integrations edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/integration/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({config:{api_url:p(r[`config-api-url`],`config-api-url`,`text`),auth_url:p(r[`config-auth-url`],`config-auth-url`,`text`),client_id:p(r[`config-client-id`],`config-client-id`,`text`),client_secret:p(r[`config-client-secret`],`config-client-secret`,`text`),customer_id:p(r[`config-customer-id`],`config-customer-id`,`text`),client_key:p(r[`config-client-key`],`config-client-key`,`text`),access_client_id:p(r[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:p(r[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:p(r.interval,`interval`,`text`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.posture.integrations.edit({...e,account_id:l,integration_id:r[`integration-id`]})),{successLabel:`Updated`});return}let d=f({config:{api_url:p(r[`config-api-url`],`config-api-url`,`text`),auth_url:p(r[`config-auth-url`],`config-auth-url`,`text`),client_id:p(r[`config-client-id`],`config-client-id`,`text`),client_secret:p(r[`config-client-secret`],`config-client-secret`,`text`),customer_id:p(r[`config-customer-id`],`config-customer-id`,`text`),client_key:p(r[`config-client-key`],`config-client-key`,`text`),access_client_id:p(r[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:p(r[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:p(r.interval,`interval`,`text`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.devices.posture.integrations.edit({...d,account_id:l,integration_id:r[`integration-id`]})),{successLabel:`Updated`})}};function ho(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const go={command:`get <integration-id>`,describe:`Fetches details for a single device posture integration.`,builder:ho,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/integration/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.posture.integrations.get({account_id:l,integration_id:r[`integration-id`]})),{successLabel:`Loaded`})}};function _o(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const vo={command:`list`,describe:`Fetches the list of device posture integrations for an account.`,builder:_o,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/integration`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.posture.integrations.list({account_id:l})),{successLabel:`Loaded`})}},yo={command:`integrations`,describe:`Operations for devices.posture.integrations`,builder:e=>e.command(lo).command(fo).command(mo).command(go).command(vo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xo={command:`list`,describe:`Fetches device posture rules for a Zero Trust account.`,builder:bo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.posture.list({account_id:l})),{successLabel:`Loaded`})}};function So(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`The description of the device posture rule.`}).option(`expiration`,{type:`string`,description:`Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.`}).option(`input-exists`,{type:`boolean`,description:`Whether or not file exists.`}).option(`input-operating-system`,{type:`string`,description:`Operating system.`,choices:[`windows`,`linux`,`mac`,`android`,`ios`,`chromeos`]}).option(`input-path`,{type:`string`,description:`File path.`}).option(`input-sha256`,{type:`string`,description:`SHA-256.`}).option(`input-thumbprint`,{type:`string`,description:`Signing certificate thumbprint.`}).option(`input-id`,{type:`string`,description:`List ID.`}).option(`input-domain`,{type:`string`,description:`Domain.`}).option(`input-operator`,{type:`string`,description:`Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-os-distro-name`,{type:`string`,description:`Operating System Distribution Name (linux only).`}).option(`input-os-distro-revision`,{type:`string`,description:`Version of OS Distribution (linux only).`}).option(`input-os-version-extra`,{type:`string`,description:`Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.`}).option(`input-version`,{type:`string`,description:`Version of OS.`}).option(`input-enabled`,{type:`boolean`,description:`Enabled.`}).option(`input-check-disks`,{type:`string`,array:!0,description:`List of volume names to be checked for encryption.`}).option(`input-require-all`,{type:`boolean`,description:`Whether to check all disks for encryption.`}).option(`input-certificate-id`,{type:`string`,description:`UUID of Cloudflare managed certificate.`}).option(`input-cn`,{type:`string`,description:`Common Name that is protected by the certificate.`}).option(`input-check-private-key`,{type:`boolean`,description:`Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.`}).option(`input-extended-key-usage`,{type:`string`,array:!0,description:`List of values indicating purposes for which the certificate public key can be used.`}).option(`input-locations-paths`,{type:`string`,array:!0,description:`List of paths to check for client certificate on linux.`}).option(`input-locations-trust-stores`,{type:`string`,array:!0,description:`List of trust stores to check for client certificate.`}).option(`input-subject-alternative-names`,{type:`string`,array:!0,description:`List of certificate Subject Alternative Names.`}).option(`input-update-window-days`,{type:`number`,description:`Number of days that the antivirus should be updated within.`}).option(`input-compliance-status`,{type:`string`,description:`Compliance Status.`,choices:[`compliant`,`noncompliant`,`unknown`,`notapplicable`,`ingraceperiod`,`error`]}).option(`input-connection-id`,{type:`string`,description:`Posture Integration ID.`}).option(`input-last-seen`,{type:`string`,description:`For more details on last seen, please refer to the Crowdstrike documentation.`}).option(`input-os`,{type:`string`,description:`Os Version.`}).option(`input-overall`,{type:`string`,description:`Overall.`}).option(`input-sensor-config`,{type:`string`,description:`SensorConfig.`}).option(`input-state`,{type:`string`,description:`For more details on state, please refer to the Crowdstrike documentation.`,choices:[`online`,`offline`,`unknown`]}).option(`input-version-operator`,{type:`string`,description:`Version Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-auth-state`,{type:`string`,array:!0,description:`The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.`}).option(`input-count-operator`,{type:`string`,description:`Count Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-issue-count`,{type:`string`,description:`The Number of Issues.`}).option(`input-eid-last-seen`,{type:`string`,description:`For more details on eid last seen, refer to the Tanium documentation.`}).option(`input-risk-level`,{type:`string`,description:`For more details on risk level, refer to the Tanium documentation.`,choices:[`low`,`medium`,`high`,`critical`]}).option(`input-score-operator`,{type:`string`,description:`Score Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-total-score`,{type:`number`,description:`For more details on total score, refer to the Tanium documentation.`}).option(`input-active-threats`,{type:`number`,description:`The Number of active threats.`}).option(`input-infected`,{type:`boolean`,description:`Whether device is infected.`}).option(`input-is-active`,{type:`boolean`,description:`Whether device is active.`}).option(`input-network-status`,{type:`string`,description:`Network status of device.`,choices:[`connected`,`disconnected`,`disconnecting`,`connecting`]}).option(`input-operational-state`,{type:`string`,description:`Agent operational state.`,choices:[`na`,`partially_disabled`,`auto_fully_disabled`,`fully_disabled`,`auto_partially_disabled`,`disabled_error`,`db_corruption`]}).option(`input-score`,{type:`number`,description:`A value between 0-100 assigned to devices set by the 3rd party posture provider.`}).option(`match`,{type:`string`,description:`The conditions that the client must match to run the rule. Provide as a JSON array of objects or @path/to/file.json.`}).option(`name`,{type:`string`,description:`The name of the device posture rule.`}).option(`schedule`,{type:`string`,description:"Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`."}).option(`type`,{type:`string`,description:`The type of device posture rule.`,choices:[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`input-exists`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operating-system`,`input-id.input-check-disks.input-require-all.input-certificate-id.input-cn.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-operator.input-os.input-overall.input-sensor-config.input-state.input-version.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-path`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sha256`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-thumbprint`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-id`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-domain`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operator`,[`input-exists`,`input-path`,`input-sha256`,`input-thumbprint`,`input-operating-system`,`input-id`,`input-domain`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`,`input-compliance-status`,`input-connection-id`,`input-auth-state`,`input-count-operator`,`input-issue-count`]).conflicts(`input-os-distro-name`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-distro-revision`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-version-extra`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-version`,[`input-operating-system`,`input-operator`]).conflicts(`input-enabled`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-enabled`,[`input-operating-system`]).conflicts(`input-check-disks`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-require-all`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-certificate-id`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-cn`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-cn`,[`input-certificate-id`]).conflicts(`input-check-private-key`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-check-private-key`,[`input-certificate-id`,`input-operating-system`]).conflicts(`input-extended-key-usage`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-paths`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-trust-stores`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-subject-alternative-names`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-update-window-days`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-compliance-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-connection-id`,[`input-exists`,`input-operating-system`,`input-path`,`input-sha256`,`input-thumbprint`,`input-id`,`input-domain`,`input-operator`,`input-os-distro-name`,`input-os-distro-revision`,`input-os-version-extra`,`input-version`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`]).conflicts(`input-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-overall`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sensor-config`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-auth-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-count-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-issue-count`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-eid-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-risk-level`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-score-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-total-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-active-threats`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-infected`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-is-active`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-network-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-operational-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state`.split(`.`)).implies(`input-score`,[`input-connection-id`,`input-operator`])}const Co={command:`update <rule-id>`,describe:`Updates a device posture rule.`,builder:So,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices posture update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/posture/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),expiration:p(r.expiration,`expiration`,`text`),input:{exists:r[`input-exists`],operating_system:p(r[`input-operating-system`],`input-operating-system`,`text`),path:p(r[`input-path`],`input-path`,`text`),sha256:p(r[`input-sha256`],`input-sha256`,`text`),thumbprint:p(r[`input-thumbprint`],`input-thumbprint`,`text`),id:p(r[`input-id`],`input-id`,`text`),domain:p(r[`input-domain`],`input-domain`,`text`),operator:p(r[`input-operator`],`input-operator`,`text`),os_distro_name:p(r[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:p(r[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:p(r[`input-os-version-extra`],`input-os-version-extra`,`text`),version:p(r[`input-version`],`input-version`,`text`),enabled:r[`input-enabled`],checkDisks:r[`input-check-disks`],requireAll:r[`input-require-all`],certificate_id:p(r[`input-certificate-id`],`input-certificate-id`,`text`),cn:p(r[`input-cn`],`input-cn`,`text`),check_private_key:r[`input-check-private-key`],extended_key_usage:r[`input-extended-key-usage`],locations:{paths:r[`input-locations-paths`],trust_stores:r[`input-locations-trust-stores`]},subject_alternative_names:r[`input-subject-alternative-names`],update_window_days:r[`input-update-window-days`],compliance_status:p(r[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:p(r[`input-connection-id`],`input-connection-id`,`text`),last_seen:p(r[`input-last-seen`],`input-last-seen`,`text`),os:p(r[`input-os`],`input-os`,`text`),overall:p(r[`input-overall`],`input-overall`,`text`),sensor_config:p(r[`input-sensor-config`],`input-sensor-config`,`text`),state:p(r[`input-state`],`input-state`,`text`),versionOperator:p(r[`input-version-operator`],`input-version-operator`,`text`),auth_state:r[`input-auth-state`],countOperator:p(r[`input-count-operator`],`input-count-operator`,`text`),issue_count:p(r[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:p(r[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:p(r[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:p(r[`input-score-operator`],`input-score-operator`,`text`),total_score:r[`input-total-score`],active_threats:r[`input-active-threats`],infected:r[`input-infected`],is_active:r[`input-is-active`],network_status:p(r[`input-network-status`],`input-network-status`,`text`),operational_state:p(r[`input-operational-state`],`input-operational-state`,`text`),score:r[`input-score`]},match:d(r.match,`match`),name:p(r.name,`name`,`text`),schedule:p(r.schedule,`schedule`,`text`),type:p(r.type,`type`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.posture.update({...e,account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await h(`name`,`The name of the device posture rule.`)),r.type===void 0&&(r.type=await g(`type`,`The type of device posture rule.`,[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]));let m=f({description:p(r.description,`description`,`text`),expiration:p(r.expiration,`expiration`,`text`),input:{exists:r[`input-exists`],operating_system:p(r[`input-operating-system`],`input-operating-system`,`text`),path:p(r[`input-path`],`input-path`,`text`),sha256:p(r[`input-sha256`],`input-sha256`,`text`),thumbprint:p(r[`input-thumbprint`],`input-thumbprint`,`text`),id:p(r[`input-id`],`input-id`,`text`),domain:p(r[`input-domain`],`input-domain`,`text`),operator:p(r[`input-operator`],`input-operator`,`text`),os_distro_name:p(r[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:p(r[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:p(r[`input-os-version-extra`],`input-os-version-extra`,`text`),version:p(r[`input-version`],`input-version`,`text`),enabled:r[`input-enabled`],checkDisks:r[`input-check-disks`],requireAll:r[`input-require-all`],certificate_id:p(r[`input-certificate-id`],`input-certificate-id`,`text`),cn:p(r[`input-cn`],`input-cn`,`text`),check_private_key:r[`input-check-private-key`],extended_key_usage:r[`input-extended-key-usage`],locations:{paths:r[`input-locations-paths`],trust_stores:r[`input-locations-trust-stores`]},subject_alternative_names:r[`input-subject-alternative-names`],update_window_days:r[`input-update-window-days`],compliance_status:p(r[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:p(r[`input-connection-id`],`input-connection-id`,`text`),last_seen:p(r[`input-last-seen`],`input-last-seen`,`text`),os:p(r[`input-os`],`input-os`,`text`),overall:p(r[`input-overall`],`input-overall`,`text`),sensor_config:p(r[`input-sensor-config`],`input-sensor-config`,`text`),state:p(r[`input-state`],`input-state`,`text`),versionOperator:p(r[`input-version-operator`],`input-version-operator`,`text`),auth_state:r[`input-auth-state`],countOperator:p(r[`input-count-operator`],`input-count-operator`,`text`),issue_count:p(r[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:p(r[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:p(r[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:p(r[`input-score-operator`],`input-score-operator`,`text`),total_score:r[`input-total-score`],active_threats:r[`input-active-threats`],infected:r[`input-infected`],is_active:r[`input-is-active`],network_status:p(r[`input-network-status`],`input-network-status`,`text`),operational_state:p(r[`input-operational-state`],`input-operational-state`,`text`),score:r[`input-score`]},match:d(r.match,`match`),name:p(r.name,`name`,`text`),schedule:p(r.schedule,`schedule`,`text`),type:p(r.type,`type`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.devices.posture.update({...m,account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},wo={command:`posture`,describe:`Operations for devices.posture`,builder:e=>e.command(ro).command(ao).command(so).command(xo).command(Co).command(yo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function To(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Eo={command:`bulk-delete`,describe:`Deletes a list of WARP registrations.`,builder:To,handler:async r=>{let i={id:r.id};if(r.dryRun){s({command:`cf zero-trust devices registrations bulk-delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>l.zeroTrust.devices.registrations.bulkDelete({account_id:u,...i})),{successLabel:`Deleted`})}};function Do(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Oo={command:`delete <registration-id>`,describe:`Deletes a WARP registration.`,builder:Do,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices registrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations/${r[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(r[`registration-id`]))}`,pathParams:{"registration-id":String(r[`registration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.registrations.delete({account_id:l,registration_id:r[`registration-id`]})),{successLabel:`Deleted`})}};function ko(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the registration response. Supported values are: "policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ao={command:`get <registration-id>`,describe:`Fetches a single WARP registration.`,builder:ko,handler:async r=>{let i={include:r.include};if(r.dryRun){s({command:`cf zero-trust devices registrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations/${r[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(r[`registration-id`]))}`,pathParams:{"registration-id":String(r[`registration-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.registrations.get({account_id:u,registration_id:r[`registration-id`],...i})),{successLabel:`Loaded`})}};function jo(e){return e.option(`user-id`,{type:`string`,description:`Filter by user ID.`}).option(`seen-after`,{type:`string`,description:`Filter by the last_seen timestamp - returns only registrations last seen after this timestamp.`}).option(`seen-before`,{type:`string`,description:`Filter by the last_seen timestamp - returns only registrations last seen before this timestamp.`}).option(`status`,{type:`string`,description:`Filter by registration status. Defaults to 'active'.`,choices:[`active`,`all`,`revoked`]}).option(`per-page`,{type:`number`,description:`The maximum number of devices to return in a single response.`}).option(`search`,{type:`string`,description:`Filter by registration details.`}).option(`sort-by`,{type:`string`,description:`The registration field to order results by.`,choices:[`id`,`user.name`,`user.email`,`last_seen_at`,`created_at`]}).option(`sort-order`,{type:`string`,description:`Sort direction.`,choices:[`asc`,`desc`]}).option(`cursor`,{type:`string`,description:`Opaque token indicating the starting position when requesting the next set of records. A cursor value can be obtained from the result_info.cursor field in the response.`}).option(`id`,{type:`string`,description:`Filter by registration ID.`}).option(`device-id`,{type:`string`,description:`Filter by WARP device ID.`}).option(`policy-id`,{type:`string`,description:`Filter by the ID of the device settings profile assigned to the registration.`}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the registration response. Supported values are: "policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Mo={command:`list`,describe:`Lists WARP registrations.`,builder:v(jo),handler:async r=>{let i={"user.id":r[`user-id`],seen_after:r[`seen-after`],seen_before:r[`seen-before`],status:r.status,per_page:r[`per-page`],search:r.search,sort_by:r[`sort-by`],sort_order:r[`sort-order`],cursor:r.cursor,id:r.id,"device.id":r[`device-id`],"policy.id":r[`policy-id`],include:r.include};if(r.dryRun){s({command:`cf zero-trust devices registrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.devices.registrations.list({account_id:u,...i})),{successLabel:`Loaded`})}};function No(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to revoke.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Po={command:`revoke`,describe:`Revokes a list of WARP registrations.`,builder:No,handler:async r=>{let i={id:r.id};if(r.dryRun){s({command:`cf zero-trust devices registrations revoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations/revoke`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,!await _({force:!!r.force,message:`This operation revokes device registrations destructively.`})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>l.zeroTrust.devices.registrations.revoke({account_id:u,...i})),{successLabel:`Deleted`})}};function Fo(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to unrevoke.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Io={command:`unrevoke`,describe:`Unrevokes a list of WARP registrations.`,builder:Fo,handler:async r=>{let i={id:r.id};if(r.dryRun){s({command:`cf zero-trust devices registrations unrevoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/registrations/unrevoke`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Creating`,async()=>l.zeroTrust.devices.registrations.unrevoke({account_id:u,...i})),{successLabel:`Created`})}},Lo={command:`registrations`,describe:`Operations for devices.registrations`,builder:e=>e.command(Eo).command(Oo).command(Ao).command(Mo).command(Po).command(Io).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ro(e){return e.option(`disconnect`,{type:`boolean`,description:`Disconnects all devices on the account using Global WARP override.`}).option(`justification`,{type:`string`,description:`Reasoning for setting the Global WARP override state. This will be surfaced in the audit log.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const zo={command:`create`,describe:`Sets the Global WARP override state.`,builder:Ro,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices resilience global-warp-override create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/resilience/disconnect`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({disconnect:r.disconnect,justification:p(r.justification,`justification`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.devices.resilience.globalWarpOverride.create({...e,account_id:l})),{successLabel:`Created`});return}if(r.disconnect===void 0)throw Error(`--disconnect is required (or pass --body with this field set).`);let d=f({disconnect:r.disconnect,justification:p(r.justification,`justification`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.devices.resilience.globalWarpOverride.create({...d,account_id:l})),{successLabel:`Created`})}};function Bo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vo={command:`get`,describe:`Fetch the Global WARP override state.`,builder:Bo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices resilience global-warp-override get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/resilience/disconnect`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.resilience.globalWarpOverride.get({account_id:l})),{successLabel:`Loaded`})}},Ho={command:`global-warp-override`,describe:`Operations for devices.resilience.global-warp-override`,builder:e=>e.command(zo).command(Vo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Uo={command:`resilience`,describe:`Operations for devices.resilience`,builder:e=>e.command(Ho).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Wo(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Go={command:`revoke <device-id>`,describe:`Revokes all WARP registrations associated with the specified device.`,builder:Wo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices revoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/physical-devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}/revoke`,pathParams:{"device-id":String(r[`device-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force,message:`This operation revokes a device's session destructively.`})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.revoke({account_id:l,device_id:r[`device-id`]})),{successLabel:`Deleted`})}};function Ko(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const qo={command:`delete`,describe:`Resets the current device settings for a Zero Trust account.`,builder:Ko,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices settings delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.devices.settings.delete({account_id:l})),{successLabel:`Deleted`})}};function Jo(e){return e.option(`disable-for-time`,{type:`number`,description:`Sets the time limit, in seconds, that a user can use an override code to bypass WARP.`}).option(`external-emergency-signal-enabled`,{type:`boolean`,description:`Controls whether the external emergency disconnect feature is enabled.`}).option(`external-emergency-signal-fingerprint`,{type:`string`,description:`The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.`}).option(`external-emergency-signal-interval`,{type:`string`,description:`The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.`}).option(`external-emergency-signal-url`,{type:`string`,description:`The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.`}).option(`gateway-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on TCP.`}).option(`gateway-udp-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on UDP.`}).option(`root-certificate-installation-enabled`,{type:`boolean`,description:`Enable installation of cloudflare managed root certificate.`}).option(`use-zt-virtual-ip`,{type:`boolean`,description:`Enable using CGNAT virtual IPv4.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Yo={command:`edit`,describe:`Patches the current device settings for a Zero Trust account.`,builder:Jo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({disable_for_time:r[`disable-for-time`],external_emergency_signal_enabled:r[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:p(r[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:p(r[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:p(r[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:r[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:r[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:r[`root-certificate-installation-enabled`],use_zt_virtual_ip:r[`use-zt-virtual-ip`]}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.settings.edit({body:e,account_id:l})),{successLabel:`Updated`});return}let d=f({disable_for_time:r[`disable-for-time`],external_emergency_signal_enabled:r[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:p(r[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:p(r[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:p(r[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:r[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:r[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:r[`root-certificate-installation-enabled`],use_zt_virtual_ip:r[`use-zt-virtual-ip`]});o(await c(`Updating`,async()=>i.zeroTrust.devices.settings.edit({body:d,account_id:l})),{successLabel:`Updated`})}};function Xo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zo={command:`get`,describe:`Describes the current device settings for a Zero Trust account.`,builder:Xo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.devices.settings.get({account_id:l})),{successLabel:`Loaded`})}};function Qo(e){return e.option(`disable-for-time`,{type:`number`,description:`Sets the time limit, in seconds, that a user can use an override code to bypass WARP.`}).option(`external-emergency-signal-enabled`,{type:`boolean`,description:`Controls whether the external emergency disconnect feature is enabled.`}).option(`external-emergency-signal-fingerprint`,{type:`string`,description:`The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.`}).option(`external-emergency-signal-interval`,{type:`string`,description:`The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.`}).option(`external-emergency-signal-url`,{type:`string`,description:`The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.`}).option(`gateway-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on TCP.`}).option(`gateway-udp-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on UDP.`}).option(`root-certificate-installation-enabled`,{type:`boolean`,description:`Enable installation of cloudflare managed root certificate.`}).option(`use-zt-virtual-ip`,{type:`boolean`,description:`Enable using CGNAT virtual IPv4.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const $o={command:`update`,describe:`Updates the current device settings for a Zero Trust account.`,builder:Qo,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust devices settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({disable_for_time:r[`disable-for-time`],external_emergency_signal_enabled:r[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:p(r[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:p(r[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:p(r[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:r[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:r[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:r[`root-certificate-installation-enabled`],use_zt_virtual_ip:r[`use-zt-virtual-ip`]}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.devices.settings.update({body:e,account_id:l})),{successLabel:`Updated`});return}let d=f({disable_for_time:r[`disable-for-time`],external_emergency_signal_enabled:r[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:p(r[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:p(r[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:p(r[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:r[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:r[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:r[`root-certificate-installation-enabled`],use_zt_virtual_ip:r[`use-zt-virtual-ip`]});o(await c(`Updating`,async()=>i.zeroTrust.devices.settings.update({body:d,account_id:l})),{successLabel:`Updated`})}},es={command:`settings`,describe:`Operations for devices.settings`,builder:e=>e.command(qo).command(Yo).command(Zo).command($o).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ts={command:`devices`,describe:`Operations for devices`,builder:e=>e.command(mi).command(Oi).command(Vi).command(Go).command(fi).command(Ei).command(zi).command(Qi).command(ra).command(to).command(wo).command(Lo).command(Uo).command(es).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ns(e){return e.option(`from`,{type:`string`,description:`Start time for connection period in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for connection period in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`sort-by`,{type:`string`,description:`Type of usage that colos should be sorted by. If unspecified, returns all Cloudflare colos sorted alphabetically.`,choices:[`fleet-status-usage`,`application-tests-usage`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const rs={command:`list`,describe:`List Cloudflare colos that account's devices were connected to during a time period, sorted by usage starting from the most used colo. Colos without traffic are also returned and sorted alphabetically.`,builder:v(ns),handler:async r=>{let i={from:r.from,to:r.to,sortBy:r[`sort-by`]};if(r.dryRun){s({command:`cf zero-trust dex colos list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/colos`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.colos.list({account_id:u,...i})),{successLabel:`Loaded`})}},is={command:`colos`,describe:`Operations for dex.colos`,builder:e=>e.command(rs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function as(e){return e.option(`commands`,{type:`string`,description:`List of device-level commands to execute. Provide as a JSON array of objects or @path/to/file.json.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const os={command:`create`,describe:`Initiate commands for up to 10 devices per account.`,builder:as,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex commands create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/commands`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({commands:d(r.commands,`commands`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dex.commands.create({...e,account_id:l})),{successLabel:`Created`});return}if(r.commands===void 0)throw Error(`--commands is required (or pass --body with this field set).`);let p=f({commands:d(r.commands,`commands`)});o(await c(`Creating`,async()=>i.zeroTrust.dex.commands.create({...p,account_id:l})),{successLabel:`Created`})}};function ss(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`search`,{type:`string`,description:`Filter devices by name or email.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const cs={command:`list`,describe:`List devices with WARP client support for remote captures which have been connected in the last 1 hour.`,builder:ss,handler:async r=>{let i={page:r.page,per_page:r[`per-page`],search:r.search};if(r.dryRun){s({command:`cf zero-trust dex commands eligible-devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/commands/devices`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.commands.eligibleDevices.list({account_id:u,...i})),{successLabel:`Loaded`})}},ls={command:`eligible-devices`,describe:`Operations for dex.commands.eligible-devices`,builder:e=>e.command(cs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function us(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`}).option(`device-id`,{type:`string`,description:`Unique identifier for a device.`}).option(`user-email`,{type:`string`,description:`Email tied to the device.`}).option(`command-type`,{type:`string`,description:`Optionally filter executed commands by command type.`,choices:[`pcap`,`speed-test`,`warp-diag`]}).option(`status`,{type:`string`,description:`Optionally filter executed commands by status.`,choices:[`PENDING_EXEC`,`PENDING_UPLOAD`,`SUCCESS`,`FAILED`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ds={command:`list`,describe:`Retrieves a paginated list of commands issued to devices under the specified account, optionally filtered by time range, device, or other parameters`,builder:v(us),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],from:r.from,to:r.to,device_id:r[`device-id`],user_email:r[`user-email`],command_type:r[`command-type`],status:r.status};if(r.dryRun){s({command:`cf zero-trust dex commands list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/commands`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.commands.list({account_id:u,...i})),{successLabel:`Loaded`})}};function fs(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ps={command:`get`,describe:`Retrieves the current quota usage and limits for device commands within a specific account, including the time when the quota will reset`,builder:fs,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex commands quota get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/commands/quota`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dex.commands.quota.get({account_id:l})),{successLabel:`Loaded`})}},ms={command:`quota`,describe:`Operations for dex.commands.quota`,builder:e=>e.command(ps).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function hs(e){return e.positional(`filename`,{type:`string`,description:"The name of the file to be downloaded, including the `.zip` extension.",demandOption:!0}).option(`command-id`,{type:`string`,description:`Unique identifier for command.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`text`,{type:`boolean`,description:`Decode the response body as UTF-8 text instead of writing raw bytes`,default:!1})}const gs={command:`get <filename>`,describe:`Downloads artifacts for an executed command. Bulk downloads are not supported`,builder:hs,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex commands results get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/commands/${r[`command-id`]==null?`<command-id>`:encodeURIComponent(String(r[`command-id`]))}/downloads/${r.filename==null?`<filename>`:encodeURIComponent(String(r.filename))}`,pathParams:{"command-id":String(r[`command-id`]??``),filename:String(r.filename??``)},bodyKind:`none`});return}await a(r);let i=r.local?e:await t();r.accountId=i;let o=await c(`Loading`,async()=>te(`/accounts/${i}/dex/commands/${encodeURIComponent(String(r[`command-id`]))}/downloads/${encodeURIComponent(String(r.filename))}`,{method:`GET`,local:r.local===!0,persistTo:r.persistTo}));ee(r.text===!0?o.toString(`utf-8`):o)}},_s={command:`results`,describe:`Operations for dex.commands.results`,builder:e=>e.command(gs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},vs={command:`commands`,describe:`Operations for dex.commands`,builder:e=>e.command(os).command(ds).command(ls).command(ms).command(_s).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ys(e){return e.option(`since-minutes`,{type:`number`,description:`Number of minutes before current time.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const bs={command:`get`,describe:`Get details for live (up to 60 minutes) devices using WARP.`,builder:ys,handler:async r=>{let i={since_minutes:r[`since-minutes`]};if(r.dryRun){s({command:`cf zero-trust dex devices aggregates live get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/fleet-status/live`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.devices.aggregates.live.get({account_id:u,...i})),{successLabel:`Loaded`})}},xs={command:`live`,describe:`Operations for dex.devices.aggregates.live`,builder:e=>e.command(bs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ss(e){return e.option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Cloudflare colo airport code.`}).option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cs={command:`get`,describe:`Get aggregate details for devices using WARP, up to 7 days.`,builder:Ss,handler:async r=>{let i={to:r.to,from:r.from,colo:r.colo,device_id:r[`device-id`]};if(r.dryRun){s({command:`cf zero-trust dex devices aggregates over-time get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/fleet-status/over-time`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.devices.aggregates.overTime.get({account_id:u,...i})),{successLabel:`Loaded`})}},ws={command:`over-time`,describe:`Operations for dex.devices.aggregates.over-time`,builder:e=>e.command(Cs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ts={command:`aggregates`,describe:`Operations for dex.devices.aggregates`,builder:e=>e.command(xs).command(ws).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Es(e){return e.positional(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`since-minutes`,{type:`number`,description:`Number of minutes before current time.`,demandOption:!0}).option(`time-now`,{type:`string`,description:`Current time in ISO format.`}).option(`colo`,{type:`string`,description:`List of data centers to filter results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ds={command:`get <device-id>`,describe:`Get the latest status of a device given device_id from the device_state table.`,builder:Es,handler:async r=>{let i={since_minutes:r[`since-minutes`],time_now:r[`time-now`],colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}/fleet-status/live`,pathParams:{"device-id":String(r[`device-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.devices.get({account_id:u,device_id:r[`device-id`],...i})),{successLabel:`Loaded`})}};function Os(e){return e.option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`sort-by`,{type:`string`,description:`Dimension to sort results by.`,choices:[`colo`,`device_id`,`mode`,`platform`,`status`,`timestamp`,`version`]}).option(`colo`,{type:`string`,description:`Cloudflare colo airport code.`}).option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`}).option(`status`,{type:`string`,description:`Network status.`}).option(`platform`,{type:`string`,description:`Operating system.`}).option(`version`,{type:`string`,description:`WARP client version.`}).option(`source`,{type:`string`,description:"Source:\n  * `hourly` - device details aggregated hourly, up to 7 days prior\n  * `last_seen` - device details, up to 60 minutes prior. Time windows exceeding 60 minutes will be rejected from June 1st, 2026. Please use 'hourly' or 'raw' instead for longer time ranges.\n  * `raw` - device details, up to 7 days prior",choices:[`last_seen`,`hourly`,`raw`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ks={command:`list`,describe:`List details of devices using WARP.`,builder:v(Os),handler:async r=>{let i={to:r.to,from:r.from,page:r.page,per_page:r[`per-page`],sort_by:r[`sort-by`],colo:r.colo,device_id:r[`device-id`],status:r.status,platform:r.platform,version:r.version,source:r.source};if(r.dryRun){s({command:`cf zero-trust dex devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/fleet-status/devices`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.devices.list({account_id:u,...i})),{successLabel:`Loaded`})}};function As(e){return e.positional(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`List of data centers to filter results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const js={command:`get <device-id>`,describe:`Get time-bucketed status metrics for a specific device.`,builder:v(As),handler:async r=>{let i={from:r.from,to:r.to,interval:r.interval,colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex devices over-time get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}/fleet-status/over-time`,pathParams:{"device-id":String(r[`device-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.devices.overTime.get({account_id:u,device_id:r[`device-id`],...i})),{successLabel:`Loaded`})}},Ms={command:`over-time`,describe:`Operations for dex.devices.over-time`,builder:e=>e.command(js).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ns={command:`devices`,describe:`Operations for dex.devices`,builder:e=>e.command(Ds).command(ks).command(Ts).command(Ms).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ps(e){return e.option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of paginated results. Mutually exclusive with cursor.`}).option(`per-page`,{type:`number`,description:`Number of items per page`,demandOption:!0}).option(`cursor`,{type:`string`,description:`Cursor for cursor-based pagination. Mutually exclusive with page.`}).option(`sort-by`,{type:`string`,description:`The field to sort results by.`,choices:[`time_start`]}).option(`sort-order`,{type:`string`,description:`The order to sort results.`,choices:[`ASC`,`DESC`]}).option(`from`,{type:`string`,description:`Start time for the query in ISO 8601 format.`}).option(`to`,{type:`string`,description:`End time for the query in ISO 8601 format.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fs={command:`list`,describe:`List ISP information observed for a specific device during traceroute tests.`,builder:v(Ps),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],cursor:r.cursor,sort_by:r[`sort-by`],sort_order:r[`sort-order`],from:r.from,to:r.to};if(r.dryRun){s({command:`cf zero-trust dex isps list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/${r[`device-id`]==null?`<device-id>`:encodeURIComponent(String(r[`device-id`]))}/isps`,pathParams:{"device-id":String(r[`device-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.isps.list({account_id:u,device_id:r[`device-id`],...i})),{successLabel:`Loaded`})}},Is={command:`isps`,describe:`Operations for dex.isps`,builder:e=>e.command(Fs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ls(e){return e.option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`test-name`,{type:`string`,description:`Optionally filter results by test name.`}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`registration-id`,{type:`string`,description:`Optionally filter results to a specific device registration. Must be used in combination with a single deviceId.`}).option(`page`,{type:`number`,description:`Page number of paginated results`}).option(`per-page`,{type:`number`,description:`Number of items per page`}).option(`kind`,{type:`string`,description:`Filter by test type.`,choices:[`http`,`traceroute`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Rs={command:`list`,describe:`List DEX tests with overview metrics.`,builder:v(Ls),handler:async r=>{let i={colo:r.colo,testName:r[`test-name`],deviceId:r[`device-id`],registration_id:r[`registration-id`],page:r.page,per_page:r[`per-page`],kind:r.kind};if(r.dryRun){s({command:`cf zero-trust dex overview tests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/tests/overview`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.overview.tests.list({account_id:u,...i})),{successLabel:`Loaded`})}};function zs(e){return e.option(`test-name`,{type:`string`,description:`Optionally filter results by test name.`}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bs={command:`get`,describe:`Returns unique count of devices that have run synthetic application monitoring tests in the past 7 days.`,builder:zs,handler:async r=>{let i={testName:r[`test-name`],deviceId:r[`device-id`]};if(r.dryRun){s({command:`cf zero-trust dex overview tests unique-devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/tests/unique-devices`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.overview.tests.uniqueDevices.get({account_id:u,...i})),{successLabel:`Loaded`})}},Vs={command:`unique-devices`,describe:`Operations for dex.overview.tests.unique-devices`,builder:e=>e.command(Bs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Hs={command:`tests`,describe:`Operations for dex.overview.tests`,builder:e=>e.command(Rs).command(Vs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Us={command:`overview`,describe:`Operations for dex.overview`,builder:e=>e.command(Hs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ws(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`match`,{type:`string`,description:`The wirefilter expression to match.`}).option(`name`,{type:`string`,description:`The name of the Rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Gs={command:`create`,describe:`Create a DEX Rule.`,builder:Ws,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),match:p(r.match,`match`,`text`),name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dex.rules.create({...e,account_id:l})),{successLabel:`Created`});return}r.match===void 0&&(r.match=await h(`match`,`The wirefilter expression to match.`)),r.name===void 0&&(r.name=await h(`name`,`The name of the Rule.`));let d=f({description:p(r.description,`description`,`text`),match:p(r.match,`match`,`text`),name:p(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dex.rules.create({...d,account_id:l})),{successLabel:`Created`})}};function Ks(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const qs={command:`delete <rule-id>`,describe:`Delete a DEX Rule.`,builder:Ks,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dex.rules.delete({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Deleted`})}};function Js(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ys={command:`get <rule-id>`,describe:`Get details for a DEX Rule.`,builder:Js,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dex.rules.get({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Loaded`})}};function Xs(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`sort-order`,{type:`string`,description:`Sort direction for sort_by property.`,choices:[`ASC`,`DESC`]}).option(`sort-by`,{type:`string`,description:`Which property to sort results by.`,choices:[`name`,`created_at`,`updated_at`]}).option(`name`,{type:`string`,description:`Filter results by rule name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zs={command:`list`,describe:`List DEX Rules.`,builder:v(Xs),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],sort_order:r[`sort-order`],sort_by:r[`sort-by`],name:r.name};if(r.dryRun){s({command:`cf zero-trust dex rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/rules`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.rules.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Qs(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`match`,{type:`string`,description:`The wirefilter expression to match.`}).option(`name`,{type:`string`,description:`The name of the Rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const $s={command:`update <rule-id>`,describe:`Update a DEX Rule.`,builder:Qs,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex rules update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),match:p(r.match,`match`,`text`),name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dex.rules.update({...e,account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}let d=f({description:p(r.description,`description`,`text`),match:p(r.match,`match`,`text`),name:p(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dex.rules.update({...d,account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},ec={command:`rules`,describe:`Operations for dex.rules`,builder:e=>e.command(Gs).command(qs).command(Ys).command(Zs).command($s).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function tc(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const nc={command:`get <test-id>`,describe:`Get test details and aggregate performance metrics for an http test for a given time period between 1 hour and 7 days.`,builder:v(tc),handler:async r=>{let i={deviceId:r[`device-id`],from:r.from,to:r.to,interval:r.interval,colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex test-results http get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/http-tests/${r[`test-id`]==null?`<test-id>`:encodeURIComponent(String(r[`test-id`]))}`,pathParams:{"test-id":String(r[`test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.testResults.http.get({account_id:u,test_id:r[`test-id`],...i})),{successLabel:`Loaded`})}};function rc(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ic={command:`get <test-id>`,describe:`Get percentiles for an http test for a given time period between 1 hour and 7 days.`,builder:rc,handler:async r=>{let i={deviceId:r[`device-id`],from:r.from,to:r.to,colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex test-results http percentiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/http-tests/${r[`test-id`]==null?`<test-id>`:encodeURIComponent(String(r[`test-id`]))}/percentiles`,pathParams:{"test-id":String(r[`test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.testResults.http.percentiles.get({account_id:u,test_id:r[`test-id`],...i})),{successLabel:`Loaded`})}},ac={command:`percentiles`,describe:`Operations for dex.test-results.http.percentiles`,builder:e=>e.command(ic).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},oc={command:`http`,describe:`Operations for dex.test-results.http`,builder:e=>e.command(nc).command(ac).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function sc(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const cc={command:`get <test-id>`,describe:`Get test details and aggregate performance metrics for a traceroute test for a given time period between 1 hour and 7 days.`,builder:v(sc),handler:async r=>{let i={deviceId:r[`device-id`],from:r.from,to:r.to,interval:r.interval,colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex test-results traceroute get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/traceroute-tests/${r[`test-id`]==null?`<test-id>`:encodeURIComponent(String(r[`test-id`]))}`,pathParams:{"test-id":String(r[`test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.testResults.traceroute.get({account_id:u,test_id:r[`test-id`],...i})),{successLabel:`Loaded`})}};function lc(e){return e.positional(`test-result-id`,{type:`string`,description:`Unique identifier for a specific traceroute test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const uc={command:`get <test-result-id>`,describe:`Get a breakdown of hops and performance metrics for a specific traceroute test run`,builder:lc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex test-results traceroute network-path get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/traceroute-test-results/${r[`test-result-id`]==null?`<test-result-id>`:encodeURIComponent(String(r[`test-result-id`]))}/network-path`,pathParams:{"test-result-id":String(r[`test-result-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dex.testResults.traceroute.networkPath.get({account_id:l,test_result_id:r[`test-result-id`]})),{successLabel:`Loaded`})}},dc={command:`network-path`,describe:`Operations for dex.test-results.traceroute.network-path`,builder:e=>e.command(uc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function fc(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pc={command:`get <test-id>`,describe:`Get percentiles for a traceroute test for a given time period between 1 hour and 7 days.`,builder:fc,handler:async r=>{let i={deviceId:r[`device-id`],from:r.from,to:r.to,colo:r.colo};if(r.dryRun){s({command:`cf zero-trust dex test-results traceroute percentiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/traceroute-tests/${r[`test-id`]==null?`<test-id>`:encodeURIComponent(String(r[`test-id`]))}/percentiles`,pathParams:{"test-id":String(r[`test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.testResults.traceroute.percentiles.get({account_id:u,test_id:r[`test-id`],...i})),{successLabel:`Loaded`})}},mc={command:`percentiles`,describe:`Operations for dex.test-results.traceroute.percentiles`,builder:e=>e.command(pc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},hc={command:`traceroute`,describe:`Operations for dex.test-results.traceroute`,builder:e=>e.command(cc).command(dc).command(mc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},gc={command:`test-results`,describe:`Operations for dex.test-results`,builder:e=>e.command(oc).command(hc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function _c(e){return e.option(`data-host`,{type:`string`,description:`The desired endpoint to test.`}).option(`data-kind`,{type:`string`,description:`The type of test.`,choices:[`http`,`traceroute`]}).option(`data-method`,{type:`string`,description:`The HTTP request method type.`,choices:[`GET`]}).option(`description`,{type:`string`,description:`Additional details about the test.`}).option(`enabled`,{type:`boolean`,description:`Determines whether or not the test is active.`}).option(`interval`,{type:`string`,description:`How often the test will run.`}).option(`name`,{type:`string`,description:`The name of the DEX test. Must be unique.`}).option(`targeted`,{type:`boolean`,description:`The targeted field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const vc={command:`create`,describe:`Create a DEX test.`,builder:_c,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex tests create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/dex_tests`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({data:{host:p(r[`data-host`],`data-host`,`text`),kind:p(r[`data-kind`],`data-kind`,`text`),method:p(r[`data-method`],`data-method`,`text`)},description:p(r.description,`description`,`text`),enabled:r.enabled,interval:p(r.interval,`interval`,`text`),name:p(r.name,`name`,`text`),targeted:r.targeted}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dex.tests.create({body:e,account_id:l})),{successLabel:`Created`});return}if(r[`data-host`]===void 0&&(r[`data-host`]=await h(`data-host`,`The desired endpoint to test.`)),r[`data-kind`]===void 0&&(r[`data-kind`]=await g(`data-kind`,`The type of test.`,[`http`,`traceroute`])),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.interval===void 0&&(r.interval=await h(`interval`,`How often the test will run.`)),r.name===void 0&&(r.name=await h(`name`,`The name of the DEX test. Must be unique.`));let d=f({data:{host:p(r[`data-host`],`data-host`,`text`),kind:p(r[`data-kind`],`data-kind`,`text`),method:p(r[`data-method`],`data-method`,`text`)},description:p(r.description,`description`,`text`),enabled:r.enabled,interval:p(r.interval,`interval`,`text`),name:p(r.name,`name`,`text`),targeted:r.targeted});o(await c(`Creating`,async()=>i.zeroTrust.dex.tests.create({body:d,account_id:l})),{successLabel:`Created`})}};function yc(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const bc={command:`delete <dex-test-id>`,describe:`Delete a Device DEX test. Returns the remaining device dex tests for the account.`,builder:yc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex tests delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/dex_tests/${r[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(r[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(r[`dex-test-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dex.tests.delete({account_id:l,dex_test_id:r[`dex-test-id`]})),{successLabel:`Deleted`})}};function xc(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sc={command:`get <dex-test-id>`,describe:`Fetch a single DEX test.`,builder:xc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex tests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/dex_tests/${r[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(r[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(r[`dex-test-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dex.tests.get({account_id:l,dex_test_id:r[`dex-test-id`]})),{successLabel:`Loaded`})}};function Cc(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`test-name`,{type:`string`,description:`Filter by test name.`}).option(`kind`,{type:`string`,description:`Filter by test type.`,choices:[`http`,`traceroute`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wc={command:`list`,describe:`Fetch all DEX tests.`,builder:v(Cc),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],testName:r[`test-name`],kind:r.kind};if(r.dryRun){s({command:`cf zero-trust dex tests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/dex_tests`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.tests.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Tc(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Device to filter traceroute result runs to.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ec={command:`get <test-id>`,describe:`Get a breakdown of metrics by hop for individual traceroute test runs.`,builder:v(Tc),handler:async r=>{let i={deviceId:r[`device-id`],from:r.from,to:r.to,interval:r.interval};if(r.dryRun){s({command:`cf zero-trust dex tests network-path get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/traceroute-tests/${r[`test-id`]==null?`<test-id>`:encodeURIComponent(String(r[`test-id`]))}/network-path`,pathParams:{"test-id":String(r[`test-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.tests.networkPath.get({account_id:u,test_id:r[`test-id`],...i})),{successLabel:`Loaded`})}},Dc={command:`network-path`,describe:`Operations for dex.tests.network-path`,builder:e=>e.command(Ec).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Oc(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`data-host`,{type:`string`,description:`The desired endpoint to test.`}).option(`data-kind`,{type:`string`,description:`The type of test.`,choices:[`http`,`traceroute`]}).option(`data-method`,{type:`string`,description:`The HTTP request method type.`,choices:[`GET`]}).option(`description`,{type:`string`,description:`Additional details about the test.`}).option(`enabled`,{type:`boolean`,description:`Determines whether or not the test is active.`}).option(`interval`,{type:`string`,description:`How often the test will run.`}).option(`name`,{type:`string`,description:`The name of the DEX test. Must be unique.`}).option(`targeted`,{type:`boolean`,description:`The targeted field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const kc={command:`update <dex-test-id>`,describe:`Update a DEX test.`,builder:Oc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dex tests update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/devices/dex_tests/${r[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(r[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(r[`dex-test-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({data:{host:p(r[`data-host`],`data-host`,`text`),kind:p(r[`data-kind`],`data-kind`,`text`),method:p(r[`data-method`],`data-method`,`text`)},description:p(r.description,`description`,`text`),enabled:r.enabled,interval:p(r.interval,`interval`,`text`),name:p(r.name,`name`,`text`),targeted:r.targeted}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dex.tests.update({body:e,account_id:l,dex_test_id:r[`dex-test-id`]})),{successLabel:`Updated`});return}if(r[`data-host`]===void 0&&(r[`data-host`]=await h(`data-host`,`The desired endpoint to test.`)),r[`data-kind`]===void 0&&(r[`data-kind`]=await g(`data-kind`,`The type of test.`,[`http`,`traceroute`])),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.interval===void 0&&(r.interval=await h(`interval`,`How often the test will run.`)),r.name===void 0&&(r.name=await h(`name`,`The name of the DEX test. Must be unique.`));let d=f({data:{host:p(r[`data-host`],`data-host`,`text`),kind:p(r[`data-kind`],`data-kind`,`text`),method:p(r[`data-method`],`data-method`,`text`)},description:p(r.description,`description`,`text`),enabled:r.enabled,interval:p(r.interval,`interval`,`text`),name:p(r.name,`name`,`text`),targeted:r.targeted});o(await c(`Updating`,async()=>i.zeroTrust.dex.tests.update({body:d,account_id:l,dex_test_id:r[`dex-test-id`]})),{successLabel:`Updated`})}},Ac={command:`tests`,describe:`Operations for dex.tests`,builder:e=>e.command(vc).command(bc).command(Sc).command(wc).command(kc).command(Dc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function jc(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`type`,{type:`string`,description:`Filter events by type 'config' or 'toggle'.`,choices:[`config`,`toggle`]}).option(`toggle`,{type:`string`,description:`Filter events by type toggle value. Applicable to type='toggle' events only.`,choices:[`on`,`off`]}).option(`config-name`,{type:`string`,description:`Filter events by WARP configuration name changed from or to. Applicable to type='config' events only.`}).option(`account-name`,{type:`string`,description:`Filter events by account name.`}).option(`sort-order`,{type:`string`,description:`Sort response by event timestamp.`,choices:[`ASC`,`DESC`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Mc={command:`list`,describe:`List WARP configuration and enablement toggle change events by device.`,builder:v(jc),handler:async r=>{let i={page:r.page,per_page:r[`per-page`],from:r.from,to:r.to,type:r.type,toggle:r.toggle,config_name:r[`config-name`],account_name:r[`account-name`],sort_order:r[`sort-order`]};if(r.dryRun){s({command:`cf zero-trust dex warp-change-events list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dex/warp-change-events`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dex.warpChangeEvents.list({account_id:u,...i})),{successLabel:`Loaded`})}},Nc={command:`warp-change-events`,describe:`Operations for dex.warp-change-events`,builder:e=>e.command(Mc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Pc={command:`dex`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(is).command(vs).command(Ns).command(Is).command(Us).command(ec).command(gc).command(Ac).command(Nc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Fc(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`topic`,{type:`string`,description:`The topic field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new custom prompt topic to create.`})}const Ic={command:`create`,describe:`Creates a DLP custom prompt topic entry.`,builder:Fc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp custom-prompt-topics create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/custom_prompt_topics`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),enabled:r.enabled,name:p(r.name,`name`,`text`),profile_id:p(r[`profile-id`],`profile-id`,`text`),topic:p(r.topic,`topic`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.customPromptTopics.create({...e,account_id:l})),{successLabel:`Created`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await h(`name`,`The name field`)),r.topic===void 0&&(r.topic=await h(`topic`,`The topic field`));let d=f({description:p(r.description,`description`,`text`),enabled:r.enabled,name:p(r.name,`name`,`text`),profile_id:p(r[`profile-id`],`profile-id`,`text`),topic:p(r.topic,`topic`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.customPromptTopics.create({...d,account_id:l})),{successLabel:`Created`})}};function Lc(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Rc={command:`delete <entry-id>`,describe:`Deletes a DLP custom prompt topic entry.`,builder:Lc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp custom-prompt-topics delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/custom_prompt_topics/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.customPromptTopics.delete({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Deleted`})}};function zc(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bc={command:`get <entry-id>`,describe:`Fetches a DLP custom prompt topic entry by ID.`,builder:zc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp custom-prompt-topics get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/custom_prompt_topics/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.customPromptTopics.get({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Loaded`})}};function Vc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Hc={command:`list`,describe:`Lists all DLP custom prompt topic entries in an account.`,builder:Vc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp custom-prompt-topics list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/custom_prompt_topics`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.customPromptTopics.list({account_id:l})),{successLabel:`Loaded`})}};function Uc(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`topic`,{type:`string`,description:`The topic field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the custom prompt topic.`})}const Wc={command:`update <entry-id>`,describe:`Updates a DLP custom prompt topic entry.`,builder:Uc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp custom-prompt-topics update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/custom_prompt_topics/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),enabled:r.enabled,name:p(r.name,`name`,`text`),topic:p(r.topic,`topic`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.customPromptTopics.update({...e,account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Updated`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await h(`name`,`The name field`)),r.topic===void 0&&(r.topic=await h(`topic`,`The topic field`));let d=f({description:p(r.description,`description`,`text`),enabled:r.enabled,name:p(r.name,`name`,`text`),topic:p(r.topic,`topic`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.customPromptTopics.update({...d,account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Updated`})}},$={command:`custom-prompt-topics`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Ic).command(Rc).command(Bc).command(Hc).command(Wc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Gc(e){return e.option(`data-tags`,{type:`string`,array:!0,description:`The data_tags field`}).option(`description`,{type:`string`,description:`The description field`}).option(`expression`,{type:`string`,description:`The expression field`}).option(`name`,{type:`string`,description:`The name field`}).option(`sensitivity-levels`,{type:`string`,description:`The sensitivity_levels field. Provide as a JSON array of objects or @path/to/file.json.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new data class.`})}const Kc={command:`create`,describe:`Creates a data class for use in DLP profiles.`,builder:Gc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-classes create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_classes`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({data_tags:r[`data-tags`],description:p(r.description,`description`,`text`),expression:p(r.expression,`expression`,`text`),name:p(r.name,`name`,`text`),sensitivity_levels:d(r[`sensitivity-levels`],`sensitivity-levels`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataClasses.create({...e,account_id:l})),{successLabel:`Created`});return}if(r[`data-tags`]===void 0)throw Error(`--data-tags is required (or pass --body with this field set).`);if(r.expression===void 0&&(r.expression=await h(`expression`,`The expression field`)),r.name===void 0&&(r.name=await h(`name`,`The name field`)),r[`sensitivity-levels`]===void 0)throw Error(`--sensitivity-levels is required (or pass --body with this field set).`);let m=f({data_tags:r[`data-tags`],description:p(r.description,`description`,`text`),expression:p(r.expression,`expression`,`text`),name:p(r.name,`name`,`text`),sensitivity_levels:d(r[`sensitivity-levels`],`sensitivity-levels`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataClasses.create({...m,account_id:l})),{successLabel:`Created`})}};function qc(e){return e.positional(`data-class-id`,{type:`string`,description:`Data class ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Jc={command:`delete <data-class-id>`,describe:`Deletes a data class from the account.`,builder:qc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-classes delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_classes/${r[`data-class-id`]==null?`<data-class-id>`:encodeURIComponent(String(r[`data-class-id`]))}`,pathParams:{"data-class-id":String(r[`data-class-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.dataClasses.delete({account_id:l,data_class_id:r[`data-class-id`]})),{successLabel:`Deleted`})}};function Yc(e){return e.positional(`data-class-id`,{type:`string`,description:`Data class ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xc={command:`get <data-class-id>`,describe:`Gets the configuration for a data class.`,builder:Yc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-classes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_classes/${r[`data-class-id`]==null?`<data-class-id>`:encodeURIComponent(String(r[`data-class-id`]))}`,pathParams:{"data-class-id":String(r[`data-class-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataClasses.get({account_id:l,data_class_id:r[`data-class-id`]})),{successLabel:`Loaded`})}};function Zc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qc={command:`list`,describe:`Lists data classes configured for the account.`,builder:Zc,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-classes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_classes`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataClasses.list({account_id:l})),{successLabel:`Loaded`})}};function $c(e){return e.positional(`data-class-id`,{type:`string`,description:`Data class ID`,demandOption:!0}).option(`data-tags`,{type:`string`,array:!0,description:`The data_tags field`}).option(`description`,{type:`string`,description:`The description field`}).option(`expression`,{type:`string`,description:`The expression field`}).option(`name`,{type:`string`,description:`The name field`}).option(`sensitivity-levels`,{type:`string`,description:`The sensitivity_levels field. Provide as a JSON array of objects or @path/to/file.json.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the data class to update.`})}const el={command:`update <data-class-id>`,describe:`Updates the configuration for a data class.`,builder:$c,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-classes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_classes/${r[`data-class-id`]==null?`<data-class-id>`:encodeURIComponent(String(r[`data-class-id`]))}`,pathParams:{"data-class-id":String(r[`data-class-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({data_tags:r[`data-tags`],description:p(r.description,`description`,`text`),expression:p(r.expression,`expression`,`text`),name:p(r.name,`name`,`text`),sensitivity_levels:d(r[`sensitivity-levels`],`sensitivity-levels`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataClasses.update({...e,account_id:l,data_class_id:r[`data-class-id`]})),{successLabel:`Updated`});return}let m=f({data_tags:r[`data-tags`],description:p(r.description,`description`,`text`),expression:p(r.expression,`expression`,`text`),name:p(r.name,`name`,`text`),sensitivity_levels:d(r[`sensitivity-levels`],`sensitivity-levels`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataClasses.update({...m,account_id:l,data_class_id:r[`data-class-id`]})),{successLabel:`Updated`})}},tl={command:`data-classes`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Kc).command(Jc).command(Xc).command(Qc).command(el).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function nl(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`tags`,{type:`string`,description:"Tags to create with the category. Mutually exclusive with `template_id`. Provide as a JSON array of objects or @path/to/file.json."}).option(`template-id`,{type:`string`,description:`The template_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new data tag category.`})}const rl={command:`create`,describe:`Creates a data tag category, optionally from a template.`,builder:nl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-categories create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`),tags:d(r.tags,`tags`),template_id:p(r[`template-id`],`template-id`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataTagCategories.create({...e,account_id:l})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await h(`name`,`The name field`));let m=f({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`),tags:d(r.tags,`tags`),template_id:p(r[`template-id`],`template-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataTagCategories.create({...m,account_id:l})),{successLabel:`Created`})}};function il(e){return e.positional(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const al={command:`delete <category-id>`,describe:`Deletes a data tag category and its tags.`,builder:il,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-categories delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.dataTagCategories.delete({account_id:l,category_id:r[`category-id`]})),{successLabel:`Deleted`})}};function ol(e){return e.positional(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sl={command:`get <category-id>`,describe:`Gets a data tag category and its tags.`,builder:ol,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-categories get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTagCategories.get({account_id:l,category_id:r[`category-id`]})),{successLabel:`Loaded`})}};function cl(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ll={command:`list`,describe:`Lists data tag categories configured for the account.`,builder:cl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-categories list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTagCategories.list({account_id:l})),{successLabel:`Loaded`})}};function ul(e){return e.positional(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`tags`,{type:`string`,description:"The desired final state of tags.\n- `None` (omitted): no tag changes.\n- `Some([])`: delete all tags.\n- `Some([...])`: desired final set + order. Provide as a JSON array of objects or @path/to/file.json."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the data tag category to update.`})}const dl={command:`update <category-id>`,describe:`Updates a data tag category and its tags.`,builder:ul,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-categories update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`),tags:d(r.tags,`tags`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataTagCategories.update({...e,account_id:l,category_id:r[`category-id`]})),{successLabel:`Updated`});return}let m=f({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`),tags:d(r.tags,`tags`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataTagCategories.update({...m,account_id:l,category_id:r[`category-id`]})),{successLabel:`Updated`})}},fl={command:`data-tag-categories`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(rl).command(al).command(sl).command(ll).command(dl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pl(e){return e.positional(`template-id`,{type:`string`,description:`Template ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ml={command:`get <template-id>`,describe:`Gets an available data tag category template.`,builder:pl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-category-templates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_category_templates/${r[`template-id`]==null?`<template-id>`:encodeURIComponent(String(r[`template-id`]))}`,pathParams:{"template-id":String(r[`template-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTagCategoryTemplates.get({account_id:l,template_id:r[`template-id`]})),{successLabel:`Loaded`})}};function hl(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gl={command:`list`,describe:`Lists available data tag category templates.`,builder:hl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tag-category-templates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_category_templates`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTagCategoryTemplates.list({account_id:l})),{successLabel:`Loaded`})}},_l={command:`data-tag-category-templates`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(ml).command(gl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function vl(e){return e.positional(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new data tag.`})}const yl={command:`create <category-id>`,describe:`Creates a data tag in a category.`,builder:vl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tags create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}/data_tags`,pathParams:{"category-id":String(r[`category-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataTags.create({body:e,account_id:l,category_id:r[`category-id`]})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await h(`name`,`The name field`));let d=f({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.dataTags.create({body:d,account_id:l,category_id:r[`category-id`]})),{successLabel:`Created`})}};function bl(e){return e.positional(`tag-id`,{type:`string`,description:`Tag ID`,demandOption:!0}).option(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const xl={command:`delete <tag-id>`,describe:`Deletes a data tag from a category.`,builder:bl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tags delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}/data_tags/${r[`tag-id`]==null?`<tag-id>`:encodeURIComponent(String(r[`tag-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``),"tag-id":String(r[`tag-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.dataTags.delete({account_id:l,category_id:r[`category-id`],tag_id:r[`tag-id`]})),{successLabel:`Deleted`})}};function Sl(e){return e.positional(`tag-id`,{type:`string`,description:`Tag ID`,demandOption:!0}).option(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cl={command:`get <tag-id>`,describe:`Gets a data tag from a category.`,builder:Sl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tags get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}/data_tags/${r[`tag-id`]==null?`<tag-id>`:encodeURIComponent(String(r[`tag-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``),"tag-id":String(r[`tag-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTags.get({account_id:l,category_id:r[`category-id`],tag_id:r[`tag-id`]})),{successLabel:`Loaded`})}};function wl(e){return e.option(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Tl={command:`list`,describe:`Lists data tags in a category.`,builder:wl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tags list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}/data_tags`,pathParams:{"category-id":String(r[`category-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.dataTags.list({account_id:l,category_id:r[`category-id`]})),{successLabel:`Loaded`})}};function El(e){return e.positional(`tag-id`,{type:`string`,description:`Tag ID`,demandOption:!0}).option(`category-id`,{type:`string`,description:`Category ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the data tag to update.`})}const Dl={command:`update <tag-id>`,describe:`Updates a data tag in a category.`,builder:El,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp data-tags update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/data_tag_categories/${r[`category-id`]==null?`<category-id>`:encodeURIComponent(String(r[`category-id`]))}/data_tags/${r[`tag-id`]==null?`<tag-id>`:encodeURIComponent(String(r[`tag-id`]))}`,pathParams:{"category-id":String(r[`category-id`]??``),"tag-id":String(r[`tag-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataTags.update({...e,account_id:l,category_id:r[`category-id`],tag_id:r[`tag-id`]})),{successLabel:`Updated`});return}let d=f({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.dataTags.update({...d,account_id:l,category_id:r[`category-id`],tag_id:r[`tag-id`]})),{successLabel:`Updated`})}},Ol={command:`data-tags`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(yl).command(xl).command(Cl).command(Tl).command(Dl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function kl(e){return e.option(`case-sensitive`,{type:`boolean`,description:`Only applies to custom word lists.
 Determines if the words should be matched in a case-sensitive manner
 Cannot be set to false if \`secret\` is true or undefined`}).option(`description`,{type:`string`,description:`The description of the dataset.`}).option(`encoding-version`,{type:`number`,description:`Dataset encoding version
 
@@ -44,16 +44,16 @@ Omitting this field provides the default value 0, which is interpreted
 the same as 1.`}).option(`name`,{type:`string`,description:`The name field`}).option(`secret`,{type:`boolean`,description:`Generate a secret dataset.
 
 If true, the response will include a secret to use with the EDM encoder.
-If false, the response has no secret and the dataset is uploaded in plaintext.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset description.`})}const kl={command:`create`,describe:`Creates a new DLP (Data Loss Prevention) dataset for storing custom detection patterns. Datasets can contain exact match data, word lists, or EDM (Exact Data Match) configurations.`,builder:Ol,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({case_sensitive:r[`case-sensitive`],description:f(r.description,`description`,`text`),encoding_version:r[`encoding-version`],name:f(r.name,`name`,`text`),secret:r.secret}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.datasets.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({case_sensitive:r[`case-sensitive`],description:f(r.description,`description`,`text`),encoding_version:r[`encoding-version`],name:f(r.name,`name`,`text`),secret:r.secret});o(await c(`Creating`,async()=>i.zeroTrust.dlp.datasets.create({...p,account_id:u})),{successLabel:`Created`})}};function Al(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const jl={command:`delete <dataset-id>`,describe:`This deletes all versions of the dataset.`,builder:Al,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.datasets.delete({account_id:l,dataset_id:r[`dataset-id`]})),{successLabel:`Deleted`})}};function Ml(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Nl={command:`get <dataset-id>`,describe:`Gets a dataset and its latest upload status.`,builder:Ml,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.datasets.get({account_id:l,dataset_id:r[`dataset-id`]})),{successLabel:`Loaded`})}};function Pl(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fl={command:`list`,describe:`Lists all DLP datasets configured for the account, including custom word lists and EDM datasets.`,builder:Pl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.datasets.list({account_id:l})),{successLabel:`Loaded`})}};function Il(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`case-sensitive`,{type:`boolean`,description:`Determines if the words should be matched in a case-sensitive manner.
+If false, the response has no secret and the dataset is uploaded in plaintext.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset description.`})}const Al={command:`create`,describe:`Creates a new DLP (Data Loss Prevention) dataset for storing custom detection patterns. Datasets can contain exact match data, word lists, or EDM (Exact Data Match) configurations.`,builder:kl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({case_sensitive:r[`case-sensitive`],description:p(r.description,`description`,`text`),encoding_version:r[`encoding-version`],name:p(r.name,`name`,`text`),secret:r.secret}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.datasets.create({...e,account_id:l})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await h(`name`,`The name field`));let d=f({case_sensitive:r[`case-sensitive`],description:p(r.description,`description`,`text`),encoding_version:r[`encoding-version`],name:p(r.name,`name`,`text`),secret:r.secret});o(await c(`Creating`,async()=>i.zeroTrust.dlp.datasets.create({...d,account_id:l})),{successLabel:`Created`})}};function jl(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ml={command:`delete <dataset-id>`,describe:`This deletes all versions of the dataset.`,builder:jl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.datasets.delete({account_id:l,dataset_id:r[`dataset-id`]})),{successLabel:`Deleted`})}};function Nl(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pl={command:`get <dataset-id>`,describe:`Gets a dataset and its latest upload status.`,builder:Nl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.datasets.get({account_id:l,dataset_id:r[`dataset-id`]})),{successLabel:`Loaded`})}};function Fl(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Il={command:`list`,describe:`Lists all DLP datasets configured for the account, including custom word lists and EDM datasets.`,builder:Fl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.datasets.list({account_id:l})),{successLabel:`Loaded`})}};function Ll(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`case-sensitive`,{type:`boolean`,description:`Determines if the words should be matched in a case-sensitive manner.
 
-Only required for custom word lists.`}).option(`description`,{type:`string`,description:`The description of the dataset.`}).option(`name`,{type:`string`,description:`The name of the dataset, must be unique.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset description.`})}const Ll={command:`update <dataset-id>`,describe:`Updates the configuration of an existing DLP dataset, such as its name, description, or detection settings.`,builder:Il,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({case_sensitive:r[`case-sensitive`],description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.datasets.update({...e,account_id:u,dataset_id:r[`dataset-id`]})),{successLabel:`Updated`});return}let p=d({case_sensitive:r[`case-sensitive`],description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.datasets.update({...p,account_id:u,dataset_id:r[`dataset-id`]})),{successLabel:`Updated`})}};function Rl(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zl={command:`create <dataset-id>`,describe:`Creates a new version of a DLP dataset, allowing you to stage changes before activation. Used for single-column EDM and custom word lists.`,builder:Rl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets upload create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}/upload`,pathParams:{"dataset-id":String(r[`dataset-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.dlp.datasets.upload.create({account_id:l,dataset_id:r[`dataset-id`]})),{successLabel:`Created`})}};function Bl(e){return e.positional(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset. For custom wordlists this contains UTF-8 patterns separated by newline characters.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Vl={command:`edit <version>`,describe:`This is used for single-column EDMv1 and Custom Word Lists. The EDM format can only be created in the Cloudflare dashboard. For other clients, this operation can only be used for non-secret Custom Word Lists. The body must be a UTF-8 encoded, newline (NL or CRNL) separated list of words to be matched.`,builder:Bl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets upload edit`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}/upload/${r.version==null?`<version>`:encodeURIComponent(String(r.version))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``),version:String(r.version??``)},bodyKind:`octet-stream`,body:r.body});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,r.file){let e=p(r.file);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/dlp/datasets/${encodeURIComponent(String(r[`dataset-id`]))}/upload/${encodeURIComponent(String(r.version))}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(r.body){let e=f(r.body,`body`,`binary`);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/dlp/datasets/${encodeURIComponent(String(r[`dataset-id`]))}/upload/${encodeURIComponent(String(r.version))}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Hl={command:`upload`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(zl).command(Vl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ul(e){return e.positional(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`array of new columns to create for this dataset version.`})}const Wl={command:`create <version>`,describe:`This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. The columns in the response appear in the same order as in the request.`,builder:Ul,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets versions create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}/versions/${r.version==null?`<version>`:encodeURIComponent(String(r.version))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``),version:String(r.version??``)},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.datasets.versions.create({body:e,account_id:u,dataset_id:r[`dataset-id`],version:r.version})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Gl(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset content.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Kl={command:`create <entry-id>`,describe:`This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard.`,builder:Gl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets versions entries create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}/versions/${r.version==null?`<version>`:encodeURIComponent(String(r.version))}/entries/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``),version:String(r.version??``),"entry-id":String(r[`entry-id`]??``)},bodyKind:`octet-stream`,body:r.body});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,r.file){let e=p(r.file);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/dlp/datasets/${encodeURIComponent(String(r[`dataset-id`]))}/versions/${encodeURIComponent(String(r.version))}/entries/${encodeURIComponent(String(r[`entry-id`]))}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(r.body){let e=f(r.body,`body`,`binary`);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/dlp/datasets/${encodeURIComponent(String(r[`dataset-id`]))}/versions/${encodeURIComponent(String(r.version))}/entries/${encodeURIComponent(String(r[`entry-id`]))}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},ql={command:`entries`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Kl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Jl={command:`versions`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Wl).command(ql).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Yl={command:`datasets`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(kl).command(jl).command(Nl).command(Fl).command(Ll).command(Hl).command(Jl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Xl(e){return e.option(`auth-requirements-allowed-microsoft-organizations`,{type:`string`,array:!0,description:`The auth_requirements.allowed_microsoft_organizations field`}).option(`auth-requirements-type`,{type:`string`,description:`The auth_requirements.type field`,choices:[`Org`,`NoAuth`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Account mapping.`})}const Zl={command:`create`,describe:`Creates a mapping between a Cloudflare account and an email provider for DLP email scanning integration.`,builder:Xl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email account-mapping create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/account_mapping`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({auth_requirements:{allowed_microsoft_organizations:r[`auth-requirements-allowed-microsoft-organizations`],type:f(r[`auth-requirements-type`],`auth-requirements-type`,`text`)}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.email.accountMapping.create({...e,account_id:u})),{successLabel:`Created`});return}r[`auth-requirements-type`]===void 0&&(r[`auth-requirements-type`]=await h(`auth-requirements-type`,`The auth_requirements.type field`,[`Org`,`NoAuth`]));let p=d({auth_requirements:{allowed_microsoft_organizations:r[`auth-requirements-allowed-microsoft-organizations`],type:f(r[`auth-requirements-type`],`auth-requirements-type`,`text`)}});o(await c(`Creating`,async()=>i.zeroTrust.dlp.email.accountMapping.create({...p,account_id:u})),{successLabel:`Created`})}};function Ql(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $l={command:`get`,describe:`Retrieves the email provider mapping configuration for DLP email scanning.`,builder:Ql,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email account-mapping get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/account_mapping`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.email.accountMapping.get({account_id:l})),{successLabel:`Loaded`})}},eu={command:`account-mapping`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Zl).command($l).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function tu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule priorities.`})}const nu={command:`bulk-edit`,describe:`Reorders DLP email scanning rules by updating their priority values. Higher priority rules are evaluated first.`,builder:tu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules bulk-edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.email.rules.bulkEdit({...e,account_id:u})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function ru(e){return e.option(`action-action`,{type:`string`,description:`The action.action field`,choices:[`Block`]}).option(`action-message`,{type:`string`,description:`The action.message field`}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule description.`})}const iu={command:`create`,describe:`Creates a new DLP email scanning rule that defines what content patterns to detect in email messages and what actions to take.`,builder:ru,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({action:{action:f(r[`action-action`],`action-action`,`text`),message:f(r[`action-message`],`action-message`,`text`)},description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.email.rules.create({body:e,account_id:u})),{successLabel:`Created`});return}if(r[`action-action`]===void 0&&(r[`action-action`]=await h(`action-action`,`The action.action field`,[`Block`])),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({action:{action:f(r[`action-action`],`action-action`,`text`),message:f(r[`action-message`],`action-message`,`text`)},description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.email.rules.create({body:p,account_id:u})),{successLabel:`Created`})}};function au(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ou={command:`delete <rule-id>`,describe:`Removes a DLP email scanning rule. The rule will no longer be applied to email messages.`,builder:au,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.email.rules.delete({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Deleted`})}};function su(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const cu={command:`get <rule-id>`,describe:`Gets detailed configuration for a specific DLP email scanning rule, including detection patterns and actions.`,builder:su,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.email.rules.get({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Loaded`})}};function lu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const uu={command:`list`,describe:`Lists all email scanner rules for an account.`,builder:lu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.email.rules.list({account_id:l})),{successLabel:`Loaded`})}};function du(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`action-action`,{type:`string`,description:`The action.action field`,choices:[`Block`]}).option(`action-message`,{type:`string`,description:`The action.message field`}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule description.`})}const fu={command:`update <rule-id>`,describe:`Updates a DLP email scanning rule.`,builder:du,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({action:{action:f(r[`action-action`],`action-action`,`text`),message:f(r[`action-message`],`action-message`,`text`)},description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.email.rules.update({body:e,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}if(r[`action-action`]===void 0&&(r[`action-action`]=await h(`action-action`,`The action.action field`,[`Block`])),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({action:{action:f(r[`action-action`],`action-action`,`text`),message:f(r[`action-message`],`action-message`,`text`)},description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.email.rules.update({body:p,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},pu={command:`rules`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(nu).command(iu).command(ou).command(cu).command(uu).command(fu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},mu={command:`email`,describe:`Operations for dlp.email`,builder:e=>e.command(eu).command(pu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function hu(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`pattern-validation`,{type:`string`,description:`The pattern.validation field`,choices:[`luhn`]}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new entry to create.`})}const gu={command:`create`,describe:`Creates a DLP custom entry.`,builder:hu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),pattern:{regex:f(r[`pattern-regex`],`pattern-regex`,`text`),validation:f(r[`pattern-validation`],`pattern-validation`,`text`)},profile_id:f(r[`profile-id`],`profile-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.create({...e,account_id:u})),{successLabel:`Created`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await m(`name`,`The name field`)),r[`pattern-regex`]===void 0&&(r[`pattern-regex`]=await m(`pattern-regex`,`The pattern.regex field`));let p=d({description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),pattern:{regex:f(r[`pattern-regex`],`pattern-regex`,`text`),validation:f(r[`pattern-validation`],`pattern-validation`,`text`)},profile_id:f(r[`profile-id`],`profile-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.create({...p,account_id:u})),{successLabel:`Created`})}};function _u(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`pattern-validation`,{type:`string`,description:`The pattern.validation field`,choices:[`luhn`]}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the entry.`})}const vu={command:`update <entry-id>`,describe:`Updates a DLP custom entry.`,builder:_u,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries custom update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/custom/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),pattern:{regex:f(r[`pattern-regex`],`pattern-regex`,`text`),validation:f(r[`pattern-validation`],`pattern-validation`,`text`)},enabled:r.enabled}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.custom.update({...e,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`});return}if(r.name===void 0&&(r.name=await m(`name`,`The name field`)),r[`pattern-regex`]===void 0&&(r[`pattern-regex`]=await m(`pattern-regex`,`The pattern.regex field`)),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),pattern:{regex:f(r[`pattern-regex`],`pattern-regex`,`text`),validation:f(r[`pattern-validation`],`pattern-validation`,`text`)},enabled:r.enabled});o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.custom.update({...p,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`})}},yu={command:`custom`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(vu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const xu={command:`delete <entry-id>`,describe:`Deletes a DLP custom entry.`,builder:bu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.entries.delete({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Deleted`})}};function Su(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cu={command:`get <entry-id>`,describe:`Fetches a DLP entry by ID.`,builder:Su,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.entries.get({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Loaded`})}};function wu(e){return e.option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`entry-id`,{type:`string`,description:`The entry_id field`}).option(`profile-id`,{type:`string`,description:`This field is not used as the owning profile.
-For predefined entries it is already set to a predefined profile.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`This endpoint will update an existing integration entry. It is not possible to create new integration entries.`})}const Tu={command:`create`,describe:`Integration entries can't be created, this will update an existing integration entry. This is needed for our generated terraform API.`,builder:wu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries integration create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/integration`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({enabled:r.enabled,entry_id:f(r[`entry-id`],`entry-id`,`text`),profile_id:f(r[`profile-id`],`profile-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.integration.create({body:e,account_id:u})),{successLabel:`Created`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r[`entry-id`]===void 0&&(r[`entry-id`]=await m(`entry-id`,`The entry_id field`));let p=d({enabled:r.enabled,entry_id:f(r[`entry-id`],`entry-id`,`text`),profile_id:f(r[`profile-id`],`profile-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.integration.create({body:p,account_id:u})),{successLabel:`Created`})}};function Eu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Du={command:`delete <entry-id>`,describe:`This is a no-op as integration entires can't be deleted but is needed for our generated terraform API.`,builder:Eu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries integration delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/integration/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.entries.integration.delete({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Deleted`})}};function Ou(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Enable or disable integration entry in owning profile.`})}const ku={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:Ou,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries integration update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/integration/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({enabled:r.enabled}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.integration.update({body:e,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let f=d({enabled:r.enabled});o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.integration.update({body:f,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`})}},Au={command:`integration`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Tu).command(Du).command(ku).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ju(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Mu={command:`list`,describe:`Lists all DLP entries in an account.`,builder:ju,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.entries.list({account_id:l})),{successLabel:`Loaded`})}};function Nu(e){return e.option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`entry-id`,{type:`string`,description:`The entry_id field`}).option(`profile-id`,{type:`string`,description:`This field is not used as the owning profile.
-For predefined entries it is already set to a predefined profile.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`This endpoint will update an existing predefined entry. It is not possible to create new predefined entries.`})}const Pu={command:`create`,describe:`Predefined entries can't be created, this will update an existing predefined entry. This is needed for our generated terraform API.`,builder:Nu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/predefined`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({enabled:r.enabled,entry_id:f(r[`entry-id`],`entry-id`,`text`),profile_id:f(r[`profile-id`],`profile-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.predefined.create({body:e,account_id:u})),{successLabel:`Created`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r[`entry-id`]===void 0&&(r[`entry-id`]=await m(`entry-id`,`The entry_id field`));let p=d({enabled:r.enabled,entry_id:f(r[`entry-id`],`entry-id`,`text`),profile_id:f(r[`profile-id`],`profile-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.predefined.create({body:p,account_id:u})),{successLabel:`Created`})}};function Fu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Iu={command:`delete <entry-id>`,describe:`This is a no-op as predefined entires can't be deleted but is needed for our generated terraform API.`,builder:Fu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries predefined delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/predefined/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.entries.predefined.delete({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Deleted`})}};function Lu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Settings to enable or disable predefined entry in owning profile.`})}const Ru={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:Lu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/predefined/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({enabled:r.enabled}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.predefined.update({body:e,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let f=d({enabled:r.enabled});o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.predefined.update({body:f,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`})}},zu={command:`predefined`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Pu).command(Iu).command(Ru).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`pattern-validation`,{type:`string`,description:`The pattern.validation field`,choices:[`luhn`]}).option(`type`,{type:`string`,description:`The type field`,choices:[`custom`,`predefined`,`integration`]}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the entry.`}).check(e=>{if([`pattern-regex`,`pattern-validation`].some(t=>e[t]!==void 0)){let t=[`pattern-regex`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --pattern-* flag is set`)}return!0})}const Vu={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:Bu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),pattern:{regex:f(r[`pattern-regex`],`pattern-regex`,`text`),validation:f(r[`pattern-validation`],`pattern-validation`,`text`)},type:f(r.type,`type`,`text`),enabled:r.enabled}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.update({body:e,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`});return}if(r.type===void 0&&(r.type=await h(`type`,`The type field`,[`custom`,`predefined`,`integration`])),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),pattern:{regex:f(r[`pattern-regex`],`pattern-regex`,`text`),validation:f(r[`pattern-validation`],`pattern-validation`,`text`)},type:f(r.type,`type`,`text`),enabled:r.enabled});o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.update({body:p,account_id:u,entry_id:r[`entry-id`]})),{successLabel:`Updated`})}},Hu={command:`entries`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(gu).command(xu).command(Cu).command(Mu).command(Vu).command(yu).command(Au).command(zu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Uu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Wu={command:`list`,describe:`Retrieves current DLP usage limits and quotas for the account, including maximum allowed counts and current usage for custom entries, dataset cells, and document fingerprints.`,builder:Uu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp limits list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/limits`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.limits.list({account_id:l})),{successLabel:`Loaded`})}},Gu={command:`limits`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Wu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ku(e){return e.option(`max-match-bytes`,{type:`number`,description:"Maximum number of bytes that the regular expression can match.\n\nIf this is `null` then there is no limit on the length. Patterns can use\n`*` and `+`. Otherwise repeats should use a range `{m,n}` to restrict\npatterns to the length. If this field is missing, then a default length\nlimit is used.\n\nNote that the length is specified in bytes. Since regular expressions\nuse UTF-8 the pattern `.` can match up to 4 bytes. Hence `.{1,256}`\nhas a maximum length of 1024 bytes."}).option(`regex`,{type:`string`,description:`The regex field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Validation query.`})}const qu={command:`validate`,describe:"Validates whether this pattern is a valid regular expression. Rejects it if the regular expression is too complex or can match an unbounded-length string. The regex will be rejected if it uses `*` or `+`. Bound the maximum number of characters that can be matched using a range, e.g. `{1,100}`.",builder:Ku,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp patterns validate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/patterns/validate`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({max_match_bytes:r[`max-match-bytes`],regex:f(r.regex,`regex`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.patterns.validate({...e,account_id:u})),{successLabel:`Created`});return}r.regex===void 0&&(r.regex=await m(`regex`,`The regex field`));let p=d({max_match_bytes:r[`max-match-bytes`],regex:f(r.regex,`regex`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.patterns.validate({...p,account_id:u})),{successLabel:`Created`})}},Ju={command:`patterns`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(qu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Yu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xu={command:`get`,describe:`Gets the current payload logging configuration for DLP, showing whether matched content is being logged.`,builder:Yu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp payload-logs get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/payload_log`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.payloadLogs.get({account_id:l})),{successLabel:`Loaded`})}};function Zu(e){return e.option(`masking-level`,{type:`string`,description:"Masking level for payload logs.\n\n- `full`: The entire payload is masked.\n- `partial`: Only partial payload content is masked.\n- `clear`: No masking is applied to the payload content.\n- `default`: DLP uses its default masking behavior.",choices:[`full`,`partial`,`clear`,`default`]}).option(`public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
+Only required for custom word lists.`}).option(`description`,{type:`string`,description:`The description of the dataset.`}).option(`name`,{type:`string`,description:`The name of the dataset, must be unique.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset description.`})}const Rl={command:`update <dataset-id>`,describe:`Updates the configuration of an existing DLP dataset, such as its name, description, or detection settings.`,builder:Ll,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({case_sensitive:r[`case-sensitive`],description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.datasets.update({...e,account_id:l,dataset_id:r[`dataset-id`]})),{successLabel:`Updated`});return}let d=f({case_sensitive:r[`case-sensitive`],description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.datasets.update({...d,account_id:l,dataset_id:r[`dataset-id`]})),{successLabel:`Updated`})}};function zl(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bl={command:`create <dataset-id>`,describe:`Creates a new version of a DLP dataset, allowing you to stage changes before activation. Used for single-column EDM and custom word lists.`,builder:zl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets upload create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}/upload`,pathParams:{"dataset-id":String(r[`dataset-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.dlp.datasets.upload.create({account_id:l,dataset_id:r[`dataset-id`]})),{successLabel:`Created`})}};function Vl(e){return e.positional(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset. For custom wordlists this contains UTF-8 patterns separated by newline characters.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Hl={command:`edit <version>`,describe:`This is used for single-column EDMv1 and Custom Word Lists. The EDM format can only be created in the Cloudflare dashboard. For other clients, this operation can only be used for non-secret Custom Word Lists. The body must be a UTF-8 encoded, newline (NL or CRNL) separated list of words to be matched.`,builder:Vl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets upload edit`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}/upload/${r.version==null?`<version>`:encodeURIComponent(String(r.version))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``),version:String(r.version??``)},bodyKind:`octet-stream`,body:r.body});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,r.file){let e=m(r.file);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/dlp/datasets/${encodeURIComponent(String(r[`dataset-id`]))}/upload/${encodeURIComponent(String(r.version))}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(r.body){let e=p(r.body,`body`,`binary`);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/dlp/datasets/${encodeURIComponent(String(r[`dataset-id`]))}/upload/${encodeURIComponent(String(r.version))}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ul={command:`upload`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Bl).command(Hl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Wl(e){return e.positional(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`array of new columns to create for this dataset version.`})}const Gl={command:`create <version>`,describe:`This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. The columns in the response appear in the same order as in the request.`,builder:Wl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets versions create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}/versions/${r.version==null?`<version>`:encodeURIComponent(String(r.version))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``),version:String(r.version??``)},bodyKind:`json`,body:r.body===void 0?void 0:u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.datasets.versions.create({body:e,account_id:l,dataset_id:r[`dataset-id`],version:r.version})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Kl(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset content.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const ql={command:`create <entry-id>`,describe:`This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard.`,builder:Kl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp datasets versions entries create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/datasets/${r[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(r[`dataset-id`]))}/versions/${r.version==null?`<version>`:encodeURIComponent(String(r.version))}/entries/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"dataset-id":String(r[`dataset-id`]??``),version:String(r.version??``),"entry-id":String(r[`entry-id`]??``)},bodyKind:`octet-stream`,body:r.body});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,r.file){let e=m(r.file);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/dlp/datasets/${encodeURIComponent(String(r[`dataset-id`]))}/versions/${encodeURIComponent(String(r.version))}/entries/${encodeURIComponent(String(r[`entry-id`]))}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(r.body){let e=p(r.body,`body`,`binary`);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/dlp/datasets/${encodeURIComponent(String(r[`dataset-id`]))}/versions/${encodeURIComponent(String(r.version))}/entries/${encodeURIComponent(String(r[`entry-id`]))}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Jl={command:`entries`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(ql).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Yl={command:`versions`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Gl).command(Jl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Xl={command:`datasets`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Al).command(Ml).command(Pl).command(Il).command(Rl).command(Ul).command(Yl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Zl(e){return e.option(`auth-requirements-allowed-microsoft-organizations`,{type:`string`,array:!0,description:`The auth_requirements.allowed_microsoft_organizations field`}).option(`auth-requirements-type`,{type:`string`,description:`The auth_requirements.type field`,choices:[`Org`,`NoAuth`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Account mapping.`})}const Ql={command:`create`,describe:`Creates a mapping between a Cloudflare account and an email provider for DLP email scanning integration.`,builder:Zl,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email account-mapping create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/account_mapping`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({auth_requirements:{allowed_microsoft_organizations:r[`auth-requirements-allowed-microsoft-organizations`],type:p(r[`auth-requirements-type`],`auth-requirements-type`,`text`)}}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.email.accountMapping.create({...e,account_id:l})),{successLabel:`Created`});return}r[`auth-requirements-type`]===void 0&&(r[`auth-requirements-type`]=await g(`auth-requirements-type`,`The auth_requirements.type field`,[`Org`,`NoAuth`]));let d=f({auth_requirements:{allowed_microsoft_organizations:r[`auth-requirements-allowed-microsoft-organizations`],type:p(r[`auth-requirements-type`],`auth-requirements-type`,`text`)}});o(await c(`Creating`,async()=>i.zeroTrust.dlp.email.accountMapping.create({...d,account_id:l})),{successLabel:`Created`})}};function $l(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const eu={command:`get`,describe:`Retrieves the email provider mapping configuration for DLP email scanning.`,builder:$l,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email account-mapping get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/account_mapping`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.email.accountMapping.get({account_id:l})),{successLabel:`Loaded`})}},tu={command:`account-mapping`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Ql).command(eu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function nu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule priorities.`})}const ru={command:`bulk-edit`,describe:`Reorders DLP email scanning rules by updating their priority values. Higher priority rules are evaluated first.`,builder:nu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules bulk-edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.email.rules.bulkEdit({...e,account_id:l})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function iu(e){return e.option(`action-action`,{type:`string`,description:`The action.action field`,choices:[`Block`]}).option(`action-message`,{type:`string`,description:`The action.message field`}).option(`conditions`,{type:`string`,description:`Triggered if all conditions match. Provide as a JSON array of objects or @path/to/file.json.`}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule description.`})}const au={command:`create`,describe:`Creates a new DLP email scanning rule that defines what content patterns to detect in email messages and what actions to take.`,builder:iu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({action:{action:p(r[`action-action`],`action-action`,`text`),message:p(r[`action-message`],`action-message`,`text`)},conditions:d(r.conditions,`conditions`),description:p(r.description,`description`,`text`),enabled:r.enabled,name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.email.rules.create({body:e,account_id:l})),{successLabel:`Created`});return}if(r[`action-action`]===void 0&&(r[`action-action`]=await g(`action-action`,`The action.action field`,[`Block`])),r.conditions===void 0)throw Error(`--conditions is required (or pass --body with this field set).`);if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await h(`name`,`The name field`));let m=f({action:{action:p(r[`action-action`],`action-action`,`text`),message:p(r[`action-message`],`action-message`,`text`)},conditions:d(r.conditions,`conditions`),description:p(r.description,`description`,`text`),enabled:r.enabled,name:p(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.email.rules.create({body:m,account_id:l})),{successLabel:`Created`})}};function ou(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const su={command:`delete <rule-id>`,describe:`Removes a DLP email scanning rule. The rule will no longer be applied to email messages.`,builder:ou,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.email.rules.delete({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Deleted`})}};function cu(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lu={command:`get <rule-id>`,describe:`Gets detailed configuration for a specific DLP email scanning rule, including detection patterns and actions.`,builder:cu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.email.rules.get({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Loaded`})}};function uu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const du={command:`list`,describe:`Lists all email scanner rules for an account.`,builder:uu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.email.rules.list({account_id:l})),{successLabel:`Loaded`})}};function fu(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`action-action`,{type:`string`,description:`The action.action field`,choices:[`Block`]}).option(`action-message`,{type:`string`,description:`The action.message field`}).option(`conditions`,{type:`string`,description:`Triggered if all conditions match. Provide as a JSON array of objects or @path/to/file.json.`}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule description.`})}const pu={command:`update <rule-id>`,describe:`Updates a DLP email scanning rule.`,builder:fu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp email rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/email/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({action:{action:p(r[`action-action`],`action-action`,`text`),message:p(r[`action-message`],`action-message`,`text`)},conditions:d(r.conditions,`conditions`),description:p(r.description,`description`,`text`),enabled:r.enabled,name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.email.rules.update({body:e,account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}if(r[`action-action`]===void 0&&(r[`action-action`]=await g(`action-action`,`The action.action field`,[`Block`])),r.conditions===void 0)throw Error(`--conditions is required (or pass --body with this field set).`);if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await h(`name`,`The name field`));let m=f({action:{action:p(r[`action-action`],`action-action`,`text`),message:p(r[`action-message`],`action-message`,`text`)},conditions:d(r.conditions,`conditions`),description:p(r.description,`description`,`text`),enabled:r.enabled,name:p(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.email.rules.update({body:m,account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},mu={command:`rules`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(ru).command(au).command(su).command(lu).command(du).command(pu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},hu={command:`email`,describe:`Operations for dlp.email`,builder:e=>e.command(tu).command(mu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function gu(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`pattern-validation`,{type:`string`,description:`The pattern.validation field`,choices:[`luhn`]}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new entry to create.`})}const _u={command:`create`,describe:`Creates a DLP custom entry.`,builder:gu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),enabled:r.enabled,name:p(r.name,`name`,`text`),pattern:{regex:p(r[`pattern-regex`],`pattern-regex`,`text`),validation:p(r[`pattern-validation`],`pattern-validation`,`text`)},profile_id:p(r[`profile-id`],`profile-id`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.create({...e,account_id:l})),{successLabel:`Created`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await h(`name`,`The name field`)),r[`pattern-regex`]===void 0&&(r[`pattern-regex`]=await h(`pattern-regex`,`The pattern.regex field`));let d=f({description:p(r.description,`description`,`text`),enabled:r.enabled,name:p(r.name,`name`,`text`),pattern:{regex:p(r[`pattern-regex`],`pattern-regex`,`text`),validation:p(r[`pattern-validation`],`pattern-validation`,`text`)},profile_id:p(r[`profile-id`],`profile-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.create({...d,account_id:l})),{successLabel:`Created`})}};function vu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`pattern-validation`,{type:`string`,description:`The pattern.validation field`,choices:[`luhn`]}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the entry.`})}const yu={command:`update <entry-id>`,describe:`Updates a DLP custom entry.`,builder:vu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries custom update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/custom/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`),pattern:{regex:p(r[`pattern-regex`],`pattern-regex`,`text`),validation:p(r[`pattern-validation`],`pattern-validation`,`text`)},enabled:r.enabled}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.custom.update({...e,account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Updated`});return}if(r.name===void 0&&(r.name=await h(`name`,`The name field`)),r[`pattern-regex`]===void 0&&(r[`pattern-regex`]=await h(`pattern-regex`,`The pattern.regex field`)),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let d=f({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`),pattern:{regex:p(r[`pattern-regex`],`pattern-regex`,`text`),validation:p(r[`pattern-validation`],`pattern-validation`,`text`)},enabled:r.enabled});o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.custom.update({...d,account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Updated`})}},bu={command:`custom`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(yu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function xu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Su={command:`delete <entry-id>`,describe:`Deletes a DLP custom entry.`,builder:xu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.entries.delete({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Deleted`})}};function Cu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wu={command:`get <entry-id>`,describe:`Fetches a DLP entry by ID.`,builder:Cu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.entries.get({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Loaded`})}};function Tu(e){return e.option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`entry-id`,{type:`string`,description:`The entry_id field`}).option(`profile-id`,{type:`string`,description:`This field is not used as the owning profile.
+For predefined entries it is already set to a predefined profile.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`This endpoint will update an existing integration entry. It is not possible to create new integration entries.`})}const Eu={command:`create`,describe:`Integration entries can't be created, this will update an existing integration entry. This is needed for our generated terraform API.`,builder:Tu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries integration create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/integration`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({enabled:r.enabled,entry_id:p(r[`entry-id`],`entry-id`,`text`),profile_id:p(r[`profile-id`],`profile-id`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.integration.create({body:e,account_id:l})),{successLabel:`Created`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r[`entry-id`]===void 0&&(r[`entry-id`]=await h(`entry-id`,`The entry_id field`));let d=f({enabled:r.enabled,entry_id:p(r[`entry-id`],`entry-id`,`text`),profile_id:p(r[`profile-id`],`profile-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.integration.create({body:d,account_id:l})),{successLabel:`Created`})}};function Du(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ou={command:`delete <entry-id>`,describe:`This is a no-op as integration entires can't be deleted but is needed for our generated terraform API.`,builder:Du,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries integration delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/integration/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.entries.integration.delete({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Deleted`})}};function ku(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Enable or disable integration entry in owning profile.`})}const Au={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:ku,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries integration update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/integration/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({enabled:r.enabled}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.integration.update({body:e,account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Updated`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let d=f({enabled:r.enabled});o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.integration.update({body:d,account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Updated`})}},ju={command:`integration`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Eu).command(Ou).command(Au).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Mu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Nu={command:`list`,describe:`Lists all DLP entries in an account.`,builder:Mu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.entries.list({account_id:l})),{successLabel:`Loaded`})}};function Pu(e){return e.option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`entry-id`,{type:`string`,description:`The entry_id field`}).option(`profile-id`,{type:`string`,description:`This field is not used as the owning profile.
+For predefined entries it is already set to a predefined profile.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`This endpoint will update an existing predefined entry. It is not possible to create new predefined entries.`})}const Fu={command:`create`,describe:`Predefined entries can't be created, this will update an existing predefined entry. This is needed for our generated terraform API.`,builder:Pu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/predefined`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({enabled:r.enabled,entry_id:p(r[`entry-id`],`entry-id`,`text`),profile_id:p(r[`profile-id`],`profile-id`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.predefined.create({body:e,account_id:l})),{successLabel:`Created`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r[`entry-id`]===void 0&&(r[`entry-id`]=await h(`entry-id`,`The entry_id field`));let d=f({enabled:r.enabled,entry_id:p(r[`entry-id`],`entry-id`,`text`),profile_id:p(r[`profile-id`],`profile-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.entries.predefined.create({body:d,account_id:l})),{successLabel:`Created`})}};function Iu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Lu={command:`delete <entry-id>`,describe:`This is a no-op as predefined entires can't be deleted but is needed for our generated terraform API.`,builder:Iu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries predefined delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/predefined/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.entries.predefined.delete({account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Deleted`})}};function Ru(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Settings to enable or disable predefined entry in owning profile.`})}const zu={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:Ru,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/predefined/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({enabled:r.enabled}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.predefined.update({body:e,account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Updated`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let d=f({enabled:r.enabled});o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.predefined.update({body:d,account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Updated`})}},Bu={command:`predefined`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Fu).command(Lu).command(zu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Vu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`pattern-validation`,{type:`string`,description:`The pattern.validation field`,choices:[`luhn`]}).option(`type`,{type:`string`,description:`The type field`,choices:[`custom`,`predefined`,`integration`]}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the entry.`}).check(e=>{if([`pattern-regex`,`pattern-validation`].some(t=>e[t]!==void 0)){let t=[`pattern-regex`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --pattern-* flag is set`)}return!0})}const Hu={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:Vu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp entries update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/entries/${r[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(r[`entry-id`]))}`,pathParams:{"entry-id":String(r[`entry-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`),pattern:{regex:p(r[`pattern-regex`],`pattern-regex`,`text`),validation:p(r[`pattern-validation`],`pattern-validation`,`text`)},type:p(r.type,`type`,`text`),enabled:r.enabled}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.update({body:e,account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Updated`});return}if(r.type===void 0&&(r.type=await g(`type`,`The type field`,[`custom`,`predefined`,`integration`])),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let d=f({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`),pattern:{regex:p(r[`pattern-regex`],`pattern-regex`,`text`),validation:p(r[`pattern-validation`],`pattern-validation`,`text`)},type:p(r.type,`type`,`text`),enabled:r.enabled});o(await c(`Updating`,async()=>i.zeroTrust.dlp.entries.update({body:d,account_id:l,entry_id:r[`entry-id`]})),{successLabel:`Updated`})}},Uu={command:`entries`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(_u).command(Su).command(wu).command(Nu).command(Hu).command(bu).command(ju).command(Bu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Wu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gu={command:`list`,describe:`Retrieves current DLP usage limits and quotas for the account, including maximum allowed counts and current usage for custom entries, dataset cells, and document fingerprints.`,builder:Wu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp limits list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/limits`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.limits.list({account_id:l})),{successLabel:`Loaded`})}},Ku={command:`limits`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Gu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function qu(e){return e.option(`max-match-bytes`,{type:`number`,description:"Maximum number of bytes that the regular expression can match.\n\nIf this is `null` then there is no limit on the length. Patterns can use\n`*` and `+`. Otherwise repeats should use a range `{m,n}` to restrict\npatterns to the length. If this field is missing, then a default length\nlimit is used.\n\nNote that the length is specified in bytes. Since regular expressions\nuse UTF-8 the pattern `.` can match up to 4 bytes. Hence `.{1,256}`\nhas a maximum length of 1024 bytes."}).option(`regex`,{type:`string`,description:`The regex field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Validation query.`})}const Ju={command:`validate`,describe:"Validates whether this pattern is a valid regular expression. Rejects it if the regular expression is too complex or can match an unbounded-length string. The regex will be rejected if it uses `*` or `+`. Bound the maximum number of characters that can be matched using a range, e.g. `{1,100}`.",builder:qu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp patterns validate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/patterns/validate`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({max_match_bytes:r[`max-match-bytes`],regex:p(r.regex,`regex`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.patterns.validate({...e,account_id:l})),{successLabel:`Created`});return}r.regex===void 0&&(r.regex=await h(`regex`,`The regex field`));let d=f({max_match_bytes:r[`max-match-bytes`],regex:p(r.regex,`regex`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.patterns.validate({...d,account_id:l})),{successLabel:`Created`})}},Yu={command:`patterns`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Ju).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Xu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zu={command:`get`,describe:`Gets the current payload logging configuration for DLP, showing whether matched content is being logged.`,builder:Xu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp payload-logs get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/payload_log`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.payloadLogs.get({account_id:l})),{successLabel:`Loaded`})}};function Qu(e){return e.option(`masking-level`,{type:`string`,description:"Masking level for payload logs.\n\n- `full`: The entire payload is masked.\n- `partial`: Only partial payload content is masked.\n- `clear`: No masking is applied to the payload content.\n- `default`: DLP uses its default masking behavior.",choices:[`full`,`partial`,`clear`,`default`]}).option(`public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
 
 - Set to null or empty string to disable payload logging.
 - Set to a non-empty base64 string to enable payload logging with the given key.
@@ -62,31 +62,32 @@ For customers with configurable payload masking feature rolled out:
 - If the field is missing, the existing setting will be kept. Note that this is different from setting to null or empty string.
 
 For all other customers:
-- If the field is missing, the existing setting will be cleared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`New payload log settings.`})}const Qu={command:`update`,describe:`Enables or disables payload logging for DLP matches. When enabled, matched content is stored for review.`,builder:Zu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp payload-logs update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/payload_log`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({masking_level:f(r[`masking-level`],`masking-level`,`text`),public_key:f(r[`public-key`],`public-key`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.payloadLogs.update({...e,account_id:u})),{successLabel:`Updated`});return}let p=d({masking_level:f(r[`masking-level`],`masking-level`,`text`),public_key:f(r[`public-key`],`public-key`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.payloadLogs.update({...p,account_id:u})),{successLabel:`Updated`})}},$u={command:`payload-logs`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Xu).command(Qu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ed(e){return e.option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`Related DLP policies will trigger when the match count exceeds the number set.`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`data-classes`,{type:`string`,array:!0,description:`Data class IDs to associate with the profile.`}).option(`data-tags`,{type:`string`,array:!0,description:`Data tag IDs to associate with the profile.`}).option(`description`,{type:`string`,description:`The description of the profile.`}).option(`name`,{type:`string`,description:`The name field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new profile to create.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const td={command:`create`,describe:`Creates a DLP custom profile.`,builder:ed,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/custom`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},data_classes:r[`data-classes`],data_tags:r[`data-tags`],description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),ocr_enabled:r[`ocr-enabled`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.profiles.custom.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},data_classes:r[`data-classes`],data_tags:r[`data-tags`],description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),ocr_enabled:r[`ocr-enabled`]});o(await c(`Creating`,async()=>i.zeroTrust.dlp.profiles.custom.create({...p,account_id:u})),{successLabel:`Created`})}};function nd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const rd={command:`delete <profile-id>`,describe:`Deletes a DLP custom profile.`,builder:nd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/custom/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.profiles.custom.delete({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Deleted`})}};function id(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ad={command:`get <profile-id>`,describe:`Fetches a custom DLP profile by id.`,builder:id,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles custom get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/custom/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.profiles.custom.get({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Loaded`})}};function od(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`data-classes`,{type:`string`,array:!0,description:`Data class IDs to associate with the profile. If omitted, existing associations are unchanged.`}).option(`data-tags`,{type:`string`,array:!0,description:`Data tag IDs to associate with the profile. If omitted, existing associations are unchanged.`}).option(`description`,{type:`string`,description:`The description of the profile.`}).option(`name`,{type:`string`,description:`The name field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the profile.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const sd={command:`update <profile-id>`,describe:`Updates a DLP custom profile.`,builder:od,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles custom update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/custom/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},data_classes:r[`data-classes`],data_tags:r[`data-tags`],description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),ocr_enabled:r[`ocr-enabled`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.profiles.custom.update({...e,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},data_classes:r[`data-classes`],data_tags:r[`data-tags`],description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),ocr_enabled:r[`ocr-enabled`]});o(await c(`Updating`,async()=>i.zeroTrust.dlp.profiles.custom.update({...p,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`})}},cd={command:`custom`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(td).command(rd).command(ad).command(sd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ld(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ud={command:`get <profile-id>`,describe:`Fetches a DLP profile by ID.`,builder:ld,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.profiles.get({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Loaded`})}};function dd(e){return e.option(`all`,{type:`boolean`,description:`Return all profiles, including those that current account does not have access to.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fd={command:`list`,describe:`Lists all DLP profiles in an account.`,builder:dd,handler:async r=>{let i={all:r.all};if(r.dryRun){s({command:`cf zero-trust dlp profiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dlp.profiles.list({account_id:u,...i})),{successLabel:`Loaded`})}};function pd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`enabled-entries`,{type:`string`,array:!0,description:`The enabled_entries field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Predefined profiles can not be created. This endpoint will only update an existing predefined profiles settings.`})}const md={command:`create <profile-id>`,describe:"This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Creates a DLP predefined profile. Only supports enabling/disabling entries.",builder:pd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}/config`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:r[`enabled-entries`],ocr_enabled:r[`ocr-enabled`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.profiles.predefined.create({body:e,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Created`});return}let p=d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:r[`enabled-entries`],ocr_enabled:r[`ocr-enabled`]});o(await c(`Creating`,async()=>i.zeroTrust.dlp.profiles.predefined.create({body:p,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Created`})}};function hd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const gd={command:`delete <profile-id>`,describe:`This is a no-op as predefined profiles can't be deleted but is needed for our generated terraform API.`,builder:hd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles predefined delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.profiles.predefined.delete({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Deleted`})}};function _d(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const vd={command:`get <profile-id>`,describe:"This is similar to `get_predefined` but only returns entries that are enabled. This is needed for our terraform API Fetches a predefined DLP profile by id.",builder:_d,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles predefined get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}/config`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.profiles.predefined.get({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Loaded`})}};function yd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`enabled-entries`,{type:`string`,array:!0,description:`The enabled_entries field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the predefined profile.`})}const bd={command:`update <profile-id>`,describe:"This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Updates a DLP predefined profile. Only supports enabling/disabling entries.",builder:yd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}/config`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:r[`enabled-entries`],ocr_enabled:r[`ocr-enabled`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.profiles.predefined.update({body:e,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`});return}let p=d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:r[`enabled-entries`],ocr_enabled:r[`ocr-enabled`]});o(await c(`Updating`,async()=>i.zeroTrust.dlp.profiles.predefined.update({body:p,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`})}},xd={command:`predefined`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(md).command(gd).command(vd).command(bd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Sd={command:`profiles`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(ud).command(fd).command(cd).command(xd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Cd(e){return e.positional(`template-id`,{type:`string`,description:`Template ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wd={command:`get <template-id>`,describe:`Gets an available sensitivity group template.`,builder:Cd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-group-templates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/templates/${r[`template-id`]==null?`<template-id>`:encodeURIComponent(String(r[`template-id`]))}`,pathParams:{"template-id":String(r[`template-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityGroupTemplates.get({account_id:l,template_id:r[`template-id`]})),{successLabel:`Loaded`})}};function Td(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ed={command:`list`,describe:`Lists available sensitivity group templates.`,builder:Td,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-group-templates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/templates`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityGroupTemplates.list({account_id:l})),{successLabel:`Loaded`})}},Dd={command:`sensitivity-group-templates`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(wd).command(Ed).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Od(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`template-id`,{type:`string`,description:`The template_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new sensitivity group.`})}const kd={command:`create`,describe:`Creates a sensitivity group, optionally from a template.`,builder:Od,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),template_id:f(r[`template-id`],`template-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.sensitivityGroups.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),template_id:f(r[`template-id`],`template-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.sensitivityGroups.create({...p,account_id:u})),{successLabel:`Created`})}};function Ad(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const jd={command:`delete <sensitivity-group-id>`,describe:`Deletes a sensitivity group and its levels.`,builder:Ad,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.sensitivityGroups.delete({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Deleted`})}};function Md(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Nd={command:`get-level-order <sensitivity-group-id>`,describe:`Gets the current order of sensitivity levels in a group.`,builder:Md,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups get-level-order`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/level_order`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityGroups.getLevelOrder({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Loaded`})}};function Pd(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fd={command:`get <sensitivity-group-id>`,describe:`Gets a sensitivity group and its levels.`,builder:Pd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityGroups.get({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Loaded`})}};function Id(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ld={command:`list`,describe:`Lists sensitivity groups configured for the account.`,builder:Id,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityGroups.list({account_id:l})),{successLabel:`Loaded`})}};function Rd(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`level-ids`,{type:`string`,array:!0,description:`The level_ids field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Desired ordered list of level IDs.`})}const zd={command:`update-level-order <sensitivity-group-id>`,describe:`Updates the order of sensitivity levels in a group.`,builder:Rd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups update-level-order`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/level_order`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({level_ids:r[`level-ids`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityGroups.updateLevelOrder({body:e,account_id:u,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Updated`});return}if(r[`level-ids`]===void 0)throw Error(`--level-ids is required (or pass --body with this field set).`);let f=d({level_ids:r[`level-ids`]});o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityGroups.updateLevelOrder({body:f,account_id:u,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Updated`})}};function Bd(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the sensitivity group to update.`})}const Vd={command:`update <sensitivity-group-id>`,describe:`Updates a sensitivity group and its levels.`,builder:Bd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityGroups.update({...e,account_id:u,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityGroups.update({...p,account_id:u,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Updated`})}},Hd={command:`sensitivity-groups`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(kd).command(jd).command(Fd).command(Nd).command(Ld).command(Vd).command(zd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ud(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new sensitivity level.`})}const Wd={command:`create <sensitivity-group-id>`,describe:`Creates a sensitivity level in a group.`,builder:Ud,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-levels create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/levels`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.sensitivityLevels.create({body:e,account_id:u,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.sensitivityLevels.create({body:p,account_id:u,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Created`})}};function Gd(e){return e.positional(`sensitivity-level-id`,{type:`string`,description:`Sensitivity level ID`,demandOption:!0}).option(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Kd={command:`delete <sensitivity-level-id>`,describe:`Deletes a sensitivity level from a group.`,builder:Gd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-levels delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/levels/${r[`sensitivity-level-id`]==null?`<sensitivity-level-id>`:encodeURIComponent(String(r[`sensitivity-level-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``),"sensitivity-level-id":String(r[`sensitivity-level-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.sensitivityLevels.delete({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`],sensitivity_level_id:r[`sensitivity-level-id`]})),{successLabel:`Deleted`})}};function qd(e){return e.positional(`sensitivity-level-id`,{type:`string`,description:`Sensitivity level ID`,demandOption:!0}).option(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jd={command:`get <sensitivity-level-id>`,describe:`Gets a sensitivity level from a group.`,builder:qd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-levels get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/levels/${r[`sensitivity-level-id`]==null?`<sensitivity-level-id>`:encodeURIComponent(String(r[`sensitivity-level-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``),"sensitivity-level-id":String(r[`sensitivity-level-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityLevels.get({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`],sensitivity_level_id:r[`sensitivity-level-id`]})),{successLabel:`Loaded`})}};function Yd(e){return e.option(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xd={command:`list`,describe:`Lists sensitivity levels in a sensitivity group.`,builder:Yd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-levels list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/levels`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityLevels.list({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Loaded`})}};function Zd(e){return e.positional(`sensitivity-level-id`,{type:`string`,description:`Sensitivity level ID`,demandOption:!0}).option(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the sensitivity level to update.`})}const Qd={command:`update <sensitivity-level-id>`,describe:`Updates a sensitivity level in a group.`,builder:Zd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-levels update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/levels/${r[`sensitivity-level-id`]==null?`<sensitivity-level-id>`:encodeURIComponent(String(r[`sensitivity-level-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``),"sensitivity-level-id":String(r[`sensitivity-level-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityLevels.update({...e,account_id:u,sensitivity_group_id:r[`sensitivity-group-id`],sensitivity_level_id:r[`sensitivity-level-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityLevels.update({...p,account_id:u,sensitivity_group_id:r[`sensitivity-group-id`],sensitivity_level_id:r[`sensitivity-level-id`]})),{successLabel:`Updated`})}},$d={command:`sensitivity-levels`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Wd).command(Kd).command(Jd).command(Xd).command(Qd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ef={command:`dlp`,describe:`Operations for dlp`,builder:e=>e.command(Wc).command(el).command(dl).command(gl).command(Dl).command(Yl).command(mu).command(Hu).command(Gu).command(Ju).command($u).command(Sd).command(Dd).command(Hd).command($d).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function tf(e){return e.option(`description`,{type:`string`,description:`The description field`,default:``}).option(`match-percent`,{type:`number`,description:`The match_percent field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new document fingerprint.`})}const nf={command:`fingerprints`,describe:`Creates a new document fingerprint for DLP scanning. Document fingerprints detect documents that are structurally similar to the uploaded sample.`,builder:tf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints create document fingerprints`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),match_percent:r[`match-percent`],name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.documentFingerprints.create.document.fingerprints({...e,account_id:u})),{successLabel:`Created`});return}if(r[`match-percent`]===void 0)throw Error(`--match-percent is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await m(`name`,`The name field`));let p=d({description:f(r.description,`description`,`text`),match_percent:r[`match-percent`],name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.documentFingerprints.create.document.fingerprints({...p,account_id:u})),{successLabel:`Created`})}},rf={command:`document`,describe:`Document Fingerprints operations`,builder:e=>e.command(nf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function af(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`match-percent`,{type:`number`,description:`The match_percent field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the document fingerprint to update.`})}const of={command:`v2 <document-fingerprint-id>`,describe:`Updates metadata for an existing document fingerprint, such as its name or description.`,builder:af,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints create v2`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints/${r[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(r[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(r[`document-fingerprint-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),match_percent:r[`match-percent`],name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.documentFingerprints.create.v2({...e,account_id:u,document_fingerprint_id:r[`document-fingerprint-id`]})),{successLabel:`Created`});return}let p=d({description:f(r.description,`description`,`text`),match_percent:r[`match-percent`],name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.documentFingerprints.create.v2({...p,account_id:u,document_fingerprint_id:r[`document-fingerprint-id`]})),{successLabel:`Created`})}},sf={command:`create`,describe:`Document Fingerprints operations`,builder:e=>e.command(of).command(rf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cf(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const lf={command:`delete <document-fingerprint-id>`,describe:`Removes a document fingerprint from DLP configuration. Documents matching this fingerprint will no longer be detected.`,builder:cf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints/${r[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(r[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(r[`document-fingerprint-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.documentFingerprints.delete({account_id:l,document_fingerprint_id:r[`document-fingerprint-id`]})),{successLabel:`Deleted`})}};function uf(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const df={command:`fingerprints <document-fingerprint-id>`,describe:`Gets a document fingerprint and its latest upload status.`,builder:uf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints get document fingerprints`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints/${r[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(r[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(r[`document-fingerprint-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.documentFingerprints.get.document.fingerprints({account_id:l,document_fingerprint_id:r[`document-fingerprint-id`]})),{successLabel:`Loaded`})}},ff={command:`document`,describe:`Document Fingerprints operations`,builder:e=>e.command(df).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const mf={command:`all`,describe:`Lists all document fingerprints configured for DLP scanning in the account.`,builder:pf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints get fingerprints all`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.documentFingerprints.get.fingerprints.all({account_id:l})),{successLabel:`Loaded`})}},hf={command:`fingerprints`,describe:`Document Fingerprints operations`,builder:e=>e.command(mf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},gf={command:`get`,describe:`Operations for document-fingerprints.get`,builder:e=>e.command(ff).command(hf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function _f(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`File used for document fingerprinting.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const vf={command:`update <document-fingerprint-id>`,describe:`Uploads a new document to create or update a fingerprint. The document structure is analyzed to enable detection of similar documents.`,builder:_f,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints/${r[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(r[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(r[`document-fingerprint-id`]??``)},bodyKind:`multipart`,body:{body:r.body,file:r.file}});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,r.file!==void 0||r.body!==void 0){let e=new FormData;if(r.file){let t=p(r.file);e.append(`file`,new Blob([t]),r.file.split(/[\\/]/).filter(Boolean).pop())}else r.body!==void 0&&e.append(`file`,r.body);o(await c(`Updating`,async()=>i(l,`PUT`,`/accounts/${u}/dlp/document_fingerprints/${encodeURIComponent(String(r[`document-fingerprint-id`]))}`,{body:e})),{successLabel:`Updated`});return}if(r.body){let e=f(r.body,`body`,`binary`);o(await c(`Updating`,async()=>i(l,`PUT`,`/accounts/${u}/dlp/document_fingerprints/${encodeURIComponent(String(r[`document-fingerprint-id`]))}`,{body:e,headers:{"Content-Type":`multipart/form-data`}})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},yf={command:`document-fingerprints`,describe:`Document Fingerprints operations`,builder:e=>e.command(lf).command(vf).command(sf).command(gf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xf={command:`list`,describe:`List all application and application type mappings.`,builder:bf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway app-types list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/app_types`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.appTypes.list({account_id:l})),{successLabel:`Loaded`})}},Sf={command:`app-types`,describe:`Operations for gateway.app-types`,builder:e=>e.command(xf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Cf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wf={command:`get`,describe:`Retrieve all Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.`,builder:Cf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway audit-ssh-settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/audit_ssh_settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.auditSshSettings.get({account_id:l})),{successLabel:`Loaded`})}};function Tf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ef={command:`rotate-seed`,describe:`Rotate the SSH account seed that generates the host key identity when connecting through the Cloudflare SSH Proxy.`,builder:Tf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway audit-ssh-settings rotate-seed`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/audit_ssh_settings/rotate_seed`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.gateway.auditSshSettings.rotateSeed({account_id:l})),{successLabel:`Created`})}};function Df(e){return e.option(`public-key`,{type:`string`,description:`Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Of={command:`update`,describe:`Update Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.`,builder:Df,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway audit-ssh-settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/audit_ssh_settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({public_key:f(r[`public-key`],`public-key`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.auditSshSettings.update({...e,account_id:u})),{successLabel:`Updated`});return}r[`public-key`]===void 0&&(r[`public-key`]=await m(`public-key`,`Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging.`));let p=d({public_key:f(r[`public-key`],`public-key`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.auditSshSettings.update({...p,account_id:u})),{successLabel:`Updated`})}},kf={command:`audit-ssh-settings`,describe:`Operations for gateway.audit-ssh-settings`,builder:e=>e.command(wf).command(Ef).command(Of).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Af(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const jf={command:`list`,describe:`List all categories.`,builder:Af,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway categories list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/categories`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.categories.list({account_id:l})),{successLabel:`Loaded`})}},Mf={command:`categories`,describe:`Operations for gateway.categories`,builder:e=>e.command(jf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Nf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pf={command:`activate <certificate-id>`,describe:`Bind a single Zero Trust certificate to the edge.`,builder:Nf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates activate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}/activate`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.gateway.certificates.activate({account_id:l,certificate_id:r[`certificate-id`]})),{successLabel:`Created`})}};function Ff(e){return e.option(`validity-period-days`,{type:`number`,description:"Sets the certificate validity period in days (range: 1-10,950 days / ~30 years). Defaults to 1,825 days (5 years). **Important**: This field is only settable during the certificate creation.  Certificates becomes immutable after creation - use the `/activate` and `/deactivate` endpoints to manage certificate lifecycle."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const If={command:`create`,describe:`Create a new Zero Trust certificate.`,builder:Ff,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({validity_period_days:r[`validity-period-days`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.certificates.create({...e,account_id:u})),{successLabel:`Created`});return}let f=d({validity_period_days:r[`validity-period-days`]});o(await c(`Creating`,async()=>i.zeroTrust.gateway.certificates.create({...f,account_id:u})),{successLabel:`Created`})}};function Lf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Rf={command:`deactivate <certificate-id>`,describe:`Unbind a single Zero Trust certificate from the edge.`,builder:Lf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates deactivate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}/deactivate`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.gateway.certificates.deactivate({account_id:l,certificate_id:r[`certificate-id`]})),{successLabel:`Created`})}};function zf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Bf={command:`delete <certificate-id>`,describe:`Delete a gateway-managed Zero Trust certificate. You must deactivate the certificate from the edge (inactive) before deleting it.`,builder:zf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.certificates.delete({account_id:l,certificate_id:r[`certificate-id`]})),{successLabel:`Deleted`})}};function Vf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Hf={command:`get <certificate-id>`,describe:`Get a single Zero Trust certificate.`,builder:Vf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.certificates.get({account_id:l,certificate_id:r[`certificate-id`]})),{successLabel:`Loaded`})}};function Uf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Wf={command:`list`,describe:`List all Zero Trust certificates for an account.`,builder:Uf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.certificates.list({account_id:l})),{successLabel:`Loaded`})}},Gf={command:`certificates`,describe:`Operations for gateway.certificates`,builder:e=>e.command(Pf).command(If).command(Rf).command(Bf).command(Hf).command(Wf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Kf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qf={command:`get`,describe:`Retrieve the current Zero Trust certificate configuration.`,builder:Kf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway configurations custom-certificate get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/configuration/custom_certificate`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.configurations.customCertificate.get({account_id:l})),{successLabel:`Loaded`})}},Jf={command:`custom-certificate`,describe:`Operations for gateway.configurations.custom-certificate`,builder:e=>e.command(qf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Yf(e){return e.option(`settings-activity-log-enabled`,{type:`boolean`,description:`Specify whether to log activity.`}).option(`settings-antivirus-enabled-download-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on downloads.`}).option(`settings-antivirus-enabled-upload-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on uploads.`}).option(`settings-antivirus-fail-closed`,{type:`boolean`,description:`Specify whether to block requests for unscannable files.`}).option(`settings-antivirus-notification-settings-enabled`,{type:`boolean`,description:`Specify whether to enable notifications.`}).option(`settings-antivirus-notification-settings-include-context`,{type:`boolean`,description:`Specify whether to include context information as query parameters.`}).option(`settings-antivirus-notification-settings-msg`,{type:`string`,description:`Specify the message to show in the notification.`}).option(`settings-antivirus-notification-settings-support-url`,{type:`string`,description:`Specify a URL that directs users to more information. If unset, the notification opens a block page.`}).option(`settings-block-page-background-color`,{type:`string`,description:"Specify the block page background color in `#rrggbb` format when the mode is customized_block_page."}).option(`settings-block-page-enabled`,{type:`boolean`,description:`Specify whether to enable the custom block page.`}).option(`settings-block-page-footer-text`,{type:`string`,description:`Specify the block page footer text when the mode is customized_block_page.`}).option(`settings-block-page-header-text`,{type:`string`,description:`Specify the block page header text when the mode is customized_block_page.`}).option(`settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to append context to target_uri as query parameters. This applies only when the mode is redirect_uri.`}).option(`settings-block-page-logo-path`,{type:`string`,description:`Specify the full URL to the logo file when the mode is customized_block_page.`}).option(`settings-block-page-mailto-address`,{type:`string`,description:`Specify the admin email for users to contact when the mode is customized_block_page.`}).option(`settings-block-page-mailto-subject`,{type:`string`,description:`Specify the subject line for emails created from the block page when the mode is customized_block_page.`}).option(`settings-block-page-mode`,{type:`string`,description:`Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.`,choices:[`customized_block_page`,`redirect_uri`]}).option(`settings-block-page-name`,{type:`string`,description:`Specify the block page title when the mode is customized_block_page.`}).option(`settings-block-page-suppress-footer`,{type:`boolean`,description:`Specify whether to suppress detailed information at the bottom of the block page when the mode is customized_block_page.`}).option(`settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to redirect users to when the mode is redirect_uri.`}).option(`settings-body-scanning-inspection-mode`,{type:`string`,description:"Specify the inspection mode as either `deep` or `shallow`.",choices:[`deep`,`shallow`]}).option(`settings-browser-isolation-non-identity-enabled`,{type:`boolean`,description:`Specify whether to enable non-identity onramp support for Browser Isolation.`}).option(`settings-browser-isolation-url-browser-isolation-enabled`,{type:`boolean`,description:`Specify whether to enable Clientless Browser Isolation.`}).option(`settings-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.`}).option(`settings-custom-certificate-enabled`,{type:`boolean`,description:`Specify whether to enable a custom certificate authority for signing Gateway traffic.`}).option(`settings-custom-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate (ID from MTLS certificate store).`}).option(`settings-extended-email-matching-enabled`,{type:`boolean`,description:`Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.`}).option(`settings-fips-tls`,{type:`boolean`,description:`Enforce cipher suites and TLS versions compliant with FIPS 140-2.`}).option(`settings-host-selector-enabled`,{type:`boolean`,description:`Specify whether to enable filtering via hosts for egress policies.`}).option(`settings-inspection-mode`,{type:`string`,description:`Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.`,choices:[`static`,`dynamic`]}).option(`settings-max-ttl-secs`,{type:`number`,description:"Account-level cap on DNS response TTLs, in seconds. Gateway rewrites DNS responses so returned record TTLs do not exceed this value. Null means no cap. Each DNS location can inherit, override, or disable it through the location `max_ttl` setting."}).option(`settings-protocol-detection-enabled`,{type:`boolean`,description:`Specify whether to detect protocols from the initial bytes of client traffic.`}).option(`settings-sandbox-enabled`,{type:`boolean`,description:`Specify whether to enable the sandbox.`}).option(`settings-sandbox-fallback-action`,{type:`string`,description:`Specify the action to take when the system cannot scan the file.`,choices:[`allow`,`block`]}).option(`settings-tls-decrypt-enabled`,{type:`boolean`,description:`Specify whether to inspect encrypted HTTP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Specify account settings.`}).check(e=>{if(`settings-activity-log-enabled.settings-antivirus-enabled-download-phase.settings-antivirus-enabled-upload-phase.settings-antivirus-fail-closed.settings-antivirus-notification-settings-enabled.settings-antivirus-notification-settings-include-context.settings-antivirus-notification-settings-msg.settings-antivirus-notification-settings-support-url.settings-block-page-background-color.settings-block-page-enabled.settings-block-page-footer-text.settings-block-page-header-text.settings-block-page-include-context.settings-block-page-logo-path.settings-block-page-mailto-address.settings-block-page-mailto-subject.settings-block-page-mode.settings-block-page-name.settings-block-page-suppress-footer.settings-block-page-target-uri.settings-body-scanning-inspection-mode.settings-browser-isolation-non-identity-enabled.settings-browser-isolation-url-browser-isolation-enabled.settings-certificate-id.settings-custom-certificate-enabled.settings-custom-certificate-id.settings-extended-email-matching-enabled.settings-fips-tls.settings-host-selector-enabled.settings-inspection-mode.settings-max-ttl-secs.settings-protocol-detection-enabled.settings-sandbox-enabled.settings-sandbox-fallback-action.settings-tls-decrypt-enabled`.split(`.`).some(t=>e[t]!==void 0)){let t=[`settings-certificate-id`,`settings-custom-certificate-enabled`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --settings-* flag is set`)}return!0})}const Xf={command:`edit`,describe:"Update (PATCH) a single subcollection of settings such as `antivirus`, `tls_decrypt`, `activity_log`, `block_page`, `browser_isolation`, `fips`, `body_scanning`, `certificate`, or `max_ttl_secs` without updating the entire configuration object. This endpoint returns an error if any settings collection lacks proper configuration.",builder:Yf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway configurations edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({settings:{activity_log:{enabled:r[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:r[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:r[`settings-antivirus-enabled-upload-phase`],fail_closed:r[`settings-antivirus-fail-closed`],notification_settings:{enabled:r[`settings-antivirus-notification-settings-enabled`],include_context:r[`settings-antivirus-notification-settings-include-context`],msg:f(r[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:f(r[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:f(r[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:r[`settings-block-page-enabled`],footer_text:f(r[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:f(r[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:r[`settings-block-page-include-context`],logo_path:f(r[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:f(r[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:f(r[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:f(r[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:f(r[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:r[`settings-block-page-suppress-footer`],target_uri:f(r[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:f(r[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:r[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:r[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:f(r[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:r[`settings-custom-certificate-enabled`],id:f(r[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:r[`settings-extended-email-matching-enabled`]},fips:{tls:r[`settings-fips-tls`]},host_selector:{enabled:r[`settings-host-selector-enabled`]},inspection:{mode:f(r[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:r[`settings-max-ttl-secs`],protocol_detection:{enabled:r[`settings-protocol-detection-enabled`]},sandbox:{enabled:r[`settings-sandbox-enabled`],fallback_action:f(r[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:r[`settings-tls-decrypt-enabled`]}}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.configurations.edit({body:e,account_id:u})),{successLabel:`Updated`});return}let p=d({settings:{activity_log:{enabled:r[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:r[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:r[`settings-antivirus-enabled-upload-phase`],fail_closed:r[`settings-antivirus-fail-closed`],notification_settings:{enabled:r[`settings-antivirus-notification-settings-enabled`],include_context:r[`settings-antivirus-notification-settings-include-context`],msg:f(r[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:f(r[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:f(r[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:r[`settings-block-page-enabled`],footer_text:f(r[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:f(r[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:r[`settings-block-page-include-context`],logo_path:f(r[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:f(r[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:f(r[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:f(r[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:f(r[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:r[`settings-block-page-suppress-footer`],target_uri:f(r[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:f(r[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:r[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:r[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:f(r[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:r[`settings-custom-certificate-enabled`],id:f(r[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:r[`settings-extended-email-matching-enabled`]},fips:{tls:r[`settings-fips-tls`]},host_selector:{enabled:r[`settings-host-selector-enabled`]},inspection:{mode:f(r[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:r[`settings-max-ttl-secs`],protocol_detection:{enabled:r[`settings-protocol-detection-enabled`]},sandbox:{enabled:r[`settings-sandbox-enabled`],fallback_action:f(r[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:r[`settings-tls-decrypt-enabled`]}}});o(await c(`Updating`,async()=>i.zeroTrust.gateway.configurations.edit({body:p,account_id:u})),{successLabel:`Updated`})}};function Zf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qf={command:`get`,describe:`Retrieve the current Zero Trust account configuration.`,builder:Zf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway configurations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.configurations.get({account_id:l})),{successLabel:`Loaded`})}};function $f(e){return e.option(`settings-activity-log-enabled`,{type:`boolean`,description:`Specify whether to log activity.`}).option(`settings-antivirus-enabled-download-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on downloads.`}).option(`settings-antivirus-enabled-upload-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on uploads.`}).option(`settings-antivirus-fail-closed`,{type:`boolean`,description:`Specify whether to block requests for unscannable files.`}).option(`settings-antivirus-notification-settings-enabled`,{type:`boolean`,description:`Specify whether to enable notifications.`}).option(`settings-antivirus-notification-settings-include-context`,{type:`boolean`,description:`Specify whether to include context information as query parameters.`}).option(`settings-antivirus-notification-settings-msg`,{type:`string`,description:`Specify the message to show in the notification.`}).option(`settings-antivirus-notification-settings-support-url`,{type:`string`,description:`Specify a URL that directs users to more information. If unset, the notification opens a block page.`}).option(`settings-block-page-background-color`,{type:`string`,description:"Specify the block page background color in `#rrggbb` format when the mode is customized_block_page."}).option(`settings-block-page-enabled`,{type:`boolean`,description:`Specify whether to enable the custom block page.`}).option(`settings-block-page-footer-text`,{type:`string`,description:`Specify the block page footer text when the mode is customized_block_page.`}).option(`settings-block-page-header-text`,{type:`string`,description:`Specify the block page header text when the mode is customized_block_page.`}).option(`settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to append context to target_uri as query parameters. This applies only when the mode is redirect_uri.`}).option(`settings-block-page-logo-path`,{type:`string`,description:`Specify the full URL to the logo file when the mode is customized_block_page.`}).option(`settings-block-page-mailto-address`,{type:`string`,description:`Specify the admin email for users to contact when the mode is customized_block_page.`}).option(`settings-block-page-mailto-subject`,{type:`string`,description:`Specify the subject line for emails created from the block page when the mode is customized_block_page.`}).option(`settings-block-page-mode`,{type:`string`,description:`Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.`,choices:[`customized_block_page`,`redirect_uri`]}).option(`settings-block-page-name`,{type:`string`,description:`Specify the block page title when the mode is customized_block_page.`}).option(`settings-block-page-suppress-footer`,{type:`boolean`,description:`Specify whether to suppress detailed information at the bottom of the block page when the mode is customized_block_page.`}).option(`settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to redirect users to when the mode is redirect_uri.`}).option(`settings-body-scanning-inspection-mode`,{type:`string`,description:"Specify the inspection mode as either `deep` or `shallow`.",choices:[`deep`,`shallow`]}).option(`settings-browser-isolation-non-identity-enabled`,{type:`boolean`,description:`Specify whether to enable non-identity onramp support for Browser Isolation.`}).option(`settings-browser-isolation-url-browser-isolation-enabled`,{type:`boolean`,description:`Specify whether to enable Clientless Browser Isolation.`}).option(`settings-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.`}).option(`settings-custom-certificate-enabled`,{type:`boolean`,description:`Specify whether to enable a custom certificate authority for signing Gateway traffic.`}).option(`settings-custom-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate (ID from MTLS certificate store).`}).option(`settings-extended-email-matching-enabled`,{type:`boolean`,description:`Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.`}).option(`settings-fips-tls`,{type:`boolean`,description:`Enforce cipher suites and TLS versions compliant with FIPS 140-2.`}).option(`settings-host-selector-enabled`,{type:`boolean`,description:`Specify whether to enable filtering via hosts for egress policies.`}).option(`settings-inspection-mode`,{type:`string`,description:`Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.`,choices:[`static`,`dynamic`]}).option(`settings-max-ttl-secs`,{type:`number`,description:"Account-level cap on DNS response TTLs, in seconds. Gateway rewrites DNS responses so returned record TTLs do not exceed this value. Null means no cap. Each DNS location can inherit, override, or disable it through the location `max_ttl` setting."}).option(`settings-protocol-detection-enabled`,{type:`boolean`,description:`Specify whether to detect protocols from the initial bytes of client traffic.`}).option(`settings-sandbox-enabled`,{type:`boolean`,description:`Specify whether to enable the sandbox.`}).option(`settings-sandbox-fallback-action`,{type:`string`,description:`Specify the action to take when the system cannot scan the file.`,choices:[`allow`,`block`]}).option(`settings-tls-decrypt-enabled`,{type:`boolean`,description:`Specify whether to inspect encrypted HTTP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Specify account settings.`}).check(e=>{if(`settings-activity-log-enabled.settings-antivirus-enabled-download-phase.settings-antivirus-enabled-upload-phase.settings-antivirus-fail-closed.settings-antivirus-notification-settings-enabled.settings-antivirus-notification-settings-include-context.settings-antivirus-notification-settings-msg.settings-antivirus-notification-settings-support-url.settings-block-page-background-color.settings-block-page-enabled.settings-block-page-footer-text.settings-block-page-header-text.settings-block-page-include-context.settings-block-page-logo-path.settings-block-page-mailto-address.settings-block-page-mailto-subject.settings-block-page-mode.settings-block-page-name.settings-block-page-suppress-footer.settings-block-page-target-uri.settings-body-scanning-inspection-mode.settings-browser-isolation-non-identity-enabled.settings-browser-isolation-url-browser-isolation-enabled.settings-certificate-id.settings-custom-certificate-enabled.settings-custom-certificate-id.settings-extended-email-matching-enabled.settings-fips-tls.settings-host-selector-enabled.settings-inspection-mode.settings-max-ttl-secs.settings-protocol-detection-enabled.settings-sandbox-enabled.settings-sandbox-fallback-action.settings-tls-decrypt-enabled`.split(`.`).some(t=>e[t]!==void 0)){let t=[`settings-certificate-id`,`settings-custom-certificate-enabled`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --settings-* flag is set`)}return!0})}const ep={command:`update`,describe:`Update the current Zero Trust account configuration.`,builder:$f,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway configurations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({settings:{activity_log:{enabled:r[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:r[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:r[`settings-antivirus-enabled-upload-phase`],fail_closed:r[`settings-antivirus-fail-closed`],notification_settings:{enabled:r[`settings-antivirus-notification-settings-enabled`],include_context:r[`settings-antivirus-notification-settings-include-context`],msg:f(r[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:f(r[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:f(r[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:r[`settings-block-page-enabled`],footer_text:f(r[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:f(r[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:r[`settings-block-page-include-context`],logo_path:f(r[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:f(r[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:f(r[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:f(r[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:f(r[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:r[`settings-block-page-suppress-footer`],target_uri:f(r[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:f(r[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:r[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:r[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:f(r[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:r[`settings-custom-certificate-enabled`],id:f(r[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:r[`settings-extended-email-matching-enabled`]},fips:{tls:r[`settings-fips-tls`]},host_selector:{enabled:r[`settings-host-selector-enabled`]},inspection:{mode:f(r[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:r[`settings-max-ttl-secs`],protocol_detection:{enabled:r[`settings-protocol-detection-enabled`]},sandbox:{enabled:r[`settings-sandbox-enabled`],fallback_action:f(r[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:r[`settings-tls-decrypt-enabled`]}}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.configurations.update({body:e,account_id:u})),{successLabel:`Updated`});return}let p=d({settings:{activity_log:{enabled:r[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:r[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:r[`settings-antivirus-enabled-upload-phase`],fail_closed:r[`settings-antivirus-fail-closed`],notification_settings:{enabled:r[`settings-antivirus-notification-settings-enabled`],include_context:r[`settings-antivirus-notification-settings-include-context`],msg:f(r[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:f(r[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:f(r[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:r[`settings-block-page-enabled`],footer_text:f(r[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:f(r[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:r[`settings-block-page-include-context`],logo_path:f(r[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:f(r[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:f(r[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:f(r[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:f(r[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:r[`settings-block-page-suppress-footer`],target_uri:f(r[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:f(r[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:r[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:r[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:f(r[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:r[`settings-custom-certificate-enabled`],id:f(r[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:r[`settings-extended-email-matching-enabled`]},fips:{tls:r[`settings-fips-tls`]},host_selector:{enabled:r[`settings-host-selector-enabled`]},inspection:{mode:f(r[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:r[`settings-max-ttl-secs`],protocol_detection:{enabled:r[`settings-protocol-detection-enabled`]},sandbox:{enabled:r[`settings-sandbox-enabled`],fallback_action:f(r[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:r[`settings-tls-decrypt-enabled`]}}});o(await c(`Updating`,async()=>i.zeroTrust.gateway.configurations.update({body:p,account_id:u})),{successLabel:`Updated`})}},tp={command:`configurations`,describe:`Operations for gateway.configurations`,builder:e=>e.command(Xf).command(Qf).command(ep).command(Jf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function np(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const rp={command:`create`,describe:`Create a Zero Trust account for an existing Cloudflare account.`,builder:np,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.gateway.create({account_id:l})),{successLabel:`Created`})}};function ip(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ap={command:`list`,describe:`List Zero Trust Gateway IPv4 address pairs for an account.`,builder:ip,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway dns-destination-ips list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/dns_destination_ips`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.dnsDestinationIps.list({account_id:l})),{successLabel:`Loaded`})}},op={command:`dns-destination-ips`,describe:`Operations for gateway.dns-destination-ips`,builder:e=>e.command(ap).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function sp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const cp={command:`list`,describe:`Retrieve the list of egress CIDRs allocated to this Zero Trust account.`,builder:sp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway egress-cidr-pairs list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/egress_cidr_pairs`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.egressCidrPairs.list({account_id:l})),{successLabel:`Loaded`})}},lp={command:`egress-cidr-pairs`,describe:`Operations for gateway.egress-cidr-pairs`,builder:e=>e.command(cp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function up(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dp={command:`list`,describe:`Retrieve information about the current Zero Trust account.`,builder:up,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.list({account_id:l})),{successLabel:`Loaded`})}};function fp(e){return e.option(`description`,{type:`string`,description:`Provide the list description.`}).option(`name`,{type:`string`,description:`Specify the list name.`}).option(`type`,{type:`string`,description:`Specify the list type.`,choices:[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pp={command:`create`,describe:`Creates a new Zero Trust list.`,builder:fp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.lists.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`Specify the list name.`)),r.type===void 0&&(r.type=await h(`type`,`Specify the list type.`,[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]));let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.gateway.lists.create({...p,account_id:u})),{successLabel:`Created`})}};function mp(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const hp={command:`delete <list-id>`,describe:`Deletes a Zero Trust list.`,builder:mp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/${r[`list-id`]==null?`<list-id>`:encodeURIComponent(String(r[`list-id`]))}`,pathParams:{"list-id":String(r[`list-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.lists.delete({account_id:l,list_id:r[`list-id`]})),{successLabel:`Deleted`})}};function gp(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`remove`,{type:`string`,array:!0,description:`Lists of item values you want to remove.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _p={command:`edit <list-id>`,describe:`Appends or removes an item from a configured Zero Trust list.`,builder:gp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/${r[`list-id`]==null?`<list-id>`:encodeURIComponent(String(r[`list-id`]))}`,pathParams:{"list-id":String(r[`list-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({remove:r.remove}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.lists.edit({...e,account_id:u,list_id:r[`list-id`]})),{successLabel:`Updated`});return}let f=d({remove:r.remove});o(await c(`Updating`,async()=>i.zeroTrust.gateway.lists.edit({...f,account_id:u,list_id:r[`list-id`]})),{successLabel:`Updated`})}};function vp(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yp={command:`get <list-id>`,describe:`Fetch a single Zero Trust list.`,builder:vp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/${r[`list-id`]==null?`<list-id>`:encodeURIComponent(String(r[`list-id`]))}`,pathParams:{"list-id":String(r[`list-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.lists.get({account_id:l,list_id:r[`list-id`]})),{successLabel:`Loaded`})}};function bp(e){return e.option(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xp={command:`list`,describe:`Fetch all items in a single Zero Trust list.`,builder:bp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists items list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/${r[`list-id`]==null?`<list-id>`:encodeURIComponent(String(r[`list-id`]))}/items`,pathParams:{"list-id":String(r[`list-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.lists.items.list({account_id:l,list_id:r[`list-id`]})),{successLabel:`Loaded`})}},Sp={command:`items`,describe:`Operations for gateway.lists.items`,builder:e=>e.command(xp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Cp(e){return e.option(`type`,{type:`string`,description:`Specify the list type.`,choices:[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]}).option(`filter`,{type:`string`,description:"Filter the returned lists by one or more `field:value` pairs.\nRepeat the parameter to apply multiple filters; they are combined with\nlogical AND (a list must satisfy every filter to be returned).\n\nSupported fields and their matching behaviour:\n  * `name` — case-insensitive substring match on the list name.\n  * `id` — substring match on the list ID (UUID), with or without dashes.\n  * `type` — exact match on the list type. Supersedes the legacy `type` query\n    parameter when both are supplied. Must be one of the valid type values.\n  * `item_count` — exact integer match on the number of items in the list.\n\nEach entry must match one of the per-field patterns below: the field must be\none of `name`, `id`, `type`, or `item_count`; `name`/`id` accept any value,\n`type` is restricted to the valid list type values, and `item_count` must be\na non-negative integer."}).option(`search`,{type:`string`,description:"Case-insensitive substring match on the list name or description. When\ncombined with `filter`, both must match (logical AND)."}).option(`order-by`,{type:`string`,description:"Field to sort the returned lists by. When omitted, results are ordered by\n`created_at` in ascending order (i.e. creation order) for backwards\ncompatibility. Supported values:\n  * `name` — sort alphabetically by list name.\n  * `created_at` — sort by creation time; defaults to descending unless `direction` is set.\n  * `updated_at` — sort by last-modified time; defaults to descending unless `direction` is set.\n  * `item_count` — sort by number of items in the list.",choices:[`name`,`created_at`,`updated_at`,`item_count`]}).option(`direction`,{type:`string`,description:"Sort direction. Applies to the field named in `order_by`; when `order_by`\nis omitted it applies to the default `created_at` ordering. When\n`direction` is omitted the default is field-specific: explicitly choosing\n`created_at` or `updated_at` defaults to descending (newest first); `name`\nand `item_count` default to ascending; and the default `created_at`\nordering used when `order_by` is omitted is ascending (for backwards\ncompatibility).\n  * `asc` — ascending.\n  * `desc` — descending.",choices:[`asc`,`desc`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wp={command:`list`,describe:`Fetch all Zero Trust lists for an account.`,builder:_(Cp),handler:async r=>{let i={type:r.type,filter:r.filter,search:r.search,order_by:r[`order-by`],direction:r.direction};if(r.dryRun){s({command:`cf zero-trust gateway lists list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.gateway.lists.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Tp(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`Provide the list description.`}).option(`name`,{type:`string`,description:`Specify the list name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ep={command:`update <list-id>`,describe:`Updates a configured Zero Trust list. Skips updating list items if not included in the payload. A non empty list items will overwrite the existing list.`,builder:Tp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/${r[`list-id`]==null?`<list-id>`:encodeURIComponent(String(r[`list-id`]))}`,pathParams:{"list-id":String(r[`list-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.lists.update({...e,account_id:u,list_id:r[`list-id`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await m(`name`,`Specify the list name.`));let p=d({description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.lists.update({...p,account_id:u,list_id:r[`list-id`]})),{successLabel:`Updated`})}};function Dp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Op={command:`upload`,describe:"Create a new Zero Trust list by uploading a CSV file. The file must be `text/csv` or `text/plain` and cannot exceed 2 MB. The operation is processed asynchronously. Use the returned operation ID to poll for status.",builder:Dp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists upload`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/upload`,pathParams:{},bodyKind:`multipart`,body:{body:r.body,file:r.file}});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,r.file!==void 0||r.body!==void 0){let e=new FormData;if(r.file){let t=p(r.file);e.append(`file`,new Blob([t]),r.file.split(/[\\/]/).filter(Boolean).pop())}else r.body!==void 0&&e.append(`file`,r.body);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/gateway/lists/upload`,{body:e})),{successLabel:`Created`});return}if(r.body){let e=f(r.body,`body`,`binary`);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/gateway/lists/upload`,{body:e,headers:{"Content-Type":`multipart/form-data`}})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},kp={command:`lists`,describe:`Operations for gateway.lists`,builder:e=>e.command(pp).command(hp).command(_p).command(yp).command(wp).command(Ep).command(Op).command(Sp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ap(e){return e.option(`client-default`,{type:`boolean`,description:`Indicate whether this location is the default location.`,default:!1}).option(`dns-destination-ips-id`,{type:`string`,description:`Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.`}).option(`ecs-support`,{type:`boolean`,description:`Indicate whether the location must resolve EDNS queries.`,default:!1}).option(`endpoints-doh-enabled`,{type:`boolean`,description:`Indicate whether the DOH endpoint is enabled for this location.`}).option(`endpoints-doh-require-token`,{type:`boolean`,description:`Specify whether the DOH endpoint requires user identity authentication.`}).option(`endpoints-dot-enabled`,{type:`boolean`,description:`Indicate whether the DOT endpoint is enabled for this location.`}).option(`endpoints-ipv4-enabled`,{type:`boolean`,description:`Indicate whether the IPv4 endpoint is enabled for this location.`}).option(`endpoints-ipv6-enabled`,{type:`boolean`,description:`Indicate whether the IPV6 endpoint is enabled for this location.`}).option(`max-ttl-mode`,{type:`string`,description:"`inherit` uses the account `max_ttl_secs`. `override` uses this location's `ttl_secs`. `disabled` leaves returned TTLs unchanged.",choices:[`inherit`,`override`,`disabled`]}).option(`max-ttl-ttl-secs`,{type:`number`,description:"Location-specific cap on DNS response TTLs, in seconds. Required when `mode` is `override`. Must be omitted when `mode` is `inherit` or `disabled`."}).option(`name`,{type:`string`,description:`Specify the location name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`max-ttl-mode`,`max-ttl-ttl-secs`].some(t=>e[t]!==void 0)){let t=[`max-ttl-mode`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --max_ttl-* flag is set`)}return!0})}const jp={command:`create`,describe:`Create a new Zero Trust Gateway location.`,builder:Ap,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway locations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/locations`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({client_default:r[`client-default`],dns_destination_ips_id:f(r[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:r[`ecs-support`],endpoints:{doh:{enabled:r[`endpoints-doh-enabled`],require_token:r[`endpoints-doh-require-token`]},dot:{enabled:r[`endpoints-dot-enabled`]},ipv4:{enabled:r[`endpoints-ipv4-enabled`]},ipv6:{enabled:r[`endpoints-ipv6-enabled`]}},max_ttl:{mode:f(r[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:r[`max-ttl-ttl-secs`]},name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.locations.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await m(`name`,`Specify the location name.`));let p=d({client_default:r[`client-default`],dns_destination_ips_id:f(r[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:r[`ecs-support`],endpoints:{doh:{enabled:r[`endpoints-doh-enabled`],require_token:r[`endpoints-doh-require-token`]},dot:{enabled:r[`endpoints-dot-enabled`]},ipv4:{enabled:r[`endpoints-ipv4-enabled`]},ipv6:{enabled:r[`endpoints-ipv6-enabled`]}},max_ttl:{mode:f(r[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:r[`max-ttl-ttl-secs`]},name:f(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.gateway.locations.create({...p,account_id:u})),{successLabel:`Created`})}};function Mp(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Np={command:`delete <location-id>`,describe:`Delete a configured Zero Trust Gateway location.`,builder:Mp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway locations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/locations/${r[`location-id`]==null?`<location-id>`:encodeURIComponent(String(r[`location-id`]))}`,pathParams:{"location-id":String(r[`location-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.locations.delete({account_id:l,location_id:r[`location-id`]})),{successLabel:`Deleted`})}};function Pp(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fp={command:`get <location-id>`,describe:`Get a single Zero Trust Gateway location.`,builder:Pp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway locations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/locations/${r[`location-id`]==null?`<location-id>`:encodeURIComponent(String(r[`location-id`]))}`,pathParams:{"location-id":String(r[`location-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.locations.get({account_id:l,location_id:r[`location-id`]})),{successLabel:`Loaded`})}};function Ip(e){return e.option(`filter`,{type:`string`,description:"Filter the returned locations by one or more `field:value` pairs.\nRepeat the parameter to apply multiple filters; they are combined with\nlogical AND (a location must satisfy every filter to be returned).\n\nSupported fields and their matching behaviour:\n  * `name` — case-insensitive substring match on the location name.\n  * `id` — substring match on the location ID (UUID), with or without dashes.\n  * `is_default` — whether it is the default for the account.\n\nEach entry must match one of the per-field patterns below:\n  * the field must be one of `name`, `id`, or `is_default`;\n  * `name`/`id` accept any value;\n  * `is_default` only accepts `true` or `false`; any other value returns `400`"}).option(`search`,{type:`string`,description:"Case-insensitive substring match on the location name. When combined\nwith `filter`, both must match (logical AND)."}).option(`order-by`,{type:`string`,description:"Field to sort the returned locations by. When omitted, the order of\nresults is unspecified. Supported values:\n  * `name` — sort alphabetically by location name.\n  * `created_at` — sort by creation time; defaults to descending unless `direction` is set.\n  * `updated_at` — sort by last-modified time; defaults to descending unless `direction` is set.",choices:[`name`,`created_at`,`updated_at`]}).option(`direction`,{type:`string`,description:"Sort direction. Only takes effect when `order_by` is also provided; it\nis ignored otherwise. When `direction` is omitted the effective\ndirection is field-specific: `created_at` and `updated_at` default to\ndescending (newest first); `name` defaults to ascending.\n  * `asc` — ascending.\n  * `desc` — descending.",choices:[`asc`,`desc`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Lp={command:`list`,describe:`List Zero Trust Gateway locations for an account.`,builder:_(Ip),handler:async r=>{let i={filter:r.filter,search:r.search,order_by:r[`order-by`],direction:r.direction};if(r.dryRun){s({command:`cf zero-trust gateway locations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/locations`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.gateway.locations.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Rp(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`client-default`,{type:`boolean`,description:`Indicate whether this location is the default location.`}).option(`dns-destination-ips-id`,{type:`string`,description:`Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.`}).option(`ecs-support`,{type:`boolean`,description:`Indicate whether the location must resolve EDNS queries.`}).option(`endpoints-doh-enabled`,{type:`boolean`,description:`Indicate whether the DOH endpoint is enabled for this location.`}).option(`endpoints-doh-require-token`,{type:`boolean`,description:`Specify whether the DOH endpoint requires user identity authentication.`}).option(`endpoints-dot-enabled`,{type:`boolean`,description:`Indicate whether the DOT endpoint is enabled for this location.`}).option(`endpoints-ipv4-enabled`,{type:`boolean`,description:`Indicate whether the IPv4 endpoint is enabled for this location.`}).option(`endpoints-ipv6-enabled`,{type:`boolean`,description:`Indicate whether the IPV6 endpoint is enabled for this location.`}).option(`max-ttl-mode`,{type:`string`,description:"`inherit` uses the account `max_ttl_secs`. `override` uses this location's `ttl_secs`. `disabled` leaves returned TTLs unchanged.",choices:[`inherit`,`override`,`disabled`]}).option(`max-ttl-ttl-secs`,{type:`number`,description:"Location-specific cap on DNS response TTLs, in seconds. Required when `mode` is `override`. Must be omitted when `mode` is `inherit` or `disabled`."}).option(`name`,{type:`string`,description:`Specify the location name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`max-ttl-mode`,`max-ttl-ttl-secs`].some(t=>e[t]!==void 0)){let t=[`max-ttl-mode`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --max_ttl-* flag is set`)}return!0})}const zp={command:`update <location-id>`,describe:`Update a configured Zero Trust Gateway location.`,builder:Rp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway locations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/locations/${r[`location-id`]==null?`<location-id>`:encodeURIComponent(String(r[`location-id`]))}`,pathParams:{"location-id":String(r[`location-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({client_default:r[`client-default`],dns_destination_ips_id:f(r[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:r[`ecs-support`],endpoints:{doh:{enabled:r[`endpoints-doh-enabled`],require_token:r[`endpoints-doh-require-token`]},dot:{enabled:r[`endpoints-dot-enabled`]},ipv4:{enabled:r[`endpoints-ipv4-enabled`]},ipv6:{enabled:r[`endpoints-ipv6-enabled`]}},max_ttl:{mode:f(r[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:r[`max-ttl-ttl-secs`]},name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.locations.update({...e,account_id:u,location_id:r[`location-id`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await m(`name`,`Specify the location name.`));let p=d({client_default:r[`client-default`],dns_destination_ips_id:f(r[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:r[`ecs-support`],endpoints:{doh:{enabled:r[`endpoints-doh-enabled`],require_token:r[`endpoints-doh-require-token`]},dot:{enabled:r[`endpoints-dot-enabled`]},ipv4:{enabled:r[`endpoints-ipv4-enabled`]},ipv6:{enabled:r[`endpoints-ipv6-enabled`]}},max_ttl:{mode:f(r[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:r[`max-ttl-ttl-secs`]},name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.locations.update({...p,account_id:u,location_id:r[`location-id`]})),{successLabel:`Updated`})}},Bp={command:`locations`,describe:`Operations for gateway.locations`,builder:e=>e.command(jp).command(Np).command(Fp).command(Lp).command(zp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Vp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Hp={command:`get`,describe:`Retrieve the current logging settings for the Zero Trust account.`,builder:Vp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway logging get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/logging`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.logging.get({account_id:l})),{successLabel:`Loaded`})}};function Up(e){return e.option(`redact-pii`,{type:`boolean`,description:`Indicate whether to redact personally identifiable information from activity logging (PII fields include source IP, user email, user ID, device ID, URL, referrer, and user agent).`}).option(`settings-by-rule-type-dns-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-dns-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`settings-by-rule-type-http-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-http-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`settings-by-rule-type-l4-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-l4-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wp={command:`update`,describe:`Update logging settings for the current Zero Trust account.`,builder:Up,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway logging update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/logging`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({redact_pii:r[`redact-pii`],settings_by_rule_type:{dns:{log_all:r[`settings-by-rule-type-dns-log-all`],log_blocks:r[`settings-by-rule-type-dns-log-blocks`]},http:{log_all:r[`settings-by-rule-type-http-log-all`],log_blocks:r[`settings-by-rule-type-http-log-blocks`]},l4:{log_all:r[`settings-by-rule-type-l4-log-all`],log_blocks:r[`settings-by-rule-type-l4-log-blocks`]}}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.logging.update({body:e,account_id:u})),{successLabel:`Updated`});return}let f=d({redact_pii:r[`redact-pii`],settings_by_rule_type:{dns:{log_all:r[`settings-by-rule-type-dns-log-all`],log_blocks:r[`settings-by-rule-type-dns-log-blocks`]},http:{log_all:r[`settings-by-rule-type-http-log-all`],log_blocks:r[`settings-by-rule-type-http-log-blocks`]},l4:{log_all:r[`settings-by-rule-type-l4-log-all`],log_blocks:r[`settings-by-rule-type-l4-log-blocks`]}}});o(await c(`Updating`,async()=>i.zeroTrust.gateway.logging.update({body:f,account_id:u})),{successLabel:`Updated`})}},Gp={command:`logging`,describe:`Operations for gateway.logging`,builder:e=>e.command(Hp).command(Wp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Kp(e){return e.positional(`operation-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qp={command:`get <operation-id>`,describe:`Fetch a single Zero Trust Gateway operation by its ID.`,builder:Kp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway operations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/operations/${r[`operation-id`]==null?`<operation-id>`:encodeURIComponent(String(r[`operation-id`]))}`,pathParams:{"operation-id":String(r[`operation-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.operations.get({account_id:l,operation_id:r[`operation-id`]})),{successLabel:`Loaded`})}};function Jp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yp={command:`list`,describe:`List all Zero Trust Gateway operations for an account.`,builder:Jp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway operations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/operations`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.operations.list({account_id:l})),{successLabel:`Loaded`})}},Xp={command:`operations`,describe:`Operations for gateway.operations`,builder:e=>e.command(qp).command(Yp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Zp(e){return e.option(`contents`,{type:`string`,description:`Actual contents of the PAC file`}).option(`description`,{type:`string`,description:`Detailed description of the PAC file.`}).option(`name`,{type:`string`,description:`Name of the PAC file.`}).option(`slug`,{type:`string`,description:`URL-friendly version of the PAC file name. If not provided, it will be auto-generated`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Qp={command:`create`,describe:`Create a new Zero Trust Gateway PAC file.`,builder:Zp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway pacfiles create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/pacfiles`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({contents:f(r.contents,`contents`,`text`),description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),slug:f(r.slug,`slug`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.pacfiles.create({...e,account_id:u})),{successLabel:`Created`});return}r.contents===void 0&&(r.contents=await m(`contents`,`Actual contents of the PAC file`)),r.name===void 0&&(r.name=await m(`name`,`Name of the PAC file.`));let p=d({contents:f(r.contents,`contents`,`text`),description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`),slug:f(r.slug,`slug`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.gateway.pacfiles.create({...p,account_id:u})),{successLabel:`Created`})}};function $p(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const em={command:`delete <pacfile-id>`,describe:`Delete a configured Zero Trust Gateway PAC file.`,builder:$p,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway pacfiles delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/pacfiles/${r[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(r[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(r[`pacfile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.pacfiles.delete({account_id:l,pacfile_id:r[`pacfile-id`]})),{successLabel:`Deleted`})}};function tm(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const nm={command:`get <pacfile-id>`,describe:`Get a single Zero Trust Gateway PAC file.`,builder:tm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway pacfiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/pacfiles/${r[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(r[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(r[`pacfile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.pacfiles.get({account_id:l,pacfile_id:r[`pacfile-id`]})),{successLabel:`Loaded`})}};function rm(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const im={command:`list`,describe:`List all Zero Trust Gateway PAC files for an account.`,builder:rm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway pacfiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/pacfiles`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.pacfiles.list({account_id:l})),{successLabel:`Loaded`})}};function am(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`contents`,{type:`string`,description:`Actual contents of the PAC file`}).option(`description`,{type:`string`,description:`Detailed description of the PAC file.`}).option(`name`,{type:`string`,description:`Name of the PAC file.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const om={command:`update <pacfile-id>`,describe:`Update a configured Zero Trust Gateway PAC file.`,builder:am,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway pacfiles update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/pacfiles/${r[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(r[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(r[`pacfile-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({contents:f(r.contents,`contents`,`text`),description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.pacfiles.update({...e,account_id:u,pacfile_id:r[`pacfile-id`]})),{successLabel:`Updated`});return}r.contents===void 0&&(r.contents=await m(`contents`,`Actual contents of the PAC file`)),r.description===void 0&&(r.description=await m(`description`,`Detailed description of the PAC file.`)),r.name===void 0&&(r.name=await m(`name`,`Name of the PAC file.`));let p=d({contents:f(r.contents,`contents`,`text`),description:f(r.description,`description`,`text`),name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.pacfiles.update({...p,account_id:u,pacfile_id:r[`pacfile-id`]})),{successLabel:`Updated`})}},sm={command:`pacfiles`,describe:`Operations for gateway.pacfiles`,builder:e=>e.command(Qp).command(em).command(nm).command(im).command(om).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cm(e){return e.option(`kind`,{type:`string`,description:`The proxy endpoint kind.`,choices:[`ip`,`identity`],default:`ip`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const lm={command:`create`,describe:`Create a new Zero Trust Gateway proxy endpoint.`,builder:cm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway proxy-endpoints create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/proxy_endpoints`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({kind:f(r.kind,`kind`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.proxyEndpoints.create({body:e,account_id:u})),{successLabel:`Created`});return}r.kind===`identity`&&r.kind===void 0&&(r.kind=await m(`kind`,`The proxy endpoint kind.`,{question:`Enter value for --kind`}));let p=d({kind:f(r.kind,`kind`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.gateway.proxyEndpoints.create({body:p,account_id:u})),{successLabel:`Created`})}};function um(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const dm={command:`delete <proxy-endpoint-id>`,describe:`Delete a configured Zero Trust Gateway proxy endpoint.`,builder:um,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway proxy-endpoints delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/proxy_endpoints/${r[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(r[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(r[`proxy-endpoint-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.proxyEndpoints.delete({account_id:l,proxy_endpoint_id:r[`proxy-endpoint-id`]})),{successLabel:`Deleted`})}};function fm(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`ips`,{type:`string`,array:!0,description:`Specify the list of CIDRs to restrict ingress connections.`}).option(`name`,{type:`string`,description:`Specify the name of the proxy endpoint.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pm={command:`edit <proxy-endpoint-id>`,describe:`Update a configured Zero Trust Gateway proxy endpoint.`,builder:fm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway proxy-endpoints edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/proxy_endpoints/${r[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(r[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(r[`proxy-endpoint-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({ips:r.ips,name:f(r.name,`name`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.proxyEndpoints.edit({...e,account_id:u,proxy_endpoint_id:r[`proxy-endpoint-id`]})),{successLabel:`Updated`});return}let p=d({ips:r.ips,name:f(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.proxyEndpoints.edit({...p,account_id:u,proxy_endpoint_id:r[`proxy-endpoint-id`]})),{successLabel:`Updated`})}};function mm(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const hm={command:`get <proxy-endpoint-id>`,describe:`Get a single Zero Trust Gateway proxy endpoint.`,builder:mm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway proxy-endpoints get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/proxy_endpoints/${r[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(r[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(r[`proxy-endpoint-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.proxyEndpoints.get({account_id:l,proxy_endpoint_id:r[`proxy-endpoint-id`]})),{successLabel:`Loaded`})}};function gm(e){return e.option(`filter`,{type:`string`,description:"Filter the returned proxy endpoints by one or more `field:value` pairs.\nRepeat the parameter to apply multiple filters; they are combined with\nlogical AND (an endpoint must satisfy every filter to be returned).\n\nSupported fields and their matching behaviour:\n  * `name` — case-insensitive substring match on the endpoint name.\n  * `id` — substring match on the endpoint ID (UUID), with or without dashes.\n  * `kind` — exact match on the endpoint kind. The value must be `ip` or `identity`; any other value returns `400`.\n\nEach entry must match one of the per-field patterns below: the field\nmust be one of `name`, `id`, or `kind`; `name`/`id` accept any value,\nwhile `kind` only accepts `ip` or `identity`."}).option(`search`,{type:`string`,description:"Case-insensitive substring match on the endpoint name. When combined\nwith `filter`, both must match (logical AND)."}).option(`order-by`,{type:`string`,description:"Field to sort the returned endpoints by. When omitted, the order of\nresults is unspecified. Supported values:\n  * `name` — sort alphabetically by endpoint name.\n  * `created_at` — sort by creation time; defaults to descending unless `direction` is set.\n  * `updated_at` — sort by last-modified time; defaults to descending unless `direction` is set.",choices:[`name`,`created_at`,`updated_at`]}).option(`direction`,{type:`string`,description:"Sort direction. Only takes effect when `order_by` is also provided; it\nis ignored otherwise. When `direction` is omitted the effective\ndirection is field-specific: `created_at` and `updated_at` default to\ndescending (newest first); `name` defaults to ascending.\n  * `asc` — ascending.\n  * `desc` — descending.",choices:[`asc`,`desc`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _m={command:`list`,describe:`List all Zero Trust Gateway proxy endpoints for an account.`,builder:_(gm),handler:async r=>{let i={filter:r.filter,search:r.search,order_by:r[`order-by`],direction:r.direction};if(r.dryRun){s({command:`cf zero-trust gateway proxy-endpoints list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/proxy_endpoints`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.gateway.proxyEndpoints.list({account_id:u,...i})),{successLabel:`Loaded`})}},vm={command:`proxy-endpoints`,describe:`Operations for gateway.proxy-endpoints`,builder:e=>e.command(lm).command(dm).command(pm).command(hm).command(_m).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ym(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const bm={command:`bulk-edit`,describe:`Update select fields of multiple Zero Trust Gateway rules in a single request. This is commonly used to reorder rules by updating their precedence values. Only the fields provided for each rule are updated.`,builder:ym,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules bulk-edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.rules.bulkEdit({body:e,account_id:u})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function xm(e){return e.option(`action`,{type:`string`,description:"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",choices:[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`]}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`device-posture`,{type:`string`,description:`Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`,default:!1}).option(`expiration-duration`,{type:`number`,description:"Defines the default duration a policy active in minutes. Must set in order to use the `reset_expiration` endpoint on this rule."}).option(`filters`,{type:`string`,array:!0,description:`Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.`}).option(`identity`,{type:`string`,description:`Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`rule-settings-allow-child-bypass`,{type:`boolean`,description:`Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.`}).option(`rule-settings-audit-ssh-command-logging`,{type:`boolean`,description:`Enable SSH command logging.`}).option(`rule-settings-biso-admin-controls-copy`,{type:`string`,description:`Configure copy behavior. If set to remote_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dcp`,{type:`boolean`,description:'Set to false to enable copy-pasting. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dd`,{type:`boolean`,description:'Set to false to enable downloading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dk`,{type:`boolean`,description:'Set to false to enable keyboard usage. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-download`,{type:`string`,description:`Configure download behavior. When set to remote_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dp`,{type:`boolean`,description:'Set to false to enable printing. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-du`,{type:`boolean`,description:'Set to false to enable uploading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-keyboard`,{type:`string`,description:`Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-paste`,{type:`string`,description:`Configure paste behavior. If set to remote_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-printing`,{type:`string`,description:`Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-upload`,{type:`string`,description:`Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-version`,{type:`string`,description:`Indicate which version of the browser isolation controls should apply.`,choices:[`v1`,`v2`]}).option(`rule-settings-biso-admin-controls-wm-id`,{type:`string`,description:`Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser.`}).option(`rule-settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-block-page-enabled`,{type:`boolean`,description:"Enable the custom block page. Settable only for `dns` rules with action `block`."}).option(`rule-settings-block-reason`,{type:`string`,description:"Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`."}).option(`rule-settings-bypass-parent-rule`,{type:`boolean`,description:`Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.`}).option(`rule-settings-check-session-duration`,{type:`string`,description:`Sets the required session freshness threshold. The API returns a normalized version of this value.`}).option(`rule-settings-check-session-enforce`,{type:`boolean`,description:`Enable session enforcement.`}).option(`rule-settings-delete-headers`,{type:`string`,array:!0,description:"Remove headers from allowed requests by name. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes. Settable only for `http` rules with the action set to `allow`."}).option(`rule-settings-egress-ipv4`,{type:`string`,description:`Specify the IPv4 address to use for egress.`}).option(`rule-settings-egress-ipv4-fallback`,{type:`string`,description:`Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.`}).option(`rule-settings-egress-ipv6`,{type:`string`,description:`Specify the IPv6 range to use for egress.`}).option(`rule-settings-forensic-copy-enabled`,{type:`boolean`,description:`Enable sending the copy to storage.`}).option(`rule-settings-ignore-cname-category-matches`,{type:`boolean`,description:"Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-insecure-disable-dnssec-validation`,{type:`boolean`,description:"Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules."}).option(`rule-settings-ip-categories`,{type:`boolean`,description:"Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-ip-indicator-feeds`,{type:`boolean`,description:"Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-l4override-ip`,{type:`string`,description:`Defines the IPv4 or IPv6 address.`}).option(`rule-settings-l4override-port`,{type:`number`,description:`Defines a port number to use for TCP/UDP overrides.`}).option(`rule-settings-notification-settings-enabled`,{type:`boolean`,description:`Enable notification.`}).option(`rule-settings-notification-settings-include-context`,{type:`boolean`,description:`Indicates whether to pass the context information as query parameters.`}).option(`rule-settings-notification-settings-msg`,{type:`string`,description:`Customize the message shown in the notification.`}).option(`rule-settings-notification-settings-support-url`,{type:`string`,description:`Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.`}).option(`rule-settings-override-host`,{type:`string`,description:"Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-override-ips`,{type:`string`,array:!0,description:"Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-payload-log-enabled`,{type:`boolean`,description:`Enable DLP payload logging for this rule.`}).option(`rule-settings-quarantine-file-types`,{type:`string`,array:!0,description:`Specify the types of files to sandbox.`}).option(`rule-settings-redirect-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-redirect-preserve-path-and-query`,{type:`boolean`,description:`Specify whether to append the path and query parameters from the original request to target_uri.`}).option(`rule-settings-redirect-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-resolve-dns-internally-fallback`,{type:`string`,description:`Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.`,choices:[`none`,`public_dns`]}).option(`rule-settings-resolve-dns-internally-view-id`,{type:`string`,description:`Specify the internal DNS view identifier to pass to the internal DNS service.`}).option(`rule-settings-resolve-dns-through-cloudflare`,{type:`boolean`,description:"Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dns_resolver` rules."}).option(`rule-settings-untrusted-cert-action`,{type:`string`,description:`Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.`,choices:[`pass_through`,`block`,`error`]}).option(`schedule-fri`,{type:`string`,description:`Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-mon`,{type:`string`,description:`Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sat`,{type:`string`,description:`Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sun`,{type:`string`,description:`Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-thu`,{type:`string`,description:`Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-time-zone`,{type:`string`,description:`Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.`}).option(`schedule-tue`,{type:`string`,description:`Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-wed`,{type:`string`,description:`Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`traffic`,{type:`string`,description:`Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if(`rule-settings-allow-child-bypass.rule-settings-audit-ssh-command-logging.rule-settings-biso-admin-controls-copy.rule-settings-biso-admin-controls-dcp.rule-settings-biso-admin-controls-dd.rule-settings-biso-admin-controls-dk.rule-settings-biso-admin-controls-download.rule-settings-biso-admin-controls-dp.rule-settings-biso-admin-controls-du.rule-settings-biso-admin-controls-keyboard.rule-settings-biso-admin-controls-paste.rule-settings-biso-admin-controls-printing.rule-settings-biso-admin-controls-upload.rule-settings-biso-admin-controls-version.rule-settings-biso-admin-controls-wm-id.rule-settings-block-page-include-context.rule-settings-block-page-target-uri.rule-settings-block-page-enabled.rule-settings-block-reason.rule-settings-bypass-parent-rule.rule-settings-check-session-duration.rule-settings-check-session-enforce.rule-settings-delete-headers.rule-settings-egress-ipv4.rule-settings-egress-ipv4-fallback.rule-settings-egress-ipv6.rule-settings-forensic-copy-enabled.rule-settings-ignore-cname-category-matches.rule-settings-insecure-disable-dnssec-validation.rule-settings-ip-categories.rule-settings-ip-indicator-feeds.rule-settings-l4override-ip.rule-settings-l4override-port.rule-settings-notification-settings-enabled.rule-settings-notification-settings-include-context.rule-settings-notification-settings-msg.rule-settings-notification-settings-support-url.rule-settings-override-host.rule-settings-override-ips.rule-settings-payload-log-enabled.rule-settings-quarantine-file-types.rule-settings-redirect-include-context.rule-settings-redirect-preserve-path-and-query.rule-settings-redirect-target-uri.rule-settings-resolve-dns-internally-fallback.rule-settings-resolve-dns-internally-view-id.rule-settings-resolve-dns-through-cloudflare.rule-settings-untrusted-cert-action`.split(`.`).some(t=>e[t]!==void 0)){let t=[`rule-settings-block-page-target-uri`,`rule-settings-redirect-target-uri`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --rule_settings-* flag is set`)}return!0})}const Sm={command:`create`,describe:`Create a new Zero Trust Gateway rule.`,builder:xm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({action:f(r.action,`action`,`text`),description:f(r.description,`description`,`text`),device_posture:f(r[`device-posture`],`device-posture`,`text`),enabled:r.enabled,expiration:{duration:r[`expiration-duration`]},filters:r.filters,identity:f(r.identity,`identity`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,rule_settings:{allow_child_bypass:r[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:r[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:f(r[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:r[`rule-settings-biso-admin-controls-dcp`],dd:r[`rule-settings-biso-admin-controls-dd`],dk:r[`rule-settings-biso-admin-controls-dk`],download:f(r[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:r[`rule-settings-biso-admin-controls-dp`],du:r[`rule-settings-biso-admin-controls-du`],keyboard:f(r[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:f(r[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:f(r[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:f(r[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:f(r[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:f(r[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:r[`rule-settings-block-page-include-context`],target_uri:f(r[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:r[`rule-settings-block-page-enabled`],block_reason:f(r[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:r[`rule-settings-bypass-parent-rule`],check_session:{duration:f(r[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:r[`rule-settings-check-session-enforce`]},delete_headers:r[`rule-settings-delete-headers`],egress:{ipv4:f(r[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:f(r[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:f(r[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:r[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:r[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:r[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:r[`rule-settings-ip-categories`],ip_indicator_feeds:r[`rule-settings-ip-indicator-feeds`],l4override:{ip:f(r[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:r[`rule-settings-l4override-port`]},notification_settings:{enabled:r[`rule-settings-notification-settings-enabled`],include_context:r[`rule-settings-notification-settings-include-context`],msg:f(r[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:f(r[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:f(r[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:r[`rule-settings-override-ips`],payload_log:{enabled:r[`rule-settings-payload-log-enabled`]},quarantine:{file_types:r[`rule-settings-quarantine-file-types`]},redirect:{include_context:r[`rule-settings-redirect-include-context`],preserve_path_and_query:r[`rule-settings-redirect-preserve-path-and-query`],target_uri:f(r[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:f(r[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:f(r[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:r[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:f(r[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:f(r[`schedule-fri`],`schedule-fri`,`text`),mon:f(r[`schedule-mon`],`schedule-mon`,`text`),sat:f(r[`schedule-sat`],`schedule-sat`,`text`),sun:f(r[`schedule-sun`],`schedule-sun`,`text`),thu:f(r[`schedule-thu`],`schedule-thu`,`text`),time_zone:f(r[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:f(r[`schedule-tue`],`schedule-tue`,`text`),wed:f(r[`schedule-wed`],`schedule-wed`,`text`)},traffic:f(r.traffic,`traffic`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.rules.create({...e,account_id:u})),{successLabel:`Created`});return}r.action===void 0&&(r.action=await h(`action`,"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`])),r.name===void 0&&(r.name=await m(`name`,`Specify the rule name.`));let p=d({action:f(r.action,`action`,`text`),description:f(r.description,`description`,`text`),device_posture:f(r[`device-posture`],`device-posture`,`text`),enabled:r.enabled,expiration:{duration:r[`expiration-duration`]},filters:r.filters,identity:f(r.identity,`identity`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,rule_settings:{allow_child_bypass:r[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:r[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:f(r[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:r[`rule-settings-biso-admin-controls-dcp`],dd:r[`rule-settings-biso-admin-controls-dd`],dk:r[`rule-settings-biso-admin-controls-dk`],download:f(r[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:r[`rule-settings-biso-admin-controls-dp`],du:r[`rule-settings-biso-admin-controls-du`],keyboard:f(r[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:f(r[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:f(r[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:f(r[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:f(r[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:f(r[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:r[`rule-settings-block-page-include-context`],target_uri:f(r[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:r[`rule-settings-block-page-enabled`],block_reason:f(r[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:r[`rule-settings-bypass-parent-rule`],check_session:{duration:f(r[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:r[`rule-settings-check-session-enforce`]},delete_headers:r[`rule-settings-delete-headers`],egress:{ipv4:f(r[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:f(r[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:f(r[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:r[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:r[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:r[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:r[`rule-settings-ip-categories`],ip_indicator_feeds:r[`rule-settings-ip-indicator-feeds`],l4override:{ip:f(r[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:r[`rule-settings-l4override-port`]},notification_settings:{enabled:r[`rule-settings-notification-settings-enabled`],include_context:r[`rule-settings-notification-settings-include-context`],msg:f(r[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:f(r[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:f(r[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:r[`rule-settings-override-ips`],payload_log:{enabled:r[`rule-settings-payload-log-enabled`]},quarantine:{file_types:r[`rule-settings-quarantine-file-types`]},redirect:{include_context:r[`rule-settings-redirect-include-context`],preserve_path_and_query:r[`rule-settings-redirect-preserve-path-and-query`],target_uri:f(r[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:f(r[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:f(r[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:r[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:f(r[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:f(r[`schedule-fri`],`schedule-fri`,`text`),mon:f(r[`schedule-mon`],`schedule-mon`,`text`),sat:f(r[`schedule-sat`],`schedule-sat`,`text`),sun:f(r[`schedule-sun`],`schedule-sun`,`text`),thu:f(r[`schedule-thu`],`schedule-thu`,`text`),time_zone:f(r[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:f(r[`schedule-tue`],`schedule-tue`,`text`),wed:f(r[`schedule-wed`],`schedule-wed`,`text`)},traffic:f(r.traffic,`traffic`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.gateway.rules.create({...p,account_id:u})),{successLabel:`Created`})}};function Cm(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const wm={command:`delete <rule-id>`,describe:`Delete a Zero Trust Gateway rule.`,builder:Cm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.rules.delete({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Deleted`})}};function Tm(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Em={command:`edit <rule-id>`,describe:"Update select fields of an existing Zero Trust Gateway rule. Only the fields provided in the request body are updated. This endpoint supports a limited subset of fields (`name`, `description`, `precedence`, `enabled`). To update other fields such as `action`, `traffic`, `identity`, `device_posture`, `rule_settings`, `schedule`, or `expiration`, use the PUT endpoint for a full rule replacement.",builder:Tm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),precedence:r.precedence}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.rules.edit({...e,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),enabled:r.enabled,name:f(r.name,`name`,`text`),precedence:r.precedence});o(await c(`Updating`,async()=>i.zeroTrust.gateway.rules.edit({...p,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}};function Dm(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Om={command:`get <rule-id>`,describe:`Get a single Zero Trust Gateway rule.`,builder:Dm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.rules.get({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Loaded`})}};function km(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Am={command:`list-tenant`,describe:`List Zero Trust Gateway rules for the parent account of an account in the MSP configuration.`,builder:km,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules list-tenant`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/tenant`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.rules.listTenant({account_id:l})),{successLabel:`Loaded`})}};function jm(e){return e.option(`filter`,{type:`string`,description:"Filter the returned rules by one or more `field:value` pairs. Repeat the\nparameter to combine filters with logical AND.\n\nSupported fields are `name`, `id`, `action`, `enabled`, `source_account`,\n`is_shared`, `filters`, and `expression` (max 1024 bytes). The `source_account`\nvalue is matched as a normalized UUID substring. The `filters` value must\nbe one of the rule filter names and matches a member of the rule's `filters`\narray. The `expression` filter performs a case-insensitive literal\nsubstring match across traffic, identity, and device posture expressions."}).option(`search`,{type:`string`,description:`Case-insensitive substring search across rule name and description.`}).option(`order-by`,{type:`string`,description:"Field to sort the returned rules by. Supported values are `name`,\n`created_at`, `updated_at`, and `precedence`.",choices:[`name`,`created_at`,`updated_at`,`precedence`]}).option(`direction`,{type:`string`,description:"Sort direction. When `order_by` is omitted, this controls the direction\nof the existing precedence ordering. Shared rules remain first in either\ndirection. Accepted values are `asc` and `desc`.",choices:[`asc`,`desc`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Mm={command:`list`,describe:`List Zero Trust Gateway rules for an account.`,builder:_(jm),handler:async r=>{let i={filter:r.filter,search:r.search,order_by:r[`order-by`],direction:r.direction};if(r.dryRun){s({command:`cf zero-trust gateway rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.gateway.rules.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Nm(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pm={command:`reset-expiration <rule-id>`,describe:"Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and it has a default duration. The Zero Trust Gateway Rule must have values for both `expiration.expires_at` and `expiration.duration`.",builder:Nm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules reset-expiration`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}/reset_expiration`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.gateway.rules.resetExpiration({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Created`})}};function Fm(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`action`,{type:`string`,description:"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",choices:[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`]}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`device-posture`,{type:`string`,description:`Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`}).option(`expiration-duration`,{type:`number`,description:"Defines the default duration a policy active in minutes. Must set in order to use the `reset_expiration` endpoint on this rule."}).option(`filters`,{type:`string`,array:!0,description:`Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.`}).option(`identity`,{type:`string`,description:`Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`rule-settings-allow-child-bypass`,{type:`boolean`,description:`Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.`}).option(`rule-settings-audit-ssh-command-logging`,{type:`boolean`,description:`Enable SSH command logging.`}).option(`rule-settings-biso-admin-controls-copy`,{type:`string`,description:`Configure copy behavior. If set to remote_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dcp`,{type:`boolean`,description:'Set to false to enable copy-pasting. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dd`,{type:`boolean`,description:'Set to false to enable downloading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dk`,{type:`boolean`,description:'Set to false to enable keyboard usage. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-download`,{type:`string`,description:`Configure download behavior. When set to remote_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dp`,{type:`boolean`,description:'Set to false to enable printing. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-du`,{type:`boolean`,description:'Set to false to enable uploading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-keyboard`,{type:`string`,description:`Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-paste`,{type:`string`,description:`Configure paste behavior. If set to remote_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-printing`,{type:`string`,description:`Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-upload`,{type:`string`,description:`Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-version`,{type:`string`,description:`Indicate which version of the browser isolation controls should apply.`,choices:[`v1`,`v2`]}).option(`rule-settings-biso-admin-controls-wm-id`,{type:`string`,description:`Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser.`}).option(`rule-settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-block-page-enabled`,{type:`boolean`,description:"Enable the custom block page. Settable only for `dns` rules with action `block`."}).option(`rule-settings-block-reason`,{type:`string`,description:"Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`."}).option(`rule-settings-bypass-parent-rule`,{type:`boolean`,description:`Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.`}).option(`rule-settings-check-session-duration`,{type:`string`,description:`Sets the required session freshness threshold. The API returns a normalized version of this value.`}).option(`rule-settings-check-session-enforce`,{type:`boolean`,description:`Enable session enforcement.`}).option(`rule-settings-delete-headers`,{type:`string`,array:!0,description:"Remove headers from allowed requests by name. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes. Settable only for `http` rules with the action set to `allow`."}).option(`rule-settings-egress-ipv4`,{type:`string`,description:`Specify the IPv4 address to use for egress.`}).option(`rule-settings-egress-ipv4-fallback`,{type:`string`,description:`Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.`}).option(`rule-settings-egress-ipv6`,{type:`string`,description:`Specify the IPv6 range to use for egress.`}).option(`rule-settings-forensic-copy-enabled`,{type:`boolean`,description:`Enable sending the copy to storage.`}).option(`rule-settings-ignore-cname-category-matches`,{type:`boolean`,description:"Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-insecure-disable-dnssec-validation`,{type:`boolean`,description:"Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules."}).option(`rule-settings-ip-categories`,{type:`boolean`,description:"Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-ip-indicator-feeds`,{type:`boolean`,description:"Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-l4override-ip`,{type:`string`,description:`Defines the IPv4 or IPv6 address.`}).option(`rule-settings-l4override-port`,{type:`number`,description:`Defines a port number to use for TCP/UDP overrides.`}).option(`rule-settings-notification-settings-enabled`,{type:`boolean`,description:`Enable notification.`}).option(`rule-settings-notification-settings-include-context`,{type:`boolean`,description:`Indicates whether to pass the context information as query parameters.`}).option(`rule-settings-notification-settings-msg`,{type:`string`,description:`Customize the message shown in the notification.`}).option(`rule-settings-notification-settings-support-url`,{type:`string`,description:`Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.`}).option(`rule-settings-override-host`,{type:`string`,description:"Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-override-ips`,{type:`string`,array:!0,description:"Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-payload-log-enabled`,{type:`boolean`,description:`Enable DLP payload logging for this rule.`}).option(`rule-settings-quarantine-file-types`,{type:`string`,array:!0,description:`Specify the types of files to sandbox.`}).option(`rule-settings-redirect-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-redirect-preserve-path-and-query`,{type:`boolean`,description:`Specify whether to append the path and query parameters from the original request to target_uri.`}).option(`rule-settings-redirect-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-resolve-dns-internally-fallback`,{type:`string`,description:`Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.`,choices:[`none`,`public_dns`]}).option(`rule-settings-resolve-dns-internally-view-id`,{type:`string`,description:`Specify the internal DNS view identifier to pass to the internal DNS service.`}).option(`rule-settings-resolve-dns-through-cloudflare`,{type:`boolean`,description:"Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dns_resolver` rules."}).option(`rule-settings-untrusted-cert-action`,{type:`string`,description:`Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.`,choices:[`pass_through`,`block`,`error`]}).option(`schedule-fri`,{type:`string`,description:`Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-mon`,{type:`string`,description:`Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sat`,{type:`string`,description:`Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sun`,{type:`string`,description:`Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-thu`,{type:`string`,description:`Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-time-zone`,{type:`string`,description:`Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.`}).option(`schedule-tue`,{type:`string`,description:`Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-wed`,{type:`string`,description:`Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`traffic`,{type:`string`,description:`Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if(`rule-settings-allow-child-bypass.rule-settings-audit-ssh-command-logging.rule-settings-biso-admin-controls-copy.rule-settings-biso-admin-controls-dcp.rule-settings-biso-admin-controls-dd.rule-settings-biso-admin-controls-dk.rule-settings-biso-admin-controls-download.rule-settings-biso-admin-controls-dp.rule-settings-biso-admin-controls-du.rule-settings-biso-admin-controls-keyboard.rule-settings-biso-admin-controls-paste.rule-settings-biso-admin-controls-printing.rule-settings-biso-admin-controls-upload.rule-settings-biso-admin-controls-version.rule-settings-biso-admin-controls-wm-id.rule-settings-block-page-include-context.rule-settings-block-page-target-uri.rule-settings-block-page-enabled.rule-settings-block-reason.rule-settings-bypass-parent-rule.rule-settings-check-session-duration.rule-settings-check-session-enforce.rule-settings-delete-headers.rule-settings-egress-ipv4.rule-settings-egress-ipv4-fallback.rule-settings-egress-ipv6.rule-settings-forensic-copy-enabled.rule-settings-ignore-cname-category-matches.rule-settings-insecure-disable-dnssec-validation.rule-settings-ip-categories.rule-settings-ip-indicator-feeds.rule-settings-l4override-ip.rule-settings-l4override-port.rule-settings-notification-settings-enabled.rule-settings-notification-settings-include-context.rule-settings-notification-settings-msg.rule-settings-notification-settings-support-url.rule-settings-override-host.rule-settings-override-ips.rule-settings-payload-log-enabled.rule-settings-quarantine-file-types.rule-settings-redirect-include-context.rule-settings-redirect-preserve-path-and-query.rule-settings-redirect-target-uri.rule-settings-resolve-dns-internally-fallback.rule-settings-resolve-dns-internally-view-id.rule-settings-resolve-dns-through-cloudflare.rule-settings-untrusted-cert-action`.split(`.`).some(t=>e[t]!==void 0)){let t=[`rule-settings-block-page-target-uri`,`rule-settings-redirect-target-uri`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --rule_settings-* flag is set`)}return!0})}const Im={command:`update <rule-id>`,describe:`Update a configured Zero Trust Gateway rule.`,builder:Fm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({action:f(r.action,`action`,`text`),description:f(r.description,`description`,`text`),device_posture:f(r[`device-posture`],`device-posture`,`text`),enabled:r.enabled,expiration:{duration:r[`expiration-duration`]},filters:r.filters,identity:f(r.identity,`identity`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,rule_settings:{allow_child_bypass:r[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:r[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:f(r[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:r[`rule-settings-biso-admin-controls-dcp`],dd:r[`rule-settings-biso-admin-controls-dd`],dk:r[`rule-settings-biso-admin-controls-dk`],download:f(r[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:r[`rule-settings-biso-admin-controls-dp`],du:r[`rule-settings-biso-admin-controls-du`],keyboard:f(r[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:f(r[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:f(r[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:f(r[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:f(r[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:f(r[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:r[`rule-settings-block-page-include-context`],target_uri:f(r[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:r[`rule-settings-block-page-enabled`],block_reason:f(r[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:r[`rule-settings-bypass-parent-rule`],check_session:{duration:f(r[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:r[`rule-settings-check-session-enforce`]},delete_headers:r[`rule-settings-delete-headers`],egress:{ipv4:f(r[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:f(r[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:f(r[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:r[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:r[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:r[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:r[`rule-settings-ip-categories`],ip_indicator_feeds:r[`rule-settings-ip-indicator-feeds`],l4override:{ip:f(r[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:r[`rule-settings-l4override-port`]},notification_settings:{enabled:r[`rule-settings-notification-settings-enabled`],include_context:r[`rule-settings-notification-settings-include-context`],msg:f(r[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:f(r[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:f(r[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:r[`rule-settings-override-ips`],payload_log:{enabled:r[`rule-settings-payload-log-enabled`]},quarantine:{file_types:r[`rule-settings-quarantine-file-types`]},redirect:{include_context:r[`rule-settings-redirect-include-context`],preserve_path_and_query:r[`rule-settings-redirect-preserve-path-and-query`],target_uri:f(r[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:f(r[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:f(r[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:r[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:f(r[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:f(r[`schedule-fri`],`schedule-fri`,`text`),mon:f(r[`schedule-mon`],`schedule-mon`,`text`),sat:f(r[`schedule-sat`],`schedule-sat`,`text`),sun:f(r[`schedule-sun`],`schedule-sun`,`text`),thu:f(r[`schedule-thu`],`schedule-thu`,`text`),time_zone:f(r[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:f(r[`schedule-tue`],`schedule-tue`,`text`),wed:f(r[`schedule-wed`],`schedule-wed`,`text`)},traffic:f(r.traffic,`traffic`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.rules.update({...e,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}r.action===void 0&&(r.action=await h(`action`,"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`])),r.name===void 0&&(r.name=await m(`name`,`Specify the rule name.`));let p=d({action:f(r.action,`action`,`text`),description:f(r.description,`description`,`text`),device_posture:f(r[`device-posture`],`device-posture`,`text`),enabled:r.enabled,expiration:{duration:r[`expiration-duration`]},filters:r.filters,identity:f(r.identity,`identity`,`text`),name:f(r.name,`name`,`text`),precedence:r.precedence,rule_settings:{allow_child_bypass:r[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:r[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:f(r[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:r[`rule-settings-biso-admin-controls-dcp`],dd:r[`rule-settings-biso-admin-controls-dd`],dk:r[`rule-settings-biso-admin-controls-dk`],download:f(r[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:r[`rule-settings-biso-admin-controls-dp`],du:r[`rule-settings-biso-admin-controls-du`],keyboard:f(r[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:f(r[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:f(r[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:f(r[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:f(r[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:f(r[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:r[`rule-settings-block-page-include-context`],target_uri:f(r[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:r[`rule-settings-block-page-enabled`],block_reason:f(r[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:r[`rule-settings-bypass-parent-rule`],check_session:{duration:f(r[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:r[`rule-settings-check-session-enforce`]},delete_headers:r[`rule-settings-delete-headers`],egress:{ipv4:f(r[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:f(r[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:f(r[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:r[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:r[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:r[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:r[`rule-settings-ip-categories`],ip_indicator_feeds:r[`rule-settings-ip-indicator-feeds`],l4override:{ip:f(r[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:r[`rule-settings-l4override-port`]},notification_settings:{enabled:r[`rule-settings-notification-settings-enabled`],include_context:r[`rule-settings-notification-settings-include-context`],msg:f(r[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:f(r[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:f(r[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:r[`rule-settings-override-ips`],payload_log:{enabled:r[`rule-settings-payload-log-enabled`]},quarantine:{file_types:r[`rule-settings-quarantine-file-types`]},redirect:{include_context:r[`rule-settings-redirect-include-context`],preserve_path_and_query:r[`rule-settings-redirect-preserve-path-and-query`],target_uri:f(r[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:f(r[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:f(r[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:r[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:f(r[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:f(r[`schedule-fri`],`schedule-fri`,`text`),mon:f(r[`schedule-mon`],`schedule-mon`,`text`),sat:f(r[`schedule-sat`],`schedule-sat`,`text`),sun:f(r[`schedule-sun`],`schedule-sun`,`text`),thu:f(r[`schedule-thu`],`schedule-thu`,`text`),time_zone:f(r[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:f(r[`schedule-tue`],`schedule-tue`,`text`),wed:f(r[`schedule-wed`],`schedule-wed`,`text`)},traffic:f(r.traffic,`traffic`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.rules.update({...p,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},Lm={command:`rules`,describe:`Operations for gateway.rules`,builder:e=>e.command(bm).command(Sm).command(wm).command(Em).command(Om).command(Mm).command(Am).command(Pm).command(Im).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Rm={command:`gateway`,describe:`Operations for gateway`,builder:e=>e.command(rp).command(dp).command(Sf).command(kf).command(Mf).command(Gf).command(tp).command(op).command(lp).command(kp).command(Bp).command(Gp).command(Xp).command(sm).command(vm).command(Lm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function zm(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Bm={command:`create`,describe:`Adds a new identity provider to Access.`,builder:zm,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust identity-providers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/identity_providers`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?void 0:l(i.body)});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=f:i.accountId=f,i.body){let e=l(i.body);o(await c(`Creating`,async()=>u.zeroTrust.identityProviders.create({body:e,account_or_zone:d,account_or_zone_id:f})),{successLabel:`Created`});return}if(i.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Vm(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Hm={command:`delete <identity-provider-id>`,describe:`Deletes an identity provider from Access.`,builder:Vm,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust identity-providers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/identity_providers/${i[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(i[`identity-provider-id`]))}`,pathParams:{"account-or-zone":String(t),"identity-provider-id":String(i[`identity-provider-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(u===`zones`?i.zoneId=d:i.accountId=d,!await g({force:!!i.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>l.zeroTrust.identityProviders.delete({account_or_zone:u,account_or_zone_id:d,identity_provider_id:i[`identity-provider-id`]})),{successLabel:`Deleted`})}};function Um(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Wm={command:`get <identity-provider-id>`,describe:`Fetches a configured identity provider.`,builder:Um,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust identity-providers get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/identity_providers/${i[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(i[`identity-provider-id`]))}`,pathParams:{"account-or-zone":String(t),"identity-provider-id":String(i[`identity-provider-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.identityProviders.get({account_or_zone:u,account_or_zone_id:d,identity_provider_id:i[`identity-provider-id`]})),{successLabel:`Loaded`})}};function Gm(e){return e.option(`scim-enabled`,{type:`string`,description:`Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Km={command:`list`,describe:`Lists all configured identity providers.`,builder:Gm,handler:async i=>{let l={scim_enabled:i[`scim-enabled`],page:i.page,per_page:i[`per-page`]};if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust identity-providers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/identity_providers`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},query:l,bodyKind:`none`});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();d===`zones`?i.zoneId=f:i.accountId=f,o(await c(`Loading`,async()=>u.zeroTrust.identityProviders.list({account_or_zone:d,account_or_zone_id:f,...l})),{successLabel:`Loaded`})}};function qm(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jm={command:`create <identity-provider-id>`,describe:"Creates a new SAML encryption certificate set and assigns it to the specified SAML Identity Provider. This endpoint is idempotent - if the IdP already has a certificate set assigned, the existing certificate set is returned with a 200 status. **Workflow for enabling SAML encryption:** 1. Call this endpoint to create and assign a certificate set to the IdP 2. Update the IdP configuration (PUT `/identity_providers/{id}`) with: - `config.enable_encryption: true` - `saml_certificate_set_id: <uid from step 1>` 3. Configure the certificate's public key in your external SAML Identity Provider",builder:qm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust identity-providers saml-certificate create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/identity_providers/${r[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(r[`identity-provider-id`]))}/saml_certificate`,pathParams:{"identity-provider-id":String(r[`identity-provider-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.identityProviders.samlCertificate.create({account_id:l,identity_provider_id:r[`identity-provider-id`]})),{successLabel:`Created`})}},Ym={command:`saml-certificate`,describe:`Operations for identity-providers.saml-certificate`,builder:e=>e.command(Jm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Xm(e){return e.option(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`cf-resource-id`,{type:`string`,description:'The unique Cloudflare-generated Id of the SCIM Group resource; also known as the "Id".\nPass once for a single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to look up multiple groups in one request,\nup to 50 values. Mutually exclusive with `idp_resource_id`, `name`,\n`search_contains`, and `search_starts_with`.'}).option(`idp-resource-id`,{type:`string`,description:'The IdP-generated Id of the SCIM Group resource; also known as the "external Id".\nPass once for a single lookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to look up multiple groups in one request,\nup to 50 values. Mutually exclusive with `cf_resource_id`, `name`,\n`search_contains`, and `search_starts_with`.'}).option(`name`,{type:`string`,description:`The display name of the SCIM Group resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zm={command:`list`,describe:`Lists SCIM Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:Xm,handler:async r=>{let i={cf_resource_id:r[`cf-resource-id`],idp_resource_id:r[`idp-resource-id`],name:r.name,page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust identity-providers scim groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/identity_providers/${r[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(r[`identity-provider-id`]))}/scim/groups`,pathParams:{"identity-provider-id":String(r[`identity-provider-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.identityProviders.scim.groups.list({account_id:u,identity_provider_id:r[`identity-provider-id`],...i})),{successLabel:`Loaded`})}},Qm={command:`groups`,describe:`Operations for identity-providers.scim.groups`,builder:e=>e.command(Zm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $m(e){return e.option(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`cf-resource-id`,{type:`string`,description:'The unique Cloudflare-generated Id of the SCIM User resource; also known as the "Id".\nPass once for a single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to look up multiple users in one request,\nup to 50 values. Mutually exclusive with `idp_resource_id`, `username`, `email`,\n`name`, `search_contains`, and `search_starts_with`.'}).option(`idp-resource-id`,{type:`string`,description:'The IdP-generated Id of the SCIM User resource; also known as the "external Id".\nPass once for a single lookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to look up multiple users in one request,\nup to 50 values. Mutually exclusive with `cf_resource_id`, `username`, `email`,\n`name`, `search_contains`, and `search_starts_with`.'}).option(`username`,{type:`string`,description:`The username of the SCIM User resource.`}).option(`email`,{type:`string`,description:`The email address of the SCIM User resource.`}).option(`name`,{type:`string`,description:`The name of the SCIM User resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const eh={command:`list`,describe:`Lists SCIM User resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:$m,handler:async r=>{let i={cf_resource_id:r[`cf-resource-id`],idp_resource_id:r[`idp-resource-id`],username:r.username,email:r.email,name:r.name,page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust identity-providers scim users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/identity_providers/${r[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(r[`identity-provider-id`]))}/scim/users`,pathParams:{"identity-provider-id":String(r[`identity-provider-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.identityProviders.scim.users.list({account_id:u,identity_provider_id:r[`identity-provider-id`],...i})),{successLabel:`Loaded`})}},th={command:`users`,describe:`Operations for identity-providers.scim.users`,builder:e=>e.command(eh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},nh={command:`scim`,describe:`Operations for identity-providers.scim`,builder:e=>e.command(Qm).command(th).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function rh(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ih={command:`update <identity-provider-id>`,describe:`Updates a configured identity provider.`,builder:rh,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust identity-providers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/identity_providers/${i[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(i[`identity-provider-id`]))}`,pathParams:{"account-or-zone":String(t),"identity-provider-id":String(i[`identity-provider-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?void 0:l(i.body)});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=f:i.accountId=f,i.body){let e=l(i.body);o(await c(`Updating`,async()=>u.zeroTrust.identityProviders.update({body:e,account_or_zone:d,account_or_zone_id:f,identity_provider_id:i[`identity-provider-id`]})),{successLabel:`Updated`});return}if(i.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},ah={command:`identity-providers`,describe:`Operations for identity-providers`,builder:e=>e.command(Bm).command(Hm).command(Wm).command(Km).command(ih).command(Ym).command(nh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function oh(e){return e.option(`allow-authenticate-via-warp`,{type:`boolean`,description:`When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.`,default:!1}).option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`auto-redirect-to-identity`,{type:`boolean`,description:"When set to `true`, users skip the identity provider selection step during login.",default:!1}).option(`deny-unmatched-requests`,{type:`boolean`,description:"Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names` array."}).option(`deny-unmatched-requests-exempted-zone-names`,{type:`string`,array:!0,description:"Contains zone names to exempt from the `deny_unmatched_requests` feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request."}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`,default:!1}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:"Lists the MFA methods that users can authenticate with. The `piv_key` and `ssh_fido2_key` values are supported only for infrastructure applications."}).option(`mfa-config-amr-matching-session-duration`,{type:`string`,description:`Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).`}).option(`mfa-config-required-aaguids`,{type:`string`,description:`Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`mfa-piv-key-requirements-pin-policy`,{type:`string`,description:"Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN required), `once` (PIN required once per session), `always` (PIN required for each use).",choices:[`never`,`once`,`always`]}).option(`mfa-piv-key-requirements-require-fips-device`,{type:`boolean`,description:`Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.`}).option(`mfa-piv-key-requirements-ssh-key-size`,{type:`string`,array:!0,description:`Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.`}).option(`mfa-piv-key-requirements-ssh-key-type`,{type:`string`,array:!0,description:"Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and `rsa`."}).option(`mfa-piv-key-requirements-touch-policy`,{type:`string`,description:"Defines when physical touch is required to use the SSH key. Valid values: `never` (no touch required), `always` (touch required for each use), `cached` (touch cached for 15 seconds).",choices:[`never`,`always`,`cached`]}).option(`mfa-required-for-all-apps`,{type:`boolean`,description:`Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: 'allowed_authenticators' cannot contain only the infrastructure SSH authenticators ('piv_key' and 'ssh_fido2_key') if the organization has any non-infrastructure applications.`,default:!1}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`warp-auth-non-browser-401`,{type:`boolean`,description:`When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page.`,default:!1}).option(`warp-auth-session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const sh={command:`create`,describe:`Sets up a Zero Trust organization for your account or zone.`,builder:oh,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust organizations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/organizations`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?d({allow_authenticate_via_warp:i[`allow-authenticate-via-warp`],auth_domain:f(i[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:i[`auto-redirect-to-identity`],deny_unmatched_requests:i[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:i[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:i[`is-ui-read-only`],login_design:{background_color:f(i[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(i[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(i[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(i[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(i[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:i[`mfa-config-allowed-authenticators`],amr_matching_session_duration:f(i[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:f(i[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:f(i[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:f(i[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:i[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:i[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:i[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:f(i[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:i[`mfa-required-for-all-apps`],name:f(i.name,`name`,`text`),session_duration:f(i[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:f(i[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(i[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_non_browser_401:i[`warp-auth-non-browser-401`],warp_auth_session_duration:f(i[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)}):l(i.body)});return}let u=await a(i),p=i.zone===void 0?`accounts`:`zones`,h=p===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();if(p===`zones`?i.zoneId=h:i.accountId=h,i.body){let e=l(i.body);o(await c(`Creating`,async()=>u.zeroTrust.organizations.create({...e,account_or_zone:p,account_or_zone_id:h})),{successLabel:`Created`});return}i[`auth-domain`]===void 0&&(i[`auth-domain`]=await m(`auth-domain`,`The unique subdomain assigned to your Zero Trust organization.`)),i.name===void 0&&(i.name=await m(`name`,`The name of your Zero Trust organization.`));let g=d({allow_authenticate_via_warp:i[`allow-authenticate-via-warp`],auth_domain:f(i[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:i[`auto-redirect-to-identity`],deny_unmatched_requests:i[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:i[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:i[`is-ui-read-only`],login_design:{background_color:f(i[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(i[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(i[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(i[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(i[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:i[`mfa-config-allowed-authenticators`],amr_matching_session_duration:f(i[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:f(i[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:f(i[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:f(i[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:i[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:i[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:i[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:f(i[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:i[`mfa-required-for-all-apps`],name:f(i.name,`name`,`text`),session_duration:f(i[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:f(i[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(i[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_non_browser_401:i[`warp-auth-non-browser-401`],warp_auth_session_duration:f(i[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)});o(await c(`Creating`,async()=>u.zeroTrust.organizations.create({...g,account_or_zone:p,account_or_zone_id:h})),{successLabel:`Created`})}};function ch(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lh={command:`get`,describe:`Returns the DoH settings for your Zero Trust organization.`,builder:ch,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust organizations doh get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/organizations/doh`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.organizations.doh.get({account_id:l})),{successLabel:`Loaded`})}};function uh(e){return e.option(`doh-jwt-duration`,{type:`string`,description:"The duration the DoH JWT is valid for. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.  Note that the maximum duration for this setting is the same as the key rotation period on the account. Default expiration is 24h"}).option(`service-token-id`,{type:`string`,description:`The uuid of the service token you want to use for DoH authentication`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const dh={command:`update`,describe:`Updates the DoH settings for your Zero Trust organization.`,builder:uh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust organizations doh update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/organizations/doh`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({doh_jwt_duration:f(r[`doh-jwt-duration`],`doh-jwt-duration`,`text`),service_token_id:f(r[`service-token-id`],`service-token-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.organizations.doh.update({...e,account_id:u})),{successLabel:`Updated`});return}let p=d({doh_jwt_duration:f(r[`doh-jwt-duration`],`doh-jwt-duration`,`text`),service_token_id:f(r[`service-token-id`],`service-token-id`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.organizations.doh.update({...p,account_id:u})),{successLabel:`Updated`})}},fh={command:`doh`,describe:`Operations for organizations.doh`,builder:e=>e.command(lh).command(dh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ph(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const mh={command:`list`,describe:`Returns the configuration for your Zero Trust organization.`,builder:ph,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust organizations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/organizations`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.organizations.list({account_or_zone:u,account_or_zone_id:d})),{successLabel:`Loaded`})}};function hh(e){return e.option(`devices`,{type:`boolean`,description:"When set to `true`, all devices associated with the user will be revoked."}).option(`email`,{type:`string`,description:`The email of the user to revoke.`}).option(`user-uid`,{type:`string`,description:`The uuid of the user to revoke.`}).option(`warp-session-reauth`,{type:`boolean`,description:"When set to `true`, the user will be required to re-authenticate to WARP for all Gateway policies that enforce a WARP client session duration. When `false`, the user’s WARP session will remain active"}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const gh={command:`revoke-users`,describe:`Revokes a user's access across all applications.`,builder:hh,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust organizations revoke-users`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/organizations/revoke_user`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?d({devices:i.devices,email:f(i.email,`email`,`text`),user_uid:f(i[`user-uid`],`user-uid`,`text`),warp_session_reauth:i[`warp-session-reauth`]}):l(i.body)});return}let u=await a(i),p=i.zone===void 0?`accounts`:`zones`,h=p===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();if(p===`zones`?i.zoneId=h:i.accountId=h,!await g({force:!!i.force,message:`This operation revokes all access tokens for a user destructively.`})){process.stderr.write(`Aborted.
-`);return}if(i.body){let e=l(i.body);o(await c(`Deleting`,async()=>u.zeroTrust.organizations.revokeUsers({...e,account_or_zone:p,account_or_zone_id:h})),{successLabel:`Deleted`});return}i.email===void 0&&(i.email=await m(`email`,`The email of the user to revoke.`));let _=d({devices:i.devices,email:f(i.email,`email`,`text`),user_uid:f(i[`user-uid`],`user-uid`,`text`),warp_session_reauth:i[`warp-session-reauth`]});o(await c(`Deleting`,async()=>u.zeroTrust.organizations.revokeUsers({..._,account_or_zone:p,account_or_zone_id:h})),{successLabel:`Deleted`})}};function _h(e){return e.option(`allow-authenticate-via-warp`,{type:`boolean`,description:`When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.`}).option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`auto-redirect-to-identity`,{type:`boolean`,description:"When set to `true`, users skip the identity provider selection step during login."}).option(`custom-pages-forbidden`,{type:`string`,description:`The uid of the custom page to use when a user is denied access after failing a non-identity rule.`}).option(`custom-pages-identity-denied`,{type:`string`,description:`The uid of the custom page to use when a user is denied access.`}).option(`deny-unmatched-requests`,{type:`boolean`,description:"Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names` array."}).option(`deny-unmatched-requests-exempted-zone-names`,{type:`string`,array:!0,description:"Contains zone names to exempt from the `deny_unmatched_requests` feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request."}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:"Lists the MFA methods that users can authenticate with. The `piv_key` and `ssh_fido2_key` values are supported only for infrastructure applications."}).option(`mfa-config-amr-matching-session-duration`,{type:`string`,description:`Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).`}).option(`mfa-config-required-aaguids`,{type:`string`,description:`Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`mfa-piv-key-requirements-pin-policy`,{type:`string`,description:"Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN required), `once` (PIN required once per session), `always` (PIN required for each use).",choices:[`never`,`once`,`always`]}).option(`mfa-piv-key-requirements-require-fips-device`,{type:`boolean`,description:`Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.`}).option(`mfa-piv-key-requirements-ssh-key-size`,{type:`string`,array:!0,description:`Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.`}).option(`mfa-piv-key-requirements-ssh-key-type`,{type:`string`,array:!0,description:"Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and `rsa`."}).option(`mfa-piv-key-requirements-touch-policy`,{type:`string`,description:"Defines when physical touch is required to use the SSH key. Valid values: `never` (no touch required), `always` (touch required for each use), `cached` (touch cached for 15 seconds).",choices:[`never`,`always`,`cached`]}).option(`mfa-required-for-all-apps`,{type:`boolean`,description:`Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: 'allowed_authenticators' cannot contain only the infrastructure SSH authenticators ('piv_key' and 'ssh_fido2_key') if the organization has any non-infrastructure applications.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`warp-auth-non-browser-401`,{type:`boolean`,description:`When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page.`}).option(`warp-auth-session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const vh={command:`update`,describe:`Updates the configuration for your Zero Trust organization.`,builder:_h,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust organizations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/organizations`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?d({allow_authenticate_via_warp:i[`allow-authenticate-via-warp`],auth_domain:f(i[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:i[`auto-redirect-to-identity`],custom_pages:{forbidden:f(i[`custom-pages-forbidden`],`custom-pages-forbidden`,`text`),identity_denied:f(i[`custom-pages-identity-denied`],`custom-pages-identity-denied`,`text`)},deny_unmatched_requests:i[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:i[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:i[`is-ui-read-only`],login_design:{background_color:f(i[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(i[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(i[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(i[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(i[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:i[`mfa-config-allowed-authenticators`],amr_matching_session_duration:f(i[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:f(i[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:f(i[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:f(i[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:i[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:i[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:i[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:f(i[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:i[`mfa-required-for-all-apps`],name:f(i.name,`name`,`text`),session_duration:f(i[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:f(i[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(i[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_non_browser_401:i[`warp-auth-non-browser-401`],warp_auth_session_duration:f(i[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)}):l(i.body)});return}let u=await a(i),p=i.zone===void 0?`accounts`:`zones`,m=p===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();if(p===`zones`?i.zoneId=m:i.accountId=m,i.body){let e=l(i.body);o(await c(`Updating`,async()=>u.zeroTrust.organizations.update({...e,account_or_zone:p,account_or_zone_id:m})),{successLabel:`Updated`});return}let h=d({allow_authenticate_via_warp:i[`allow-authenticate-via-warp`],auth_domain:f(i[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:i[`auto-redirect-to-identity`],custom_pages:{forbidden:f(i[`custom-pages-forbidden`],`custom-pages-forbidden`,`text`),identity_denied:f(i[`custom-pages-identity-denied`],`custom-pages-identity-denied`,`text`)},deny_unmatched_requests:i[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:i[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:i[`is-ui-read-only`],login_design:{background_color:f(i[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(i[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(i[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(i[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(i[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:i[`mfa-config-allowed-authenticators`],amr_matching_session_duration:f(i[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:f(i[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:f(i[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:f(i[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:i[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:i[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:i[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:f(i[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:i[`mfa-required-for-all-apps`],name:f(i.name,`name`,`text`),session_duration:f(i[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:f(i[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(i[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_non_browser_401:i[`warp-auth-non-browser-401`],warp_auth_session_duration:f(i[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)});o(await c(`Updating`,async()=>u.zeroTrust.organizations.update({...h,account_or_zone:p,account_or_zone_id:m})),{successLabel:`Updated`})}},yh={command:`organizations`,describe:`Operations for organizations`,builder:e=>e.command(sh).command(mh).command(gh).command(vh).command(fh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xh={command:`list`,describe:`Lists all DLP custom profiles in an account.`,builder:bh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust profiles custom list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/custom`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.profiles.custom.list({account_id:l})),{successLabel:`Loaded`})}},Sh={command:`custom`,describe:`Profiles operations`,builder:e=>e.command(xh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ch(e){return e.option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Predefined profiles can not be created. This endpoint will only update an existing predefined profiles settings.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const wh={command:`create`,describe:`Creates a DLP predefined profile. Only supports enabling/disabling entries.`,builder:Ch,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust profiles predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},ocr_enabled:r[`ocr-enabled`],profile_id:f(r[`profile-id`],`profile-id`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.profiles.predefined.create({...e,account_id:u})),{successLabel:`Created`});return}r[`profile-id`]===void 0&&(r[`profile-id`]=await m(`profile-id`,`The profile_id field`));let p=d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},ocr_enabled:r[`ocr-enabled`],profile_id:f(r[`profile-id`],`profile-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.profiles.predefined.create({...p,account_id:u})),{successLabel:`Created`})}};function Th(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Eh={command:`get <profile-id>`,describe:`Fetches a predefined DLP profile by id.`,builder:Th,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust profiles predefined get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.profiles.predefined.get({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Loaded`})}};function Dh(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the predefined profile.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const Oh={command:`update <profile-id>`,describe:`Updates a DLP predefined profile. Only supports enabling/disabling entries.`,builder:Dh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust profiles predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},ocr_enabled:r[`ocr-enabled`]}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.profiles.predefined.update({...e,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`});return}let p=d({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:f(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},ocr_enabled:r[`ocr-enabled`]});o(await c(`Updating`,async()=>i.zeroTrust.profiles.predefined.update({...p,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`})}},kh={command:`predefined`,describe:`Profiles operations`,builder:e=>e.command(wh).command(Eh).command(Oh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ah={command:`profiles`,describe:`Operations for profiles`,builder:e=>e.command(Sh).command(kh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function jh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Mh={command:`get`,describe:`Retrieves configured risk score behaviors that define how user actions affect their overall risk score.`,builder:jh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring behaviours get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/behaviors`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.behaviours.get({account_id:l})),{successLabel:`Loaded`})}};function Nh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Behaviors.`})}const Ph={command:`update`,describe:`Updates risk score behavior configurations, defining weights and thresholds for risk calculation.`,builder:Nh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring behaviours update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/behaviors`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.riskScoring.behaviours.update({body:e,account_id:u})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Fh={command:`behaviours`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(Mh).command(Ph).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ih(e){return e.positional(`user-id`,{type:`string`,description:`User ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Lh={command:`get <user-id>`,describe:`Retrieves the detailed risk score breakdown for a specific user, including contributing factors.`,builder:Ih,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.get({account_id:l,user_id:r[`user-id`]})),{successLabel:`Loaded`})}};function Rh(e){return e.option(`integration-type`,{type:`string`,description:`The integration_type field`,choices:[`Okta`]}).option(`reference-id`,{type:`string`,description:`A reference id that can be supplied by the client. Currently this should be set to the Access-Okta IDP ID (a UUIDv4).
-https://developers.cloudflare.com/api/operations/access-identity-providers-get-an-access-identity-provider`}).option(`tenant-url`,{type:`string`,description:`The base url of the tenant, e.g. "https://tenant.okta.com".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const zh={command:`create`,describe:`Creates a new Zero Trust risk score integration, connecting external risk signals to Cloudflare's risk scoring system.`,builder:Rh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({integration_type:f(r[`integration-type`],`integration-type`,`text`),reference_id:f(r[`reference-id`],`reference-id`,`text`),tenant_url:f(r[`tenant-url`],`tenant-url`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Creating`,async()=>i.zeroTrust.riskScoring.integrations.create({...e,account_id:u})),{successLabel:`Created`});return}r[`integration-type`]===void 0&&(r[`integration-type`]=await h(`integration-type`,`The integration_type field`,[`Okta`])),r[`tenant-url`]===void 0&&(r[`tenant-url`]=await m(`tenant-url`,`The base url of the tenant, e.g. "https://tenant.okta.com".`));let p=d({integration_type:f(r[`integration-type`],`integration-type`,`text`),reference_id:f(r[`reference-id`],`reference-id`,`text`),tenant_url:f(r[`tenant-url`],`tenant-url`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.riskScoring.integrations.create({...p,account_id:u})),{successLabel:`Created`})}};function Bh(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Vh={command:`delete <integration-id>`,describe:`Removes a Zero Trust risk score integration, disconnecting the external risk signal source.`,builder:Bh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.riskScoring.integrations.delete({account_id:l,integration_id:r[`integration-id`]})),{successLabel:`Deleted`})}};function Hh(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Uh={command:`get <integration-id>`,describe:`Gets a Zero Trust risk score integration by ID.`,builder:Hh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.integrations.get({account_id:l,integration_id:r[`integration-id`]})),{successLabel:`Loaded`})}};function Wh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gh={command:`list`,describe:`Lists all configured Zero Trust risk score integrations for the account.`,builder:Wh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.integrations.list({account_id:l})),{successLabel:`Loaded`})}};function Kh(e){return e.positional(`reference-id`,{type:`string`,description:`Reference ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qh={command:`get <reference-id>`,describe:`Retrieves a Zero Trust risk score integration using its external reference ID.`,builder:Kh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations references get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations/reference_id/${r[`reference-id`]==null?`<reference-id>`:encodeURIComponent(String(r[`reference-id`]))}`,pathParams:{"reference-id":String(r[`reference-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.integrations.references.get({account_id:l,reference_id:r[`reference-id`]})),{successLabel:`Loaded`})}},Jh={command:`references`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(qh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Yh(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`active`,{type:`boolean`,description:`Whether this integration is enabled. If disabled, no risk changes will be exported to the third-party.`}).option(`reference-id`,{type:`string`,description:`A reference id that can be supplied by the client. Currently this should be set to the Access-Okta IDP ID (a UUIDv4).
-https://developers.cloudflare.com/api/operations/access-identity-providers-get-an-access-identity-provider`}).option(`tenant-url`,{type:`string`,description:`The base url of the tenant, e.g. "https://tenant.okta.com".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Xh={command:`update <integration-id>`,describe:`Overwrite the reference_id, tenant_url, and active values with the ones provided.`,builder:Yh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({active:r.active,reference_id:f(r[`reference-id`],`reference-id`,`text`),tenant_url:f(r[`tenant-url`],`tenant-url`,`text`)}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.riskScoring.integrations.update({...e,account_id:u,integration_id:r[`integration-id`]})),{successLabel:`Updated`});return}if(r.active===void 0)throw Error(`--active is required (or pass --body with this field set).`);r[`tenant-url`]===void 0&&(r[`tenant-url`]=await m(`tenant-url`,`The base url of the tenant, e.g. "https://tenant.okta.com".`));let p=d({active:r.active,reference_id:f(r[`reference-id`],`reference-id`,`text`),tenant_url:f(r[`tenant-url`],`tenant-url`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.riskScoring.integrations.update({...p,account_id:u,integration_id:r[`integration-id`]})),{successLabel:`Updated`})}},Zh={command:`integrations`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(zh).command(Vh).command(Uh).command(Gh).command(Xh).command(Jh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qh(e){return e.positional(`user-id`,{type:`string`,description:`User ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const $h={command:`reset <user-id>`,describe:`Resets risk scores for specified users, clearing their accumulated risk history.`,builder:Qh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring reset`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/reset`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force,message:`This operation wipes risk-scoring history.`})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.riskScoring.reset({account_id:l,user_id:r[`user-id`]})),{successLabel:`Deleted`})}};function eg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const tg={command:`get`,describe:`Gets an aggregate summary of risk scores across the account, including distribution and trends.`,builder:eg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring summary get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/summary`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.summary.get({account_id:l})),{successLabel:`Loaded`})}},ng={command:`summary`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(tg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},rg={command:`risk-scoring`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(Lh).command($h).command(Fh).command(Zh).command(ng).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ig(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ag={command:`edit`,describe:"Removes a user from a Zero Trust seat when both `access_seat` and `gateway_seat` are set to false.",builder:ig,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust seats edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/seats`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.seats.edit({body:e,account_id:u})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},og={command:`seats`,describe:`Operations for seats`,builder:e=>e.command(ag).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function sg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const cg={command:`delete`,describe:`Deletes account-level DLP settings and returns the initial values.`,builder:sg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust settings delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.settings.delete({account_id:l})),{successLabel:`Deleted`})}};function lg(e){return e.option(`ai-context-analysis`,{type:`boolean`,description:`Whether AI context analysis is enabled at the account level.`}).option(`ocr`,{type:`boolean`,description:`Whether OCR is enabled at the account level.`}).option(`payload-logging-masking-level`,{type:`string`,description:"Masking level for payload logs.\n\n- `full`: The entire payload is masked.\n- `partial`: Only partial payload content is masked.\n- `clear`: No masking is applied to the payload content.\n- `default`: DLP uses its default masking behavior.",choices:[`full`,`partial`,`clear`,`default`]}).option(`payload-logging-public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
+- If the field is missing, the existing setting will be cleared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`New payload log settings.`})}const $u={command:`update`,describe:`Enables or disables payload logging for DLP matches. When enabled, matched content is stored for review.`,builder:Qu,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp payload-logs update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/payload_log`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({masking_level:p(r[`masking-level`],`masking-level`,`text`),public_key:p(r[`public-key`],`public-key`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.payloadLogs.update({...e,account_id:l})),{successLabel:`Updated`});return}let d=f({masking_level:p(r[`masking-level`],`masking-level`,`text`),public_key:p(r[`public-key`],`public-key`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.payloadLogs.update({...d,account_id:l})),{successLabel:`Updated`})}},ed={command:`payload-logs`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Zu).command($u).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function td(e){return e.option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`Related DLP policies will trigger when the match count exceeds the number set.`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`data-classes`,{type:`string`,array:!0,description:`Data class IDs to associate with the profile.`}).option(`data-tags`,{type:`string`,array:!0,description:`Data tag IDs to associate with the profile.`}).option(`description`,{type:`string`,description:`The description of the profile.`}).option(`entries`,{type:`string`,description:`The entries field. Provide as a JSON array of objects or @path/to/file.json.`}).option(`name`,{type:`string`,description:`The name field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`sensitivity-levels`,{type:`string`,description:`Sensitivity levels to associate with the profile. Provide as a JSON array of objects or @path/to/file.json.`}).option(`shared-entries`,{type:`string`,description:`Entries from other profiles (e.g. pre-defined Cloudflare profiles, or your Microsoft Information Protection profiles). Provide as a JSON array of objects or @path/to/file.json.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new profile to create.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const nd={command:`create`,describe:`Creates a DLP custom profile.`,builder:td,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/custom`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:p(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},data_classes:r[`data-classes`],data_tags:r[`data-tags`],description:p(r.description,`description`,`text`),entries:d(r.entries,`entries`),name:p(r.name,`name`,`text`),ocr_enabled:r[`ocr-enabled`],sensitivity_levels:d(r[`sensitivity-levels`],`sensitivity-levels`),shared_entries:d(r[`shared-entries`],`shared-entries`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.profiles.custom.create({...e,account_id:l})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await h(`name`,`The name field`));let m=f({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:p(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},data_classes:r[`data-classes`],data_tags:r[`data-tags`],description:p(r.description,`description`,`text`),entries:d(r.entries,`entries`),name:p(r.name,`name`,`text`),ocr_enabled:r[`ocr-enabled`],sensitivity_levels:d(r[`sensitivity-levels`],`sensitivity-levels`),shared_entries:d(r[`shared-entries`],`shared-entries`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.profiles.custom.create({...m,account_id:l})),{successLabel:`Created`})}};function rd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const id={command:`delete <profile-id>`,describe:`Deletes a DLP custom profile.`,builder:rd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/custom/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.profiles.custom.delete({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Deleted`})}};function ad(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const od={command:`get <profile-id>`,describe:`Fetches a custom DLP profile by id.`,builder:ad,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles custom get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/custom/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.profiles.custom.get({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Loaded`})}};function sd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`data-classes`,{type:`string`,array:!0,description:`Data class IDs to associate with the profile. If omitted, existing associations are unchanged.`}).option(`data-tags`,{type:`string`,array:!0,description:`Data tag IDs to associate with the profile. If omitted, existing associations are unchanged.`}).option(`description`,{type:`string`,description:`The description of the profile.`}).option(`entries`,{type:`string`,description:`Custom entries from this profile.
+If this field is omitted, entries owned by this profile will not be changed. Provide as a JSON array of objects or @path/to/file.json.`}).option(`name`,{type:`string`,description:`The name field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`sensitivity-levels`,{type:`string`,description:`Sensitivity levels to associate with the profile. If omitted, existing associations are unchanged. Provide as a JSON array of objects or @path/to/file.json.`}).option(`shared-entries`,{type:`string`,description:`Other entries, e.g. predefined or integration. Provide as a JSON array of objects or @path/to/file.json.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the profile.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const cd={command:`update <profile-id>`,describe:`Updates a DLP custom profile.`,builder:sd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles custom update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/custom/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:p(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},data_classes:r[`data-classes`],data_tags:r[`data-tags`],description:p(r.description,`description`,`text`),entries:d(r.entries,`entries`),name:p(r.name,`name`,`text`),ocr_enabled:r[`ocr-enabled`],sensitivity_levels:d(r[`sensitivity-levels`],`sensitivity-levels`),shared_entries:d(r[`shared-entries`],`shared-entries`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.profiles.custom.update({...e,account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await h(`name`,`The name field`));let m=f({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:p(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},data_classes:r[`data-classes`],data_tags:r[`data-tags`],description:p(r.description,`description`,`text`),entries:d(r.entries,`entries`),name:p(r.name,`name`,`text`),ocr_enabled:r[`ocr-enabled`],sensitivity_levels:d(r[`sensitivity-levels`],`sensitivity-levels`),shared_entries:d(r[`shared-entries`],`shared-entries`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.profiles.custom.update({...m,account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Updated`})}},ld={command:`custom`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(nd).command(id).command(od).command(cd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ud(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dd={command:`get <profile-id>`,describe:`Fetches a DLP profile by ID.`,builder:ud,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.profiles.get({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Loaded`})}};function fd(e){return e.option(`all`,{type:`boolean`,description:`Return all profiles, including those that current account does not have access to.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pd={command:`list`,describe:`Lists all DLP profiles in an account.`,builder:fd,handler:async r=>{let i={all:r.all};if(r.dryRun){s({command:`cf zero-trust dlp profiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.dlp.profiles.list({account_id:u,...i})),{successLabel:`Loaded`})}};function md(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`enabled-entries`,{type:`string`,array:!0,description:`The enabled_entries field`}).option(`entries`,{type:`string`,description:`The entries field. Provide as a JSON array of objects or @path/to/file.json.`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Predefined profiles can not be created. This endpoint will only update an existing predefined profiles settings.`})}const hd={command:`create <profile-id>`,describe:"This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Creates a DLP predefined profile. Only supports enabling/disabling entries.",builder:md,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}/config`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:p(r[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:r[`enabled-entries`],entries:d(r.entries,`entries`),ocr_enabled:r[`ocr-enabled`]}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.profiles.predefined.create({body:e,account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Created`});return}let m=f({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:p(r[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:r[`enabled-entries`],entries:d(r.entries,`entries`),ocr_enabled:r[`ocr-enabled`]});o(await c(`Creating`,async()=>i.zeroTrust.dlp.profiles.predefined.create({body:m,account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Created`})}};function gd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const _d={command:`delete <profile-id>`,describe:`This is a no-op as predefined profiles can't be deleted but is needed for our generated terraform API.`,builder:gd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles predefined delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.profiles.predefined.delete({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Deleted`})}};function vd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yd={command:`get <profile-id>`,describe:"This is similar to `get_predefined` but only returns entries that are enabled. This is needed for our terraform API Fetches a predefined DLP profile by id.",builder:vd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles predefined get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}/config`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.profiles.predefined.get({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Loaded`})}};function bd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`enabled-entries`,{type:`string`,array:!0,description:`The enabled_entries field`}).option(`entries`,{type:`string`,description:`The entries field. Provide as a JSON array of objects or @path/to/file.json.`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the predefined profile.`})}const xd={command:`update <profile-id>`,describe:"This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Updates a DLP predefined profile. Only supports enabling/disabling entries.",builder:bd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp profiles predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}/config`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:p(r[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:r[`enabled-entries`],entries:d(r.entries,`entries`),ocr_enabled:r[`ocr-enabled`]}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.profiles.predefined.update({body:e,account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Updated`});return}let m=f({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:p(r[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:r[`enabled-entries`],entries:d(r.entries,`entries`),ocr_enabled:r[`ocr-enabled`]});o(await c(`Updating`,async()=>i.zeroTrust.dlp.profiles.predefined.update({body:m,account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Updated`})}},Sd={command:`predefined`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(hd).command(_d).command(yd).command(xd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Cd={command:`profiles`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(dd).command(pd).command(ld).command(Sd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function wd(e){return e.positional(`template-id`,{type:`string`,description:`Template ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Td={command:`get <template-id>`,describe:`Gets an available sensitivity group template.`,builder:wd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-group-templates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/templates/${r[`template-id`]==null?`<template-id>`:encodeURIComponent(String(r[`template-id`]))}`,pathParams:{"template-id":String(r[`template-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityGroupTemplates.get({account_id:l,template_id:r[`template-id`]})),{successLabel:`Loaded`})}};function Ed(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dd={command:`list`,describe:`Lists available sensitivity group templates.`,builder:Ed,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-group-templates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/templates`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityGroupTemplates.list({account_id:l})),{successLabel:`Loaded`})}},Od={command:`sensitivity-group-templates`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Td).command(Dd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function kd(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`levels`,{type:`string`,description:"Levels to create with the group. Mutually exclusive with `template_id`. Provide as a JSON array of objects or @path/to/file.json."}).option(`name`,{type:`string`,description:`The name field`}).option(`template-id`,{type:`string`,description:`The template_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new sensitivity group.`})}const Ad={command:`create`,describe:`Creates a sensitivity group, optionally from a template.`,builder:kd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),levels:d(r.levels,`levels`),name:p(r.name,`name`,`text`),template_id:p(r[`template-id`],`template-id`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.sensitivityGroups.create({...e,account_id:l})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await h(`name`,`The name field`));let m=f({description:p(r.description,`description`,`text`),levels:d(r.levels,`levels`),name:p(r.name,`name`,`text`),template_id:p(r[`template-id`],`template-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.sensitivityGroups.create({...m,account_id:l})),{successLabel:`Created`})}};function jd(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Md={command:`delete <sensitivity-group-id>`,describe:`Deletes a sensitivity group and its levels.`,builder:jd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.sensitivityGroups.delete({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Deleted`})}};function Nd(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pd={command:`get-level-order <sensitivity-group-id>`,describe:`Gets the current order of sensitivity levels in a group.`,builder:Nd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups get-level-order`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/level_order`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityGroups.getLevelOrder({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Loaded`})}};function Fd(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Id={command:`get <sensitivity-group-id>`,describe:`Gets a sensitivity group and its levels.`,builder:Fd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityGroups.get({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Loaded`})}};function Ld(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Rd={command:`list`,describe:`Lists sensitivity groups configured for the account.`,builder:Ld,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityGroups.list({account_id:l})),{successLabel:`Loaded`})}};function zd(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`level-ids`,{type:`string`,array:!0,description:`The level_ids field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Desired ordered list of level IDs.`})}const Bd={command:`update-level-order <sensitivity-group-id>`,describe:`Updates the order of sensitivity levels in a group.`,builder:zd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups update-level-order`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/level_order`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({level_ids:r[`level-ids`]}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityGroups.updateLevelOrder({body:e,account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Updated`});return}if(r[`level-ids`]===void 0)throw Error(`--level-ids is required (or pass --body with this field set).`);let d=f({level_ids:r[`level-ids`]});o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityGroups.updateLevelOrder({body:d,account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Updated`})}};function Vd(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`levels`,{type:`string`,description:"The desired final state of levels.\n- `None` (omitted): no level changes.\n- `Some([])`: delete all levels.\n- `Some([...])`: desired final set + order. Provide as a JSON array of objects or @path/to/file.json."}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the sensitivity group to update.`})}const Hd={command:`update <sensitivity-group-id>`,describe:`Updates a sensitivity group and its levels.`,builder:Vd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),levels:d(r.levels,`levels`),name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityGroups.update({...e,account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Updated`});return}let m=f({description:p(r.description,`description`,`text`),levels:d(r.levels,`levels`),name:p(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityGroups.update({...m,account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Updated`})}},Ud={command:`sensitivity-groups`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Ad).command(Md).command(Id).command(Pd).command(Rd).command(Hd).command(Bd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Wd(e){return e.positional(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new sensitivity level.`})}const Gd={command:`create <sensitivity-group-id>`,describe:`Creates a sensitivity level in a group.`,builder:Wd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-levels create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/levels`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.dlp.sensitivityLevels.create({body:e,account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await h(`name`,`The name field`));let d=f({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.dlp.sensitivityLevels.create({body:d,account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Created`})}};function Kd(e){return e.positional(`sensitivity-level-id`,{type:`string`,description:`Sensitivity level ID`,demandOption:!0}).option(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const qd={command:`delete <sensitivity-level-id>`,describe:`Deletes a sensitivity level from a group.`,builder:Kd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-levels delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/levels/${r[`sensitivity-level-id`]==null?`<sensitivity-level-id>`:encodeURIComponent(String(r[`sensitivity-level-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``),"sensitivity-level-id":String(r[`sensitivity-level-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.dlp.sensitivityLevels.delete({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`],sensitivity_level_id:r[`sensitivity-level-id`]})),{successLabel:`Deleted`})}};function Jd(e){return e.positional(`sensitivity-level-id`,{type:`string`,description:`Sensitivity level ID`,demandOption:!0}).option(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yd={command:`get <sensitivity-level-id>`,describe:`Gets a sensitivity level from a group.`,builder:Jd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-levels get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/levels/${r[`sensitivity-level-id`]==null?`<sensitivity-level-id>`:encodeURIComponent(String(r[`sensitivity-level-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``),"sensitivity-level-id":String(r[`sensitivity-level-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityLevels.get({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`],sensitivity_level_id:r[`sensitivity-level-id`]})),{successLabel:`Loaded`})}};function Xd(e){return e.option(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zd={command:`list`,describe:`Lists sensitivity levels in a sensitivity group.`,builder:Xd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-levels list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/levels`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.dlp.sensitivityLevels.list({account_id:l,sensitivity_group_id:r[`sensitivity-group-id`]})),{successLabel:`Loaded`})}};function Qd(e){return e.positional(`sensitivity-level-id`,{type:`string`,description:`Sensitivity level ID`,demandOption:!0}).option(`sensitivity-group-id`,{type:`string`,description:`Sensitivity group ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the sensitivity level to update.`})}const $d={command:`update <sensitivity-level-id>`,describe:`Updates a sensitivity level in a group.`,builder:Qd,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust dlp sensitivity-levels update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/sensitivity_groups/${r[`sensitivity-group-id`]==null?`<sensitivity-group-id>`:encodeURIComponent(String(r[`sensitivity-group-id`]))}/levels/${r[`sensitivity-level-id`]==null?`<sensitivity-level-id>`:encodeURIComponent(String(r[`sensitivity-level-id`]))}`,pathParams:{"sensitivity-group-id":String(r[`sensitivity-group-id`]??``),"sensitivity-level-id":String(r[`sensitivity-level-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityLevels.update({...e,account_id:l,sensitivity_group_id:r[`sensitivity-group-id`],sensitivity_level_id:r[`sensitivity-level-id`]})),{successLabel:`Updated`});return}let d=f({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.dlp.sensitivityLevels.update({...d,account_id:l,sensitivity_group_id:r[`sensitivity-group-id`],sensitivity_level_id:r[`sensitivity-level-id`]})),{successLabel:`Updated`})}},ef={command:`sensitivity-levels`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Gd).command(qd).command(Yd).command(Zd).command($d).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},tf={command:`dlp`,describe:`Operations for dlp`,builder:e=>e.command($).command(tl).command(fl).command(_l).command(Ol).command(Xl).command(hu).command(Uu).command(Ku).command(Yu).command(ed).command(Cd).command(Od).command(Ud).command(ef).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function nf(e){return e.option(`description`,{type:`string`,description:`The description field`,default:``}).option(`match-percent`,{type:`number`,description:`The match_percent field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new document fingerprint.`})}const rf={command:`fingerprints`,describe:`Creates a new document fingerprint for DLP scanning. Document fingerprints detect documents that are structurally similar to the uploaded sample.`,builder:nf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints create document fingerprints`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),match_percent:r[`match-percent`],name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.documentFingerprints.create.document.fingerprints({...e,account_id:l})),{successLabel:`Created`});return}if(r[`match-percent`]===void 0)throw Error(`--match-percent is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await h(`name`,`The name field`));let d=f({description:p(r.description,`description`,`text`),match_percent:r[`match-percent`],name:p(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.documentFingerprints.create.document.fingerprints({...d,account_id:l})),{successLabel:`Created`})}},af={command:`document`,describe:`Document Fingerprints operations`,builder:e=>e.command(rf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function of(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`match-percent`,{type:`number`,description:`The match_percent field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the document fingerprint to update.`})}const sf={command:`v2 <document-fingerprint-id>`,describe:`Updates metadata for an existing document fingerprint, such as its name or description.`,builder:of,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints create v2`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints/${r[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(r[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(r[`document-fingerprint-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),match_percent:r[`match-percent`],name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.documentFingerprints.create.v2({...e,account_id:l,document_fingerprint_id:r[`document-fingerprint-id`]})),{successLabel:`Created`});return}let d=f({description:p(r.description,`description`,`text`),match_percent:r[`match-percent`],name:p(r.name,`name`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.documentFingerprints.create.v2({...d,account_id:l,document_fingerprint_id:r[`document-fingerprint-id`]})),{successLabel:`Created`})}},cf={command:`create`,describe:`Document Fingerprints operations`,builder:e=>e.command(sf).command(af).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function lf(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const uf={command:`delete <document-fingerprint-id>`,describe:`Removes a document fingerprint from DLP configuration. Documents matching this fingerprint will no longer be detected.`,builder:lf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints/${r[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(r[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(r[`document-fingerprint-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.documentFingerprints.delete({account_id:l,document_fingerprint_id:r[`document-fingerprint-id`]})),{successLabel:`Deleted`})}};function df(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ff={command:`fingerprints <document-fingerprint-id>`,describe:`Gets a document fingerprint and its latest upload status.`,builder:df,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints get document fingerprints`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints/${r[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(r[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(r[`document-fingerprint-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.documentFingerprints.get.document.fingerprints({account_id:l,document_fingerprint_id:r[`document-fingerprint-id`]})),{successLabel:`Loaded`})}},pf={command:`document`,describe:`Document Fingerprints operations`,builder:e=>e.command(ff).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function mf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const hf={command:`all`,describe:`Lists all document fingerprints configured for DLP scanning in the account.`,builder:mf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints get fingerprints all`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.documentFingerprints.get.fingerprints.all({account_id:l})),{successLabel:`Loaded`})}},gf={command:`fingerprints`,describe:`Document Fingerprints operations`,builder:e=>e.command(hf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},_f={command:`get`,describe:`Operations for document-fingerprints.get`,builder:e=>e.command(pf).command(gf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function vf(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`File used for document fingerprinting.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const yf={command:`update <document-fingerprint-id>`,describe:`Uploads a new document to create or update a fingerprint. The document structure is analyzed to enable detection of similar documents.`,builder:vf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust document-fingerprints update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/document_fingerprints/${r[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(r[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(r[`document-fingerprint-id`]??``)},bodyKind:`multipart`,body:{body:r.body,file:r.file}});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,r.file!==void 0||r.body!==void 0){let e=new FormData;if(r.file){let t=m(r.file);e.append(`file`,new Blob([t]),r.file.split(/[\\/]/).filter(Boolean).pop())}else r.body!==void 0&&e.append(`file`,r.body);o(await c(`Updating`,async()=>i(l,`PUT`,`/accounts/${u}/dlp/document_fingerprints/${encodeURIComponent(String(r[`document-fingerprint-id`]))}`,{body:e})),{successLabel:`Updated`});return}if(r.body){let e=p(r.body,`body`,`binary`);o(await c(`Updating`,async()=>i(l,`PUT`,`/accounts/${u}/dlp/document_fingerprints/${encodeURIComponent(String(r[`document-fingerprint-id`]))}`,{body:e,headers:{"Content-Type":`multipart/form-data`}})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},bf={command:`document-fingerprints`,describe:`Document Fingerprints operations`,builder:e=>e.command(uf).command(yf).command(cf).command(_f).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function xf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sf={command:`list`,describe:`List all application and application type mappings.`,builder:xf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway app-types list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/app_types`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.appTypes.list({account_id:l})),{successLabel:`Loaded`})}},Cf={command:`app-types`,describe:`Operations for gateway.app-types`,builder:e=>e.command(Sf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function wf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Tf={command:`get`,describe:`Retrieve all Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.`,builder:wf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway audit-ssh-settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/audit_ssh_settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.auditSshSettings.get({account_id:l})),{successLabel:`Loaded`})}};function Ef(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Df={command:`rotate-seed`,describe:`Rotate the SSH account seed that generates the host key identity when connecting through the Cloudflare SSH Proxy.`,builder:Ef,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway audit-ssh-settings rotate-seed`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/audit_ssh_settings/rotate_seed`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.gateway.auditSshSettings.rotateSeed({account_id:l})),{successLabel:`Created`})}};function Of(e){return e.option(`public-key`,{type:`string`,description:`Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const kf={command:`update`,describe:`Update Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.`,builder:Of,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway audit-ssh-settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/audit_ssh_settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({public_key:p(r[`public-key`],`public-key`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.auditSshSettings.update({...e,account_id:l})),{successLabel:`Updated`});return}r[`public-key`]===void 0&&(r[`public-key`]=await h(`public-key`,`Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging.`));let d=f({public_key:p(r[`public-key`],`public-key`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.auditSshSettings.update({...d,account_id:l})),{successLabel:`Updated`})}},Af={command:`audit-ssh-settings`,describe:`Operations for gateway.audit-ssh-settings`,builder:e=>e.command(Tf).command(Df).command(kf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function jf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Mf={command:`list`,describe:`List all categories.`,builder:jf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway categories list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/categories`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.categories.list({account_id:l})),{successLabel:`Loaded`})}},Nf={command:`categories`,describe:`Operations for gateway.categories`,builder:e=>e.command(Mf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Pf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ff={command:`activate <certificate-id>`,describe:`Bind a single Zero Trust certificate to the edge.`,builder:Pf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates activate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}/activate`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.gateway.certificates.activate({account_id:l,certificate_id:r[`certificate-id`]})),{successLabel:`Created`})}};function If(e){return e.option(`validity-period-days`,{type:`number`,description:"Sets the certificate validity period in days (range: 1-10,950 days / ~30 years). Defaults to 1,825 days (5 years). **Important**: This field is only settable during the certificate creation.  Certificates becomes immutable after creation - use the `/activate` and `/deactivate` endpoints to manage certificate lifecycle."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Lf={command:`create`,describe:`Create a new Zero Trust certificate.`,builder:If,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({validity_period_days:r[`validity-period-days`]}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.certificates.create({...e,account_id:l})),{successLabel:`Created`});return}let d=f({validity_period_days:r[`validity-period-days`]});o(await c(`Creating`,async()=>i.zeroTrust.gateway.certificates.create({...d,account_id:l})),{successLabel:`Created`})}};function Rf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zf={command:`deactivate <certificate-id>`,describe:`Unbind a single Zero Trust certificate from the edge.`,builder:Rf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates deactivate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}/deactivate`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.gateway.certificates.deactivate({account_id:l,certificate_id:r[`certificate-id`]})),{successLabel:`Created`})}};function Bf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Vf={command:`delete <certificate-id>`,describe:`Delete a gateway-managed Zero Trust certificate. You must deactivate the certificate from the edge (inactive) before deleting it.`,builder:Bf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.certificates.delete({account_id:l,certificate_id:r[`certificate-id`]})),{successLabel:`Deleted`})}};function Hf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Uf={command:`get <certificate-id>`,describe:`Get a single Zero Trust certificate.`,builder:Hf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates/${r[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(r[`certificate-id`]))}`,pathParams:{"certificate-id":String(r[`certificate-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.certificates.get({account_id:l,certificate_id:r[`certificate-id`]})),{successLabel:`Loaded`})}};function Wf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gf={command:`list`,describe:`List all Zero Trust certificates for an account.`,builder:Wf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/certificates`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.certificates.list({account_id:l})),{successLabel:`Loaded`})}},Kf={command:`certificates`,describe:`Operations for gateway.certificates`,builder:e=>e.command(Ff).command(Lf).command(zf).command(Vf).command(Uf).command(Gf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function qf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jf={command:`get`,describe:`Retrieve the current Zero Trust certificate configuration.`,builder:qf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway configurations custom-certificate get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/configuration/custom_certificate`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.configurations.customCertificate.get({account_id:l})),{successLabel:`Loaded`})}},Yf={command:`custom-certificate`,describe:`Operations for gateway.configurations.custom-certificate`,builder:e=>e.command(Jf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Xf(e){return e.option(`settings-activity-log-enabled`,{type:`boolean`,description:`Specify whether to log activity.`}).option(`settings-antivirus-enabled-download-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on downloads.`}).option(`settings-antivirus-enabled-upload-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on uploads.`}).option(`settings-antivirus-fail-closed`,{type:`boolean`,description:`Specify whether to block requests for unscannable files.`}).option(`settings-antivirus-notification-settings-enabled`,{type:`boolean`,description:`Specify whether to enable notifications.`}).option(`settings-antivirus-notification-settings-include-context`,{type:`boolean`,description:`Specify whether to include context information as query parameters.`}).option(`settings-antivirus-notification-settings-msg`,{type:`string`,description:`Specify the message to show in the notification.`}).option(`settings-antivirus-notification-settings-support-url`,{type:`string`,description:`Specify a URL that directs users to more information. If unset, the notification opens a block page.`}).option(`settings-block-page-background-color`,{type:`string`,description:"Specify the block page background color in `#rrggbb` format when the mode is customized_block_page."}).option(`settings-block-page-enabled`,{type:`boolean`,description:`Specify whether to enable the custom block page.`}).option(`settings-block-page-footer-text`,{type:`string`,description:`Specify the block page footer text when the mode is customized_block_page.`}).option(`settings-block-page-header-text`,{type:`string`,description:`Specify the block page header text when the mode is customized_block_page.`}).option(`settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to append context to target_uri as query parameters. This applies only when the mode is redirect_uri.`}).option(`settings-block-page-logo-path`,{type:`string`,description:`Specify the full URL to the logo file when the mode is customized_block_page.`}).option(`settings-block-page-mailto-address`,{type:`string`,description:`Specify the admin email for users to contact when the mode is customized_block_page.`}).option(`settings-block-page-mailto-subject`,{type:`string`,description:`Specify the subject line for emails created from the block page when the mode is customized_block_page.`}).option(`settings-block-page-mode`,{type:`string`,description:`Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.`,choices:[`customized_block_page`,`redirect_uri`]}).option(`settings-block-page-name`,{type:`string`,description:`Specify the block page title when the mode is customized_block_page.`}).option(`settings-block-page-suppress-footer`,{type:`boolean`,description:`Specify whether to suppress detailed information at the bottom of the block page when the mode is customized_block_page.`}).option(`settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to redirect users to when the mode is redirect_uri.`}).option(`settings-body-scanning-inspection-mode`,{type:`string`,description:"Specify the inspection mode as either `deep` or `shallow`.",choices:[`deep`,`shallow`]}).option(`settings-browser-isolation-non-identity-enabled`,{type:`boolean`,description:`Specify whether to enable non-identity onramp support for Browser Isolation.`}).option(`settings-browser-isolation-url-browser-isolation-enabled`,{type:`boolean`,description:`Specify whether to enable Clientless Browser Isolation.`}).option(`settings-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.`}).option(`settings-custom-certificate-enabled`,{type:`boolean`,description:`Specify whether to enable a custom certificate authority for signing Gateway traffic.`}).option(`settings-custom-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate (ID from MTLS certificate store).`}).option(`settings-extended-email-matching-enabled`,{type:`boolean`,description:`Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.`}).option(`settings-fips-tls`,{type:`boolean`,description:`Enforce cipher suites and TLS versions compliant with FIPS 140-2.`}).option(`settings-host-selector-enabled`,{type:`boolean`,description:`Specify whether to enable filtering via hosts for egress policies.`}).option(`settings-inspection-mode`,{type:`string`,description:`Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.`,choices:[`static`,`dynamic`]}).option(`settings-max-ttl-secs`,{type:`number`,description:"Account-level cap on DNS response TTLs, in seconds. Gateway rewrites DNS responses so returned record TTLs do not exceed this value. Null means no cap. Each DNS location can inherit, override, or disable it through the location `max_ttl` setting."}).option(`settings-protocol-detection-enabled`,{type:`boolean`,description:`Specify whether to detect protocols from the initial bytes of client traffic.`}).option(`settings-sandbox-enabled`,{type:`boolean`,description:`Specify whether to enable the sandbox.`}).option(`settings-sandbox-fallback-action`,{type:`string`,description:`Specify the action to take when the system cannot scan the file.`,choices:[`allow`,`block`]}).option(`settings-tls-decrypt-enabled`,{type:`boolean`,description:`Specify whether to inspect encrypted HTTP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Specify account settings.`}).check(e=>{if(`settings-activity-log-enabled.settings-antivirus-enabled-download-phase.settings-antivirus-enabled-upload-phase.settings-antivirus-fail-closed.settings-antivirus-notification-settings-enabled.settings-antivirus-notification-settings-include-context.settings-antivirus-notification-settings-msg.settings-antivirus-notification-settings-support-url.settings-block-page-background-color.settings-block-page-enabled.settings-block-page-footer-text.settings-block-page-header-text.settings-block-page-include-context.settings-block-page-logo-path.settings-block-page-mailto-address.settings-block-page-mailto-subject.settings-block-page-mode.settings-block-page-name.settings-block-page-suppress-footer.settings-block-page-target-uri.settings-body-scanning-inspection-mode.settings-browser-isolation-non-identity-enabled.settings-browser-isolation-url-browser-isolation-enabled.settings-certificate-id.settings-custom-certificate-enabled.settings-custom-certificate-id.settings-extended-email-matching-enabled.settings-fips-tls.settings-host-selector-enabled.settings-inspection-mode.settings-max-ttl-secs.settings-protocol-detection-enabled.settings-sandbox-enabled.settings-sandbox-fallback-action.settings-tls-decrypt-enabled`.split(`.`).some(t=>e[t]!==void 0)){let t=[`settings-certificate-id`,`settings-custom-certificate-enabled`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --settings-* flag is set`)}return!0})}const Zf={command:`edit`,describe:"Update (PATCH) a single subcollection of settings such as `antivirus`, `tls_decrypt`, `activity_log`, `block_page`, `browser_isolation`, `fips`, `body_scanning`, `certificate`, or `max_ttl_secs` without updating the entire configuration object. This endpoint returns an error if any settings collection lacks proper configuration.",builder:Xf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway configurations edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({settings:{activity_log:{enabled:r[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:r[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:r[`settings-antivirus-enabled-upload-phase`],fail_closed:r[`settings-antivirus-fail-closed`],notification_settings:{enabled:r[`settings-antivirus-notification-settings-enabled`],include_context:r[`settings-antivirus-notification-settings-include-context`],msg:p(r[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:p(r[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:p(r[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:r[`settings-block-page-enabled`],footer_text:p(r[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:p(r[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:r[`settings-block-page-include-context`],logo_path:p(r[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:p(r[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:p(r[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:p(r[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:p(r[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:r[`settings-block-page-suppress-footer`],target_uri:p(r[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:p(r[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:r[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:r[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:p(r[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:r[`settings-custom-certificate-enabled`],id:p(r[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:r[`settings-extended-email-matching-enabled`]},fips:{tls:r[`settings-fips-tls`]},host_selector:{enabled:r[`settings-host-selector-enabled`]},inspection:{mode:p(r[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:r[`settings-max-ttl-secs`],protocol_detection:{enabled:r[`settings-protocol-detection-enabled`]},sandbox:{enabled:r[`settings-sandbox-enabled`],fallback_action:p(r[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:r[`settings-tls-decrypt-enabled`]}}}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.configurations.edit({body:e,account_id:l})),{successLabel:`Updated`});return}let d=f({settings:{activity_log:{enabled:r[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:r[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:r[`settings-antivirus-enabled-upload-phase`],fail_closed:r[`settings-antivirus-fail-closed`],notification_settings:{enabled:r[`settings-antivirus-notification-settings-enabled`],include_context:r[`settings-antivirus-notification-settings-include-context`],msg:p(r[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:p(r[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:p(r[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:r[`settings-block-page-enabled`],footer_text:p(r[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:p(r[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:r[`settings-block-page-include-context`],logo_path:p(r[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:p(r[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:p(r[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:p(r[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:p(r[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:r[`settings-block-page-suppress-footer`],target_uri:p(r[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:p(r[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:r[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:r[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:p(r[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:r[`settings-custom-certificate-enabled`],id:p(r[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:r[`settings-extended-email-matching-enabled`]},fips:{tls:r[`settings-fips-tls`]},host_selector:{enabled:r[`settings-host-selector-enabled`]},inspection:{mode:p(r[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:r[`settings-max-ttl-secs`],protocol_detection:{enabled:r[`settings-protocol-detection-enabled`]},sandbox:{enabled:r[`settings-sandbox-enabled`],fallback_action:p(r[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:r[`settings-tls-decrypt-enabled`]}}});o(await c(`Updating`,async()=>i.zeroTrust.gateway.configurations.edit({body:d,account_id:l})),{successLabel:`Updated`})}};function Qf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $f={command:`get`,describe:`Retrieve the current Zero Trust account configuration.`,builder:Qf,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway configurations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.configurations.get({account_id:l})),{successLabel:`Loaded`})}};function ep(e){return e.option(`settings-activity-log-enabled`,{type:`boolean`,description:`Specify whether to log activity.`}).option(`settings-antivirus-enabled-download-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on downloads.`}).option(`settings-antivirus-enabled-upload-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on uploads.`}).option(`settings-antivirus-fail-closed`,{type:`boolean`,description:`Specify whether to block requests for unscannable files.`}).option(`settings-antivirus-notification-settings-enabled`,{type:`boolean`,description:`Specify whether to enable notifications.`}).option(`settings-antivirus-notification-settings-include-context`,{type:`boolean`,description:`Specify whether to include context information as query parameters.`}).option(`settings-antivirus-notification-settings-msg`,{type:`string`,description:`Specify the message to show in the notification.`}).option(`settings-antivirus-notification-settings-support-url`,{type:`string`,description:`Specify a URL that directs users to more information. If unset, the notification opens a block page.`}).option(`settings-block-page-background-color`,{type:`string`,description:"Specify the block page background color in `#rrggbb` format when the mode is customized_block_page."}).option(`settings-block-page-enabled`,{type:`boolean`,description:`Specify whether to enable the custom block page.`}).option(`settings-block-page-footer-text`,{type:`string`,description:`Specify the block page footer text when the mode is customized_block_page.`}).option(`settings-block-page-header-text`,{type:`string`,description:`Specify the block page header text when the mode is customized_block_page.`}).option(`settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to append context to target_uri as query parameters. This applies only when the mode is redirect_uri.`}).option(`settings-block-page-logo-path`,{type:`string`,description:`Specify the full URL to the logo file when the mode is customized_block_page.`}).option(`settings-block-page-mailto-address`,{type:`string`,description:`Specify the admin email for users to contact when the mode is customized_block_page.`}).option(`settings-block-page-mailto-subject`,{type:`string`,description:`Specify the subject line for emails created from the block page when the mode is customized_block_page.`}).option(`settings-block-page-mode`,{type:`string`,description:`Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.`,choices:[`customized_block_page`,`redirect_uri`]}).option(`settings-block-page-name`,{type:`string`,description:`Specify the block page title when the mode is customized_block_page.`}).option(`settings-block-page-suppress-footer`,{type:`boolean`,description:`Specify whether to suppress detailed information at the bottom of the block page when the mode is customized_block_page.`}).option(`settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to redirect users to when the mode is redirect_uri.`}).option(`settings-body-scanning-inspection-mode`,{type:`string`,description:"Specify the inspection mode as either `deep` or `shallow`.",choices:[`deep`,`shallow`]}).option(`settings-browser-isolation-non-identity-enabled`,{type:`boolean`,description:`Specify whether to enable non-identity onramp support for Browser Isolation.`}).option(`settings-browser-isolation-url-browser-isolation-enabled`,{type:`boolean`,description:`Specify whether to enable Clientless Browser Isolation.`}).option(`settings-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.`}).option(`settings-custom-certificate-enabled`,{type:`boolean`,description:`Specify whether to enable a custom certificate authority for signing Gateway traffic.`}).option(`settings-custom-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate (ID from MTLS certificate store).`}).option(`settings-extended-email-matching-enabled`,{type:`boolean`,description:`Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.`}).option(`settings-fips-tls`,{type:`boolean`,description:`Enforce cipher suites and TLS versions compliant with FIPS 140-2.`}).option(`settings-host-selector-enabled`,{type:`boolean`,description:`Specify whether to enable filtering via hosts for egress policies.`}).option(`settings-inspection-mode`,{type:`string`,description:`Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.`,choices:[`static`,`dynamic`]}).option(`settings-max-ttl-secs`,{type:`number`,description:"Account-level cap on DNS response TTLs, in seconds. Gateway rewrites DNS responses so returned record TTLs do not exceed this value. Null means no cap. Each DNS location can inherit, override, or disable it through the location `max_ttl` setting."}).option(`settings-protocol-detection-enabled`,{type:`boolean`,description:`Specify whether to detect protocols from the initial bytes of client traffic.`}).option(`settings-sandbox-enabled`,{type:`boolean`,description:`Specify whether to enable the sandbox.`}).option(`settings-sandbox-fallback-action`,{type:`string`,description:`Specify the action to take when the system cannot scan the file.`,choices:[`allow`,`block`]}).option(`settings-tls-decrypt-enabled`,{type:`boolean`,description:`Specify whether to inspect encrypted HTTP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Specify account settings.`}).check(e=>{if(`settings-activity-log-enabled.settings-antivirus-enabled-download-phase.settings-antivirus-enabled-upload-phase.settings-antivirus-fail-closed.settings-antivirus-notification-settings-enabled.settings-antivirus-notification-settings-include-context.settings-antivirus-notification-settings-msg.settings-antivirus-notification-settings-support-url.settings-block-page-background-color.settings-block-page-enabled.settings-block-page-footer-text.settings-block-page-header-text.settings-block-page-include-context.settings-block-page-logo-path.settings-block-page-mailto-address.settings-block-page-mailto-subject.settings-block-page-mode.settings-block-page-name.settings-block-page-suppress-footer.settings-block-page-target-uri.settings-body-scanning-inspection-mode.settings-browser-isolation-non-identity-enabled.settings-browser-isolation-url-browser-isolation-enabled.settings-certificate-id.settings-custom-certificate-enabled.settings-custom-certificate-id.settings-extended-email-matching-enabled.settings-fips-tls.settings-host-selector-enabled.settings-inspection-mode.settings-max-ttl-secs.settings-protocol-detection-enabled.settings-sandbox-enabled.settings-sandbox-fallback-action.settings-tls-decrypt-enabled`.split(`.`).some(t=>e[t]!==void 0)){let t=[`settings-certificate-id`,`settings-custom-certificate-enabled`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --settings-* flag is set`)}return!0})}const tp={command:`update`,describe:`Update the current Zero Trust account configuration.`,builder:ep,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway configurations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({settings:{activity_log:{enabled:r[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:r[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:r[`settings-antivirus-enabled-upload-phase`],fail_closed:r[`settings-antivirus-fail-closed`],notification_settings:{enabled:r[`settings-antivirus-notification-settings-enabled`],include_context:r[`settings-antivirus-notification-settings-include-context`],msg:p(r[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:p(r[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:p(r[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:r[`settings-block-page-enabled`],footer_text:p(r[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:p(r[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:r[`settings-block-page-include-context`],logo_path:p(r[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:p(r[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:p(r[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:p(r[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:p(r[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:r[`settings-block-page-suppress-footer`],target_uri:p(r[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:p(r[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:r[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:r[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:p(r[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:r[`settings-custom-certificate-enabled`],id:p(r[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:r[`settings-extended-email-matching-enabled`]},fips:{tls:r[`settings-fips-tls`]},host_selector:{enabled:r[`settings-host-selector-enabled`]},inspection:{mode:p(r[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:r[`settings-max-ttl-secs`],protocol_detection:{enabled:r[`settings-protocol-detection-enabled`]},sandbox:{enabled:r[`settings-sandbox-enabled`],fallback_action:p(r[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:r[`settings-tls-decrypt-enabled`]}}}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.configurations.update({body:e,account_id:l})),{successLabel:`Updated`});return}let d=f({settings:{activity_log:{enabled:r[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:r[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:r[`settings-antivirus-enabled-upload-phase`],fail_closed:r[`settings-antivirus-fail-closed`],notification_settings:{enabled:r[`settings-antivirus-notification-settings-enabled`],include_context:r[`settings-antivirus-notification-settings-include-context`],msg:p(r[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:p(r[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:p(r[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:r[`settings-block-page-enabled`],footer_text:p(r[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:p(r[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:r[`settings-block-page-include-context`],logo_path:p(r[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:p(r[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:p(r[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:p(r[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:p(r[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:r[`settings-block-page-suppress-footer`],target_uri:p(r[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:p(r[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:r[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:r[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:p(r[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:r[`settings-custom-certificate-enabled`],id:p(r[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:r[`settings-extended-email-matching-enabled`]},fips:{tls:r[`settings-fips-tls`]},host_selector:{enabled:r[`settings-host-selector-enabled`]},inspection:{mode:p(r[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:r[`settings-max-ttl-secs`],protocol_detection:{enabled:r[`settings-protocol-detection-enabled`]},sandbox:{enabled:r[`settings-sandbox-enabled`],fallback_action:p(r[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:r[`settings-tls-decrypt-enabled`]}}});o(await c(`Updating`,async()=>i.zeroTrust.gateway.configurations.update({body:d,account_id:l})),{successLabel:`Updated`})}},np={command:`configurations`,describe:`Operations for gateway.configurations`,builder:e=>e.command(Zf).command($f).command(tp).command(Yf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function rp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ip={command:`create`,describe:`Create a Zero Trust account for an existing Cloudflare account.`,builder:rp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.gateway.create({account_id:l})),{successLabel:`Created`})}};function ap(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const op={command:`list`,describe:`List Zero Trust Gateway IPv4 address pairs for an account.`,builder:ap,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway dns-destination-ips list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/dns_destination_ips`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.dnsDestinationIps.list({account_id:l})),{successLabel:`Loaded`})}},sp={command:`dns-destination-ips`,describe:`Operations for gateway.dns-destination-ips`,builder:e=>e.command(op).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lp={command:`list`,describe:`Retrieve the list of egress CIDRs allocated to this Zero Trust account.`,builder:cp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway egress-cidr-pairs list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/egress_cidr_pairs`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.egressCidrPairs.list({account_id:l})),{successLabel:`Loaded`})}},up={command:`egress-cidr-pairs`,describe:`Operations for gateway.egress-cidr-pairs`,builder:e=>e.command(lp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function dp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fp={command:`list`,describe:`Retrieve information about the current Zero Trust account.`,builder:dp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.list({account_id:l})),{successLabel:`Loaded`})}};function pp(e){return e.option(`description`,{type:`string`,description:`Provide the list description.`}).option(`items`,{type:`string`,description:`Add items to the list. Provide as a JSON array of objects or @path/to/file.json.`}).option(`name`,{type:`string`,description:`Specify the list name.`}).option(`type`,{type:`string`,description:`Specify the list type.`,choices:[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const mp={command:`create`,describe:`Creates a new Zero Trust list.`,builder:pp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),items:d(r.items,`items`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.lists.create({...e,account_id:l})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await h(`name`,`Specify the list name.`)),r.type===void 0&&(r.type=await g(`type`,`Specify the list type.`,[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]));let m=f({description:p(r.description,`description`,`text`),items:d(r.items,`items`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.gateway.lists.create({...m,account_id:l})),{successLabel:`Created`})}};function hp(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const gp={command:`delete <list-id>`,describe:`Deletes a Zero Trust list.`,builder:hp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/${r[`list-id`]==null?`<list-id>`:encodeURIComponent(String(r[`list-id`]))}`,pathParams:{"list-id":String(r[`list-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.lists.delete({account_id:l,list_id:r[`list-id`]})),{successLabel:`Deleted`})}};function _p(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`append`,{type:`string`,description:`Add items to the list. Provide as a JSON array of objects or @path/to/file.json.`}).option(`remove`,{type:`string`,array:!0,description:`Lists of item values you want to remove.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const vp={command:`edit <list-id>`,describe:`Appends or removes an item from a configured Zero Trust list.`,builder:_p,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/${r[`list-id`]==null?`<list-id>`:encodeURIComponent(String(r[`list-id`]))}`,pathParams:{"list-id":String(r[`list-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({append:d(r.append,`append`),remove:r.remove}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.lists.edit({...e,account_id:l,list_id:r[`list-id`]})),{successLabel:`Updated`});return}let p=f({append:d(r.append,`append`),remove:r.remove});o(await c(`Updating`,async()=>i.zeroTrust.gateway.lists.edit({...p,account_id:l,list_id:r[`list-id`]})),{successLabel:`Updated`})}};function yp(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const bp={command:`get <list-id>`,describe:`Fetch a single Zero Trust list.`,builder:yp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/${r[`list-id`]==null?`<list-id>`:encodeURIComponent(String(r[`list-id`]))}`,pathParams:{"list-id":String(r[`list-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.lists.get({account_id:l,list_id:r[`list-id`]})),{successLabel:`Loaded`})}};function xp(e){return e.option(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sp={command:`list`,describe:`Fetch all items in a single Zero Trust list.`,builder:xp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists items list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/${r[`list-id`]==null?`<list-id>`:encodeURIComponent(String(r[`list-id`]))}/items`,pathParams:{"list-id":String(r[`list-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.lists.items.list({account_id:l,list_id:r[`list-id`]})),{successLabel:`Loaded`})}},Cp={command:`items`,describe:`Operations for gateway.lists.items`,builder:e=>e.command(Sp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function wp(e){return e.option(`type`,{type:`string`,description:`Specify the list type.`,choices:[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]}).option(`filter`,{type:`string`,description:"Filter the returned lists by one or more `field:value` pairs.\nRepeat the parameter to apply multiple filters; they are combined with\nlogical AND (a list must satisfy every filter to be returned).\n\nSupported fields and their matching behaviour:\n  * `name` — case-insensitive substring match on the list name.\n  * `id` — substring match on the list ID (UUID), with or without dashes.\n  * `type` — exact match on the list type. Supersedes the legacy `type` query\n    parameter when both are supplied. Must be one of the valid type values.\n  * `item_count` — exact integer match on the number of items in the list.\n\nEach entry must match one of the per-field patterns below: the field must be\none of `name`, `id`, `type`, or `item_count`; `name`/`id` accept any value,\n`type` is restricted to the valid list type values, and `item_count` must be\na non-negative integer."}).option(`search`,{type:`string`,description:"Case-insensitive substring match on the list name or description. When\ncombined with `filter`, both must match (logical AND)."}).option(`order-by`,{type:`string`,description:"Field to sort the returned lists by. When omitted, results are ordered by\n`created_at` in ascending order (i.e. creation order) for backwards\ncompatibility. Supported values:\n  * `name` — sort alphabetically by list name.\n  * `created_at` — sort by creation time; defaults to descending unless `direction` is set.\n  * `updated_at` — sort by last-modified time; defaults to descending unless `direction` is set.\n  * `item_count` — sort by number of items in the list.",choices:[`name`,`created_at`,`updated_at`,`item_count`]}).option(`direction`,{type:`string`,description:"Sort direction. Applies to the field named in `order_by`; when `order_by`\nis omitted it applies to the default `created_at` ordering. When\n`direction` is omitted the default is field-specific: explicitly choosing\n`created_at` or `updated_at` defaults to descending (newest first); `name`\nand `item_count` default to ascending; and the default `created_at`\nordering used when `order_by` is omitted is ascending (for backwards\ncompatibility).\n  * `asc` — ascending.\n  * `desc` — descending.",choices:[`asc`,`desc`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Tp={command:`list`,describe:`Fetch all Zero Trust lists for an account.`,builder:v(wp),handler:async r=>{let i={type:r.type,filter:r.filter,search:r.search,order_by:r[`order-by`],direction:r.direction};if(r.dryRun){s({command:`cf zero-trust gateway lists list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.gateway.lists.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Ep(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`Provide the list description.`}).option(`items`,{type:`string`,description:`Add items to the list. Provide as a JSON array of objects or @path/to/file.json.`}).option(`name`,{type:`string`,description:`Specify the list name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Dp={command:`update <list-id>`,describe:`Updates a configured Zero Trust list. Skips updating list items if not included in the payload. A non empty list items will overwrite the existing list.`,builder:Ep,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/${r[`list-id`]==null?`<list-id>`:encodeURIComponent(String(r[`list-id`]))}`,pathParams:{"list-id":String(r[`list-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),items:d(r.items,`items`),name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.lists.update({...e,account_id:l,list_id:r[`list-id`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await h(`name`,`Specify the list name.`));let m=f({description:p(r.description,`description`,`text`),items:d(r.items,`items`),name:p(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.lists.update({...m,account_id:l,list_id:r[`list-id`]})),{successLabel:`Updated`})}};function Op(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const kp={command:`upload`,describe:"Create a new Zero Trust list by uploading a CSV file. The file must be `text/csv` or `text/plain` and cannot exceed 2 MB. The operation is processed asynchronously. Use the returned operation ID to poll for status.",builder:Op,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway lists upload`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/lists/upload`,pathParams:{},bodyKind:`multipart`,body:{body:r.body,file:r.file}});return}let l=await a(r),u=r.local?e:await t();if(r.accountId=u,r.file!==void 0||r.body!==void 0){let e=new FormData;if(r.file){let t=m(r.file);e.append(`file`,new Blob([t]),r.file.split(/[\\/]/).filter(Boolean).pop())}else r.body!==void 0&&e.append(`file`,r.body);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/gateway/lists/upload`,{body:e})),{successLabel:`Created`});return}if(r.body){let e=p(r.body,`body`,`binary`);o(await c(`Creating`,async()=>i(l,`POST`,`/accounts/${u}/gateway/lists/upload`,{body:e,headers:{"Content-Type":`multipart/form-data`}})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ap={command:`lists`,describe:`Operations for gateway.lists`,builder:e=>e.command(mp).command(gp).command(vp).command(bp).command(Tp).command(Dp).command(kp).command(Cp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function jp(e){return e.option(`client-default`,{type:`boolean`,description:`Indicate whether this location is the default location.`,default:!1}).option(`dns-destination-ips-id`,{type:`string`,description:`Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.`}).option(`ecs-support`,{type:`boolean`,description:`Indicate whether the location must resolve EDNS queries.`,default:!1}).option(`endpoints-doh-enabled`,{type:`boolean`,description:`Indicate whether the DOH endpoint is enabled for this location.`}).option(`endpoints-doh-require-token`,{type:`boolean`,description:`Specify whether the DOH endpoint requires user identity authentication.`}).option(`endpoints-dot-enabled`,{type:`boolean`,description:`Indicate whether the DOT endpoint is enabled for this location.`}).option(`endpoints-ipv4-enabled`,{type:`boolean`,description:`Indicate whether the IPv4 endpoint is enabled for this location.`}).option(`endpoints-ipv6-enabled`,{type:`boolean`,description:`Indicate whether the IPV6 endpoint is enabled for this location.`}).option(`max-ttl-mode`,{type:`string`,description:"`inherit` uses the account `max_ttl_secs`. `override` uses this location's `ttl_secs`. `disabled` leaves returned TTLs unchanged.",choices:[`inherit`,`override`,`disabled`]}).option(`max-ttl-ttl-secs`,{type:`number`,description:"Location-specific cap on DNS response TTLs, in seconds. Required when `mode` is `override`. Must be omitted when `mode` is `inherit` or `disabled`."}).option(`name`,{type:`string`,description:`Specify the location name.`}).option(`networks`,{type:`string`,description:`Specify the list of network ranges from which requests at this location originate. The list takes effect only if it is non-empty and the IPv4 endpoint is enabled for this location. Provide as a JSON array of objects or @path/to/file.json.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`max-ttl-mode`,`max-ttl-ttl-secs`].some(t=>e[t]!==void 0)){let t=[`max-ttl-mode`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --max_ttl-* flag is set`)}return!0})}const Mp={command:`create`,describe:`Create a new Zero Trust Gateway location.`,builder:jp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway locations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/locations`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({client_default:r[`client-default`],dns_destination_ips_id:p(r[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:r[`ecs-support`],endpoints:{doh:{enabled:r[`endpoints-doh-enabled`],require_token:r[`endpoints-doh-require-token`]},dot:{enabled:r[`endpoints-dot-enabled`]},ipv4:{enabled:r[`endpoints-ipv4-enabled`]},ipv6:{enabled:r[`endpoints-ipv6-enabled`]}},max_ttl:{mode:p(r[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:r[`max-ttl-ttl-secs`]},name:p(r.name,`name`,`text`),networks:d(r.networks,`networks`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.locations.create({...e,account_id:l})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await h(`name`,`Specify the location name.`));let m=f({client_default:r[`client-default`],dns_destination_ips_id:p(r[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:r[`ecs-support`],endpoints:{doh:{enabled:r[`endpoints-doh-enabled`],require_token:r[`endpoints-doh-require-token`]},dot:{enabled:r[`endpoints-dot-enabled`]},ipv4:{enabled:r[`endpoints-ipv4-enabled`]},ipv6:{enabled:r[`endpoints-ipv6-enabled`]}},max_ttl:{mode:p(r[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:r[`max-ttl-ttl-secs`]},name:p(r.name,`name`,`text`),networks:d(r.networks,`networks`)});o(await c(`Creating`,async()=>i.zeroTrust.gateway.locations.create({...m,account_id:l})),{successLabel:`Created`})}};function Np(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Pp={command:`delete <location-id>`,describe:`Delete a configured Zero Trust Gateway location.`,builder:Np,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway locations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/locations/${r[`location-id`]==null?`<location-id>`:encodeURIComponent(String(r[`location-id`]))}`,pathParams:{"location-id":String(r[`location-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.locations.delete({account_id:l,location_id:r[`location-id`]})),{successLabel:`Deleted`})}};function Fp(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ip={command:`get <location-id>`,describe:`Get a single Zero Trust Gateway location.`,builder:Fp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway locations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/locations/${r[`location-id`]==null?`<location-id>`:encodeURIComponent(String(r[`location-id`]))}`,pathParams:{"location-id":String(r[`location-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.locations.get({account_id:l,location_id:r[`location-id`]})),{successLabel:`Loaded`})}};function Lp(e){return e.option(`filter`,{type:`string`,description:"Filter the returned locations by one or more `field:value` pairs.\nRepeat the parameter to apply multiple filters; they are combined with\nlogical AND (a location must satisfy every filter to be returned).\n\nSupported fields and their matching behaviour:\n  * `name` — case-insensitive substring match on the location name.\n  * `id` — substring match on the location ID (UUID), with or without dashes.\n  * `is_default` — whether it is the default for the account.\n\nEach entry must match one of the per-field patterns below:\n  * the field must be one of `name`, `id`, or `is_default`;\n  * `name`/`id` accept any value;\n  * `is_default` only accepts `true` or `false`; any other value returns `400`"}).option(`search`,{type:`string`,description:"Case-insensitive substring match on the location name. When combined\nwith `filter`, both must match (logical AND)."}).option(`order-by`,{type:`string`,description:"Field to sort the returned locations by. When omitted, the order of\nresults is unspecified. Supported values:\n  * `name` — sort alphabetically by location name.\n  * `created_at` — sort by creation time; defaults to descending unless `direction` is set.\n  * `updated_at` — sort by last-modified time; defaults to descending unless `direction` is set.",choices:[`name`,`created_at`,`updated_at`]}).option(`direction`,{type:`string`,description:"Sort direction. Only takes effect when `order_by` is also provided; it\nis ignored otherwise. When `direction` is omitted the effective\ndirection is field-specific: `created_at` and `updated_at` default to\ndescending (newest first); `name` defaults to ascending.\n  * `asc` — ascending.\n  * `desc` — descending.",choices:[`asc`,`desc`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Rp={command:`list`,describe:`List Zero Trust Gateway locations for an account.`,builder:v(Lp),handler:async r=>{let i={filter:r.filter,search:r.search,order_by:r[`order-by`],direction:r.direction};if(r.dryRun){s({command:`cf zero-trust gateway locations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/locations`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.gateway.locations.list({account_id:u,...i})),{successLabel:`Loaded`})}};function zp(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`client-default`,{type:`boolean`,description:`Indicate whether this location is the default location.`}).option(`dns-destination-ips-id`,{type:`string`,description:`Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.`}).option(`ecs-support`,{type:`boolean`,description:`Indicate whether the location must resolve EDNS queries.`}).option(`endpoints-doh-enabled`,{type:`boolean`,description:`Indicate whether the DOH endpoint is enabled for this location.`}).option(`endpoints-doh-require-token`,{type:`boolean`,description:`Specify whether the DOH endpoint requires user identity authentication.`}).option(`endpoints-dot-enabled`,{type:`boolean`,description:`Indicate whether the DOT endpoint is enabled for this location.`}).option(`endpoints-ipv4-enabled`,{type:`boolean`,description:`Indicate whether the IPv4 endpoint is enabled for this location.`}).option(`endpoints-ipv6-enabled`,{type:`boolean`,description:`Indicate whether the IPV6 endpoint is enabled for this location.`}).option(`max-ttl-mode`,{type:`string`,description:"`inherit` uses the account `max_ttl_secs`. `override` uses this location's `ttl_secs`. `disabled` leaves returned TTLs unchanged.",choices:[`inherit`,`override`,`disabled`]}).option(`max-ttl-ttl-secs`,{type:`number`,description:"Location-specific cap on DNS response TTLs, in seconds. Required when `mode` is `override`. Must be omitted when `mode` is `inherit` or `disabled`."}).option(`name`,{type:`string`,description:`Specify the location name.`}).option(`networks`,{type:`string`,description:`Specify the list of network ranges from which requests at this location originate. The list takes effect only if it is non-empty and the IPv4 endpoint is enabled for this location. Provide as a JSON array of objects or @path/to/file.json.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`max-ttl-mode`,`max-ttl-ttl-secs`].some(t=>e[t]!==void 0)){let t=[`max-ttl-mode`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --max_ttl-* flag is set`)}return!0})}const Bp={command:`update <location-id>`,describe:`Update a configured Zero Trust Gateway location.`,builder:zp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway locations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/locations/${r[`location-id`]==null?`<location-id>`:encodeURIComponent(String(r[`location-id`]))}`,pathParams:{"location-id":String(r[`location-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({client_default:r[`client-default`],dns_destination_ips_id:p(r[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:r[`ecs-support`],endpoints:{doh:{enabled:r[`endpoints-doh-enabled`],require_token:r[`endpoints-doh-require-token`]},dot:{enabled:r[`endpoints-dot-enabled`]},ipv4:{enabled:r[`endpoints-ipv4-enabled`]},ipv6:{enabled:r[`endpoints-ipv6-enabled`]}},max_ttl:{mode:p(r[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:r[`max-ttl-ttl-secs`]},name:p(r.name,`name`,`text`),networks:d(r.networks,`networks`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.locations.update({...e,account_id:l,location_id:r[`location-id`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await h(`name`,`Specify the location name.`));let m=f({client_default:r[`client-default`],dns_destination_ips_id:p(r[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:r[`ecs-support`],endpoints:{doh:{enabled:r[`endpoints-doh-enabled`],require_token:r[`endpoints-doh-require-token`]},dot:{enabled:r[`endpoints-dot-enabled`]},ipv4:{enabled:r[`endpoints-ipv4-enabled`]},ipv6:{enabled:r[`endpoints-ipv6-enabled`]}},max_ttl:{mode:p(r[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:r[`max-ttl-ttl-secs`]},name:p(r.name,`name`,`text`),networks:d(r.networks,`networks`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.locations.update({...m,account_id:l,location_id:r[`location-id`]})),{successLabel:`Updated`})}},Vp={command:`locations`,describe:`Operations for gateway.locations`,builder:e=>e.command(Mp).command(Pp).command(Ip).command(Rp).command(Bp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Hp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Up={command:`get`,describe:`Retrieve the current logging settings for the Zero Trust account.`,builder:Hp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway logging get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/logging`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.logging.get({account_id:l})),{successLabel:`Loaded`})}};function Wp(e){return e.option(`redact-pii`,{type:`boolean`,description:`Indicate whether to redact personally identifiable information from activity logging (PII fields include source IP, user email, user ID, device ID, URL, referrer, and user agent).`}).option(`settings-by-rule-type-dns-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-dns-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`settings-by-rule-type-http-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-http-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`settings-by-rule-type-l4-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-l4-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Gp={command:`update`,describe:`Update logging settings for the current Zero Trust account.`,builder:Wp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway logging update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/logging`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({redact_pii:r[`redact-pii`],settings_by_rule_type:{dns:{log_all:r[`settings-by-rule-type-dns-log-all`],log_blocks:r[`settings-by-rule-type-dns-log-blocks`]},http:{log_all:r[`settings-by-rule-type-http-log-all`],log_blocks:r[`settings-by-rule-type-http-log-blocks`]},l4:{log_all:r[`settings-by-rule-type-l4-log-all`],log_blocks:r[`settings-by-rule-type-l4-log-blocks`]}}}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.logging.update({body:e,account_id:l})),{successLabel:`Updated`});return}let d=f({redact_pii:r[`redact-pii`],settings_by_rule_type:{dns:{log_all:r[`settings-by-rule-type-dns-log-all`],log_blocks:r[`settings-by-rule-type-dns-log-blocks`]},http:{log_all:r[`settings-by-rule-type-http-log-all`],log_blocks:r[`settings-by-rule-type-http-log-blocks`]},l4:{log_all:r[`settings-by-rule-type-l4-log-all`],log_blocks:r[`settings-by-rule-type-l4-log-blocks`]}}});o(await c(`Updating`,async()=>i.zeroTrust.gateway.logging.update({body:d,account_id:l})),{successLabel:`Updated`})}},Kp={command:`logging`,describe:`Operations for gateway.logging`,builder:e=>e.command(Up).command(Gp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function qp(e){return e.positional(`operation-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jp={command:`get <operation-id>`,describe:`Fetch a single Zero Trust Gateway operation by its ID.`,builder:qp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway operations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/operations/${r[`operation-id`]==null?`<operation-id>`:encodeURIComponent(String(r[`operation-id`]))}`,pathParams:{"operation-id":String(r[`operation-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.operations.get({account_id:l,operation_id:r[`operation-id`]})),{successLabel:`Loaded`})}};function Yp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xp={command:`list`,describe:`List all Zero Trust Gateway operations for an account.`,builder:Yp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway operations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/operations`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.operations.list({account_id:l})),{successLabel:`Loaded`})}},Zp={command:`operations`,describe:`Operations for gateway.operations`,builder:e=>e.command(Jp).command(Xp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qp(e){return e.option(`contents`,{type:`string`,description:`Actual contents of the PAC file`}).option(`description`,{type:`string`,description:`Detailed description of the PAC file.`}).option(`name`,{type:`string`,description:`Name of the PAC file.`}).option(`slug`,{type:`string`,description:`URL-friendly version of the PAC file name. If not provided, it will be auto-generated`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const $p={command:`create`,describe:`Create a new Zero Trust Gateway PAC file.`,builder:Qp,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway pacfiles create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/pacfiles`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({contents:p(r.contents,`contents`,`text`),description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`),slug:p(r.slug,`slug`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.pacfiles.create({...e,account_id:l})),{successLabel:`Created`});return}r.contents===void 0&&(r.contents=await h(`contents`,`Actual contents of the PAC file`)),r.name===void 0&&(r.name=await h(`name`,`Name of the PAC file.`));let d=f({contents:p(r.contents,`contents`,`text`),description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`),slug:p(r.slug,`slug`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.gateway.pacfiles.create({...d,account_id:l})),{successLabel:`Created`})}};function em(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const tm={command:`delete <pacfile-id>`,describe:`Delete a configured Zero Trust Gateway PAC file.`,builder:em,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway pacfiles delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/pacfiles/${r[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(r[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(r[`pacfile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.pacfiles.delete({account_id:l,pacfile_id:r[`pacfile-id`]})),{successLabel:`Deleted`})}};function nm(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const rm={command:`get <pacfile-id>`,describe:`Get a single Zero Trust Gateway PAC file.`,builder:nm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway pacfiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/pacfiles/${r[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(r[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(r[`pacfile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.pacfiles.get({account_id:l,pacfile_id:r[`pacfile-id`]})),{successLabel:`Loaded`})}};function im(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const am={command:`list`,describe:`List all Zero Trust Gateway PAC files for an account.`,builder:im,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway pacfiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/pacfiles`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.pacfiles.list({account_id:l})),{successLabel:`Loaded`})}};function om(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`contents`,{type:`string`,description:`Actual contents of the PAC file`}).option(`description`,{type:`string`,description:`Detailed description of the PAC file.`}).option(`name`,{type:`string`,description:`Name of the PAC file.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const sm={command:`update <pacfile-id>`,describe:`Update a configured Zero Trust Gateway PAC file.`,builder:om,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway pacfiles update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/pacfiles/${r[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(r[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(r[`pacfile-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({contents:p(r.contents,`contents`,`text`),description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.pacfiles.update({...e,account_id:l,pacfile_id:r[`pacfile-id`]})),{successLabel:`Updated`});return}r.contents===void 0&&(r.contents=await h(`contents`,`Actual contents of the PAC file`)),r.description===void 0&&(r.description=await h(`description`,`Detailed description of the PAC file.`)),r.name===void 0&&(r.name=await h(`name`,`Name of the PAC file.`));let d=f({contents:p(r.contents,`contents`,`text`),description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.pacfiles.update({...d,account_id:l,pacfile_id:r[`pacfile-id`]})),{successLabel:`Updated`})}},cm={command:`pacfiles`,describe:`Operations for gateway.pacfiles`,builder:e=>e.command($p).command(tm).command(rm).command(am).command(sm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function lm(e){return e.option(`kind`,{type:`string`,description:`The proxy endpoint kind.`,choices:[`ip`,`identity`],default:`ip`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const um={command:`create`,describe:`Create a new Zero Trust Gateway proxy endpoint.`,builder:lm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway proxy-endpoints create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/proxy_endpoints`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({kind:p(r.kind,`kind`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.proxyEndpoints.create({body:e,account_id:l})),{successLabel:`Created`});return}r.kind===`identity`&&r.kind===void 0&&(r.kind=await h(`kind`,`The proxy endpoint kind.`,{question:`Enter value for --kind`}));let d=f({kind:p(r.kind,`kind`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.gateway.proxyEndpoints.create({body:d,account_id:l})),{successLabel:`Created`})}};function dm(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const fm={command:`delete <proxy-endpoint-id>`,describe:`Delete a configured Zero Trust Gateway proxy endpoint.`,builder:dm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway proxy-endpoints delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/proxy_endpoints/${r[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(r[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(r[`proxy-endpoint-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.proxyEndpoints.delete({account_id:l,proxy_endpoint_id:r[`proxy-endpoint-id`]})),{successLabel:`Deleted`})}};function pm(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`ips`,{type:`string`,array:!0,description:`Specify the list of CIDRs to restrict ingress connections.`}).option(`name`,{type:`string`,description:`Specify the name of the proxy endpoint.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const mm={command:`edit <proxy-endpoint-id>`,describe:`Update a configured Zero Trust Gateway proxy endpoint.`,builder:pm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway proxy-endpoints edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/proxy_endpoints/${r[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(r[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(r[`proxy-endpoint-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({ips:r.ips,name:p(r.name,`name`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.proxyEndpoints.edit({...e,account_id:l,proxy_endpoint_id:r[`proxy-endpoint-id`]})),{successLabel:`Updated`});return}let d=f({ips:r.ips,name:p(r.name,`name`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.proxyEndpoints.edit({...d,account_id:l,proxy_endpoint_id:r[`proxy-endpoint-id`]})),{successLabel:`Updated`})}};function hm(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gm={command:`get <proxy-endpoint-id>`,describe:`Get a single Zero Trust Gateway proxy endpoint.`,builder:hm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway proxy-endpoints get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/proxy_endpoints/${r[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(r[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(r[`proxy-endpoint-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.proxyEndpoints.get({account_id:l,proxy_endpoint_id:r[`proxy-endpoint-id`]})),{successLabel:`Loaded`})}};function _m(e){return e.option(`filter`,{type:`string`,description:"Filter the returned proxy endpoints by one or more `field:value` pairs.\nRepeat the parameter to apply multiple filters; they are combined with\nlogical AND (an endpoint must satisfy every filter to be returned).\n\nSupported fields and their matching behaviour:\n  * `name` — case-insensitive substring match on the endpoint name.\n  * `id` — substring match on the endpoint ID (UUID), with or without dashes.\n  * `kind` — exact match on the endpoint kind. The value must be `ip` or `identity`; any other value returns `400`.\n\nEach entry must match one of the per-field patterns below: the field\nmust be one of `name`, `id`, or `kind`; `name`/`id` accept any value,\nwhile `kind` only accepts `ip` or `identity`."}).option(`search`,{type:`string`,description:"Case-insensitive substring match on the endpoint name. When combined\nwith `filter`, both must match (logical AND)."}).option(`order-by`,{type:`string`,description:"Field to sort the returned endpoints by. When omitted, the order of\nresults is unspecified. Supported values:\n  * `name` — sort alphabetically by endpoint name.\n  * `created_at` — sort by creation time; defaults to descending unless `direction` is set.\n  * `updated_at` — sort by last-modified time; defaults to descending unless `direction` is set.",choices:[`name`,`created_at`,`updated_at`]}).option(`direction`,{type:`string`,description:"Sort direction. Only takes effect when `order_by` is also provided; it\nis ignored otherwise. When `direction` is omitted the effective\ndirection is field-specific: `created_at` and `updated_at` default to\ndescending (newest first); `name` defaults to ascending.\n  * `asc` — ascending.\n  * `desc` — descending.",choices:[`asc`,`desc`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const vm={command:`list`,describe:`List all Zero Trust Gateway proxy endpoints for an account.`,builder:v(_m),handler:async r=>{let i={filter:r.filter,search:r.search,order_by:r[`order-by`],direction:r.direction};if(r.dryRun){s({command:`cf zero-trust gateway proxy-endpoints list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/proxy_endpoints`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.gateway.proxyEndpoints.list({account_id:u,...i})),{successLabel:`Loaded`})}},ym={command:`proxy-endpoints`,describe:`Operations for gateway.proxy-endpoints`,builder:e=>e.command(um).command(fm).command(mm).command(gm).command(vm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bm(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xm={command:`bulk-edit`,describe:`Update select fields of multiple Zero Trust Gateway rules in a single request. This is commonly used to reorder rules by updating their precedence values. Only the fields provided for each rule are updated.`,builder:bm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules bulk-edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.rules.bulkEdit({body:e,account_id:l})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Sm(e){return e.option(`action`,{type:`string`,description:"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",choices:[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`]}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`device-posture`,{type:`string`,description:`Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`,default:!1}).option(`expiration-duration`,{type:`number`,description:"Defines the default duration a policy active in minutes. Must set in order to use the `reset_expiration` endpoint on this rule."}).option(`filters`,{type:`string`,array:!0,description:`Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.`}).option(`identity`,{type:`string`,description:`Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`rule-settings-allow-child-bypass`,{type:`boolean`,description:`Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.`}).option(`rule-settings-audit-ssh-command-logging`,{type:`boolean`,description:`Enable SSH command logging.`}).option(`rule-settings-biso-admin-controls-copy`,{type:`string`,description:`Configure copy behavior. If set to remote_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dcp`,{type:`boolean`,description:'Set to false to enable copy-pasting. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dd`,{type:`boolean`,description:'Set to false to enable downloading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dk`,{type:`boolean`,description:'Set to false to enable keyboard usage. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-download`,{type:`string`,description:`Configure download behavior. When set to remote_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dp`,{type:`boolean`,description:'Set to false to enable printing. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-du`,{type:`boolean`,description:'Set to false to enable uploading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-keyboard`,{type:`string`,description:`Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-paste`,{type:`string`,description:`Configure paste behavior. If set to remote_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-printing`,{type:`string`,description:`Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-upload`,{type:`string`,description:`Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-version`,{type:`string`,description:`Indicate which version of the browser isolation controls should apply.`,choices:[`v1`,`v2`]}).option(`rule-settings-biso-admin-controls-wm-id`,{type:`string`,description:`Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser.`}).option(`rule-settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-block-page-enabled`,{type:`boolean`,description:"Enable the custom block page. Settable only for `dns` rules with action `block`."}).option(`rule-settings-block-reason`,{type:`string`,description:"Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`."}).option(`rule-settings-bypass-parent-rule`,{type:`boolean`,description:`Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.`}).option(`rule-settings-check-session-duration`,{type:`string`,description:`Sets the required session freshness threshold. The API returns a normalized version of this value.`}).option(`rule-settings-check-session-enforce`,{type:`boolean`,description:`Enable session enforcement.`}).option(`rule-settings-delete-headers`,{type:`string`,array:!0,description:"Remove headers from allowed requests by name. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes. Settable only for `http` rules with the action set to `allow`."}).option(`rule-settings-egress-ipv4`,{type:`string`,description:`Specify the IPv4 address to use for egress.`}).option(`rule-settings-egress-ipv4-fallback`,{type:`string`,description:`Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.`}).option(`rule-settings-egress-ipv6`,{type:`string`,description:`Specify the IPv6 range to use for egress.`}).option(`rule-settings-forensic-copy-enabled`,{type:`boolean`,description:`Enable sending the copy to storage.`}).option(`rule-settings-ignore-cname-category-matches`,{type:`boolean`,description:"Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-insecure-disable-dnssec-validation`,{type:`boolean`,description:"Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules."}).option(`rule-settings-ip-categories`,{type:`boolean`,description:"Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-ip-indicator-feeds`,{type:`boolean`,description:"Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-l4override-ip`,{type:`string`,description:`Defines the IPv4 or IPv6 address.`}).option(`rule-settings-l4override-port`,{type:`number`,description:`Defines a port number to use for TCP/UDP overrides.`}).option(`rule-settings-notification-settings-enabled`,{type:`boolean`,description:`Enable notification.`}).option(`rule-settings-notification-settings-include-context`,{type:`boolean`,description:`Indicates whether to pass the context information as query parameters.`}).option(`rule-settings-notification-settings-msg`,{type:`string`,description:`Customize the message shown in the notification.`}).option(`rule-settings-notification-settings-support-url`,{type:`string`,description:`Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.`}).option(`rule-settings-override-host`,{type:`string`,description:"Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-override-ips`,{type:`string`,array:!0,description:"Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-payload-log-enabled`,{type:`boolean`,description:`Enable DLP payload logging for this rule.`}).option(`rule-settings-quarantine-file-types`,{type:`string`,array:!0,description:`Specify the types of files to sandbox.`}).option(`rule-settings-redirect-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-redirect-preserve-path-and-query`,{type:`boolean`,description:`Specify whether to append the path and query parameters from the original request to target_uri.`}).option(`rule-settings-redirect-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-resolve-dns-internally-fallback`,{type:`string`,description:`Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.`,choices:[`none`,`public_dns`]}).option(`rule-settings-resolve-dns-internally-view-id`,{type:`string`,description:`Specify the internal DNS view identifier to pass to the internal DNS service.`}).option(`rule-settings-resolve-dns-through-cloudflare`,{type:`boolean`,description:"Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dns_resolver` rules."}).option(`rule-settings-untrusted-cert-action`,{type:`string`,description:`Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.`,choices:[`pass_through`,`block`,`error`]}).option(`schedule-fri`,{type:`string`,description:`Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-mon`,{type:`string`,description:`Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sat`,{type:`string`,description:`Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sun`,{type:`string`,description:`Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-thu`,{type:`string`,description:`Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-time-zone`,{type:`string`,description:`Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.`}).option(`schedule-tue`,{type:`string`,description:`Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-wed`,{type:`string`,description:`Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`traffic`,{type:`string`,description:`Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if(`rule-settings-allow-child-bypass.rule-settings-audit-ssh-command-logging.rule-settings-biso-admin-controls-copy.rule-settings-biso-admin-controls-dcp.rule-settings-biso-admin-controls-dd.rule-settings-biso-admin-controls-dk.rule-settings-biso-admin-controls-download.rule-settings-biso-admin-controls-dp.rule-settings-biso-admin-controls-du.rule-settings-biso-admin-controls-keyboard.rule-settings-biso-admin-controls-paste.rule-settings-biso-admin-controls-printing.rule-settings-biso-admin-controls-upload.rule-settings-biso-admin-controls-version.rule-settings-biso-admin-controls-wm-id.rule-settings-block-page-include-context.rule-settings-block-page-target-uri.rule-settings-block-page-enabled.rule-settings-block-reason.rule-settings-bypass-parent-rule.rule-settings-check-session-duration.rule-settings-check-session-enforce.rule-settings-delete-headers.rule-settings-egress-ipv4.rule-settings-egress-ipv4-fallback.rule-settings-egress-ipv6.rule-settings-forensic-copy-enabled.rule-settings-ignore-cname-category-matches.rule-settings-insecure-disable-dnssec-validation.rule-settings-ip-categories.rule-settings-ip-indicator-feeds.rule-settings-l4override-ip.rule-settings-l4override-port.rule-settings-notification-settings-enabled.rule-settings-notification-settings-include-context.rule-settings-notification-settings-msg.rule-settings-notification-settings-support-url.rule-settings-override-host.rule-settings-override-ips.rule-settings-payload-log-enabled.rule-settings-quarantine-file-types.rule-settings-redirect-include-context.rule-settings-redirect-preserve-path-and-query.rule-settings-redirect-target-uri.rule-settings-resolve-dns-internally-fallback.rule-settings-resolve-dns-internally-view-id.rule-settings-resolve-dns-through-cloudflare.rule-settings-untrusted-cert-action`.split(`.`).some(t=>e[t]!==void 0)){let t=[`rule-settings-block-page-target-uri`,`rule-settings-redirect-target-uri`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --rule_settings-* flag is set`)}return!0})}const Cm={command:`create`,describe:`Create a new Zero Trust Gateway rule.`,builder:Sm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({action:p(r.action,`action`,`text`),description:p(r.description,`description`,`text`),device_posture:p(r[`device-posture`],`device-posture`,`text`),enabled:r.enabled,expiration:{duration:r[`expiration-duration`]},filters:r.filters,identity:p(r.identity,`identity`,`text`),name:p(r.name,`name`,`text`),precedence:r.precedence,rule_settings:{allow_child_bypass:r[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:r[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:p(r[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:r[`rule-settings-biso-admin-controls-dcp`],dd:r[`rule-settings-biso-admin-controls-dd`],dk:r[`rule-settings-biso-admin-controls-dk`],download:p(r[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:r[`rule-settings-biso-admin-controls-dp`],du:r[`rule-settings-biso-admin-controls-du`],keyboard:p(r[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:p(r[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:p(r[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:p(r[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:p(r[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:p(r[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:r[`rule-settings-block-page-include-context`],target_uri:p(r[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:r[`rule-settings-block-page-enabled`],block_reason:p(r[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:r[`rule-settings-bypass-parent-rule`],check_session:{duration:p(r[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:r[`rule-settings-check-session-enforce`]},delete_headers:r[`rule-settings-delete-headers`],egress:{ipv4:p(r[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:p(r[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:p(r[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:r[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:r[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:r[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:r[`rule-settings-ip-categories`],ip_indicator_feeds:r[`rule-settings-ip-indicator-feeds`],l4override:{ip:p(r[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:r[`rule-settings-l4override-port`]},notification_settings:{enabled:r[`rule-settings-notification-settings-enabled`],include_context:r[`rule-settings-notification-settings-include-context`],msg:p(r[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:p(r[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:p(r[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:r[`rule-settings-override-ips`],payload_log:{enabled:r[`rule-settings-payload-log-enabled`]},quarantine:{file_types:r[`rule-settings-quarantine-file-types`]},redirect:{include_context:r[`rule-settings-redirect-include-context`],preserve_path_and_query:r[`rule-settings-redirect-preserve-path-and-query`],target_uri:p(r[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:p(r[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:p(r[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:r[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:p(r[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:p(r[`schedule-fri`],`schedule-fri`,`text`),mon:p(r[`schedule-mon`],`schedule-mon`,`text`),sat:p(r[`schedule-sat`],`schedule-sat`,`text`),sun:p(r[`schedule-sun`],`schedule-sun`,`text`),thu:p(r[`schedule-thu`],`schedule-thu`,`text`),time_zone:p(r[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:p(r[`schedule-tue`],`schedule-tue`,`text`),wed:p(r[`schedule-wed`],`schedule-wed`,`text`)},traffic:p(r.traffic,`traffic`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.gateway.rules.create({...e,account_id:l})),{successLabel:`Created`});return}r.action===void 0&&(r.action=await g(`action`,"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`])),r.name===void 0&&(r.name=await h(`name`,`Specify the rule name.`));let d=f({action:p(r.action,`action`,`text`),description:p(r.description,`description`,`text`),device_posture:p(r[`device-posture`],`device-posture`,`text`),enabled:r.enabled,expiration:{duration:r[`expiration-duration`]},filters:r.filters,identity:p(r.identity,`identity`,`text`),name:p(r.name,`name`,`text`),precedence:r.precedence,rule_settings:{allow_child_bypass:r[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:r[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:p(r[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:r[`rule-settings-biso-admin-controls-dcp`],dd:r[`rule-settings-biso-admin-controls-dd`],dk:r[`rule-settings-biso-admin-controls-dk`],download:p(r[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:r[`rule-settings-biso-admin-controls-dp`],du:r[`rule-settings-biso-admin-controls-du`],keyboard:p(r[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:p(r[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:p(r[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:p(r[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:p(r[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:p(r[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:r[`rule-settings-block-page-include-context`],target_uri:p(r[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:r[`rule-settings-block-page-enabled`],block_reason:p(r[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:r[`rule-settings-bypass-parent-rule`],check_session:{duration:p(r[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:r[`rule-settings-check-session-enforce`]},delete_headers:r[`rule-settings-delete-headers`],egress:{ipv4:p(r[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:p(r[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:p(r[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:r[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:r[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:r[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:r[`rule-settings-ip-categories`],ip_indicator_feeds:r[`rule-settings-ip-indicator-feeds`],l4override:{ip:p(r[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:r[`rule-settings-l4override-port`]},notification_settings:{enabled:r[`rule-settings-notification-settings-enabled`],include_context:r[`rule-settings-notification-settings-include-context`],msg:p(r[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:p(r[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:p(r[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:r[`rule-settings-override-ips`],payload_log:{enabled:r[`rule-settings-payload-log-enabled`]},quarantine:{file_types:r[`rule-settings-quarantine-file-types`]},redirect:{include_context:r[`rule-settings-redirect-include-context`],preserve_path_and_query:r[`rule-settings-redirect-preserve-path-and-query`],target_uri:p(r[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:p(r[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:p(r[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:r[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:p(r[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:p(r[`schedule-fri`],`schedule-fri`,`text`),mon:p(r[`schedule-mon`],`schedule-mon`,`text`),sat:p(r[`schedule-sat`],`schedule-sat`,`text`),sun:p(r[`schedule-sun`],`schedule-sun`,`text`),thu:p(r[`schedule-thu`],`schedule-thu`,`text`),time_zone:p(r[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:p(r[`schedule-tue`],`schedule-tue`,`text`),wed:p(r[`schedule-wed`],`schedule-wed`,`text`)},traffic:p(r.traffic,`traffic`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.gateway.rules.create({...d,account_id:l})),{successLabel:`Created`})}};function wm(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Tm={command:`delete <rule-id>`,describe:`Delete a Zero Trust Gateway rule.`,builder:wm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.gateway.rules.delete({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Deleted`})}};function Em(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Dm={command:`edit <rule-id>`,describe:"Update select fields of an existing Zero Trust Gateway rule. Only the fields provided in the request body are updated. This endpoint supports a limited subset of fields (`name`, `description`, `precedence`, `enabled`). To update other fields such as `action`, `traffic`, `identity`, `device_posture`, `rule_settings`, `schedule`, or `expiration`, use the PUT endpoint for a full rule replacement.",builder:Em,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({description:p(r.description,`description`,`text`),enabled:r.enabled,name:p(r.name,`name`,`text`),precedence:r.precedence}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.rules.edit({...e,account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}let d=f({description:p(r.description,`description`,`text`),enabled:r.enabled,name:p(r.name,`name`,`text`),precedence:r.precedence});o(await c(`Updating`,async()=>i.zeroTrust.gateway.rules.edit({...d,account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}};function Om(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const km={command:`get <rule-id>`,describe:`Get a single Zero Trust Gateway rule.`,builder:Om,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.rules.get({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Loaded`})}};function Am(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const jm={command:`list-tenant`,describe:`List Zero Trust Gateway rules for the parent account of an account in the MSP configuration.`,builder:Am,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules list-tenant`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/tenant`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.gateway.rules.listTenant({account_id:l})),{successLabel:`Loaded`})}};function Mm(e){return e.option(`filter`,{type:`string`,description:"Filter the returned rules by one or more `field:value` pairs. Repeat the\nparameter to combine filters with logical AND.\n\nSupported fields are `name`, `id`, `action`, `enabled`, `source_account`,\n`is_shared`, `filters`, and `expression` (max 1024 bytes). The `source_account`\nvalue is matched as a normalized UUID substring. The `filters` value must\nbe one of the rule filter names and matches a member of the rule's `filters`\narray. The `expression` filter performs a case-insensitive literal\nsubstring match across traffic, identity, and device posture expressions."}).option(`search`,{type:`string`,description:`Case-insensitive substring search across rule name and description.`}).option(`order-by`,{type:`string`,description:"Field to sort the returned rules by. Supported values are `name`,\n`created_at`, `updated_at`, and `precedence`.",choices:[`name`,`created_at`,`updated_at`,`precedence`]}).option(`direction`,{type:`string`,description:"Sort direction. When `order_by` is omitted, this controls the direction\nof the existing precedence ordering. Shared rules remain first in either\ndirection. Accepted values are `asc` and `desc`.",choices:[`asc`,`desc`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Nm={command:`list`,describe:`List Zero Trust Gateway rules for an account.`,builder:v(Mm),handler:async r=>{let i={filter:r.filter,search:r.search,order_by:r[`order-by`],direction:r.direction};if(r.dryRun){s({command:`cf zero-trust gateway rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules`,pathParams:{},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.gateway.rules.list({account_id:u,...i})),{successLabel:`Loaded`})}};function Pm(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fm={command:`reset-expiration <rule-id>`,describe:"Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and it has a default duration. The Zero Trust Gateway Rule must have values for both `expiration.expires_at` and `expiration.duration`.",builder:Pm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules reset-expiration`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}/reset_expiration`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.gateway.rules.resetExpiration({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Created`})}};function Im(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`action`,{type:`string`,description:"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",choices:[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`]}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`device-posture`,{type:`string`,description:`Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`}).option(`expiration-duration`,{type:`number`,description:"Defines the default duration a policy active in minutes. Must set in order to use the `reset_expiration` endpoint on this rule."}).option(`filters`,{type:`string`,array:!0,description:`Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.`}).option(`identity`,{type:`string`,description:`Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`rule-settings-allow-child-bypass`,{type:`boolean`,description:`Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.`}).option(`rule-settings-audit-ssh-command-logging`,{type:`boolean`,description:`Enable SSH command logging.`}).option(`rule-settings-biso-admin-controls-copy`,{type:`string`,description:`Configure copy behavior. If set to remote_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dcp`,{type:`boolean`,description:'Set to false to enable copy-pasting. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dd`,{type:`boolean`,description:'Set to false to enable downloading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dk`,{type:`boolean`,description:'Set to false to enable keyboard usage. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-download`,{type:`string`,description:`Configure download behavior. When set to remote_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dp`,{type:`boolean`,description:'Set to false to enable printing. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-du`,{type:`boolean`,description:'Set to false to enable uploading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-keyboard`,{type:`string`,description:`Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-paste`,{type:`string`,description:`Configure paste behavior. If set to remote_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-printing`,{type:`string`,description:`Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-upload`,{type:`string`,description:`Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-version`,{type:`string`,description:`Indicate which version of the browser isolation controls should apply.`,choices:[`v1`,`v2`]}).option(`rule-settings-biso-admin-controls-wm-id`,{type:`string`,description:`Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser.`}).option(`rule-settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-block-page-enabled`,{type:`boolean`,description:"Enable the custom block page. Settable only for `dns` rules with action `block`."}).option(`rule-settings-block-reason`,{type:`string`,description:"Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`."}).option(`rule-settings-bypass-parent-rule`,{type:`boolean`,description:`Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.`}).option(`rule-settings-check-session-duration`,{type:`string`,description:`Sets the required session freshness threshold. The API returns a normalized version of this value.`}).option(`rule-settings-check-session-enforce`,{type:`boolean`,description:`Enable session enforcement.`}).option(`rule-settings-delete-headers`,{type:`string`,array:!0,description:"Remove headers from allowed requests by name. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes. Settable only for `http` rules with the action set to `allow`."}).option(`rule-settings-egress-ipv4`,{type:`string`,description:`Specify the IPv4 address to use for egress.`}).option(`rule-settings-egress-ipv4-fallback`,{type:`string`,description:`Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.`}).option(`rule-settings-egress-ipv6`,{type:`string`,description:`Specify the IPv6 range to use for egress.`}).option(`rule-settings-forensic-copy-enabled`,{type:`boolean`,description:`Enable sending the copy to storage.`}).option(`rule-settings-ignore-cname-category-matches`,{type:`boolean`,description:"Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-insecure-disable-dnssec-validation`,{type:`boolean`,description:"Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules."}).option(`rule-settings-ip-categories`,{type:`boolean`,description:"Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-ip-indicator-feeds`,{type:`boolean`,description:"Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-l4override-ip`,{type:`string`,description:`Defines the IPv4 or IPv6 address.`}).option(`rule-settings-l4override-port`,{type:`number`,description:`Defines a port number to use for TCP/UDP overrides.`}).option(`rule-settings-notification-settings-enabled`,{type:`boolean`,description:`Enable notification.`}).option(`rule-settings-notification-settings-include-context`,{type:`boolean`,description:`Indicates whether to pass the context information as query parameters.`}).option(`rule-settings-notification-settings-msg`,{type:`string`,description:`Customize the message shown in the notification.`}).option(`rule-settings-notification-settings-support-url`,{type:`string`,description:`Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.`}).option(`rule-settings-override-host`,{type:`string`,description:"Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-override-ips`,{type:`string`,array:!0,description:"Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-payload-log-enabled`,{type:`boolean`,description:`Enable DLP payload logging for this rule.`}).option(`rule-settings-quarantine-file-types`,{type:`string`,array:!0,description:`Specify the types of files to sandbox.`}).option(`rule-settings-redirect-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-redirect-preserve-path-and-query`,{type:`boolean`,description:`Specify whether to append the path and query parameters from the original request to target_uri.`}).option(`rule-settings-redirect-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-resolve-dns-internally-fallback`,{type:`string`,description:`Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.`,choices:[`none`,`public_dns`]}).option(`rule-settings-resolve-dns-internally-view-id`,{type:`string`,description:`Specify the internal DNS view identifier to pass to the internal DNS service.`}).option(`rule-settings-resolve-dns-through-cloudflare`,{type:`boolean`,description:"Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dns_resolver` rules."}).option(`rule-settings-untrusted-cert-action`,{type:`string`,description:`Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.`,choices:[`pass_through`,`block`,`error`]}).option(`schedule-fri`,{type:`string`,description:`Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-mon`,{type:`string`,description:`Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sat`,{type:`string`,description:`Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sun`,{type:`string`,description:`Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-thu`,{type:`string`,description:`Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-time-zone`,{type:`string`,description:`Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.`}).option(`schedule-tue`,{type:`string`,description:`Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-wed`,{type:`string`,description:`Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`traffic`,{type:`string`,description:`Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if(`rule-settings-allow-child-bypass.rule-settings-audit-ssh-command-logging.rule-settings-biso-admin-controls-copy.rule-settings-biso-admin-controls-dcp.rule-settings-biso-admin-controls-dd.rule-settings-biso-admin-controls-dk.rule-settings-biso-admin-controls-download.rule-settings-biso-admin-controls-dp.rule-settings-biso-admin-controls-du.rule-settings-biso-admin-controls-keyboard.rule-settings-biso-admin-controls-paste.rule-settings-biso-admin-controls-printing.rule-settings-biso-admin-controls-upload.rule-settings-biso-admin-controls-version.rule-settings-biso-admin-controls-wm-id.rule-settings-block-page-include-context.rule-settings-block-page-target-uri.rule-settings-block-page-enabled.rule-settings-block-reason.rule-settings-bypass-parent-rule.rule-settings-check-session-duration.rule-settings-check-session-enforce.rule-settings-delete-headers.rule-settings-egress-ipv4.rule-settings-egress-ipv4-fallback.rule-settings-egress-ipv6.rule-settings-forensic-copy-enabled.rule-settings-ignore-cname-category-matches.rule-settings-insecure-disable-dnssec-validation.rule-settings-ip-categories.rule-settings-ip-indicator-feeds.rule-settings-l4override-ip.rule-settings-l4override-port.rule-settings-notification-settings-enabled.rule-settings-notification-settings-include-context.rule-settings-notification-settings-msg.rule-settings-notification-settings-support-url.rule-settings-override-host.rule-settings-override-ips.rule-settings-payload-log-enabled.rule-settings-quarantine-file-types.rule-settings-redirect-include-context.rule-settings-redirect-preserve-path-and-query.rule-settings-redirect-target-uri.rule-settings-resolve-dns-internally-fallback.rule-settings-resolve-dns-internally-view-id.rule-settings-resolve-dns-through-cloudflare.rule-settings-untrusted-cert-action`.split(`.`).some(t=>e[t]!==void 0)){let t=[`rule-settings-block-page-target-uri`,`rule-settings-redirect-target-uri`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --rule_settings-* flag is set`)}return!0})}const Lm={command:`update <rule-id>`,describe:`Update a configured Zero Trust Gateway rule.`,builder:Im,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust gateway rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/gateway/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({action:p(r.action,`action`,`text`),description:p(r.description,`description`,`text`),device_posture:p(r[`device-posture`],`device-posture`,`text`),enabled:r.enabled,expiration:{duration:r[`expiration-duration`]},filters:r.filters,identity:p(r.identity,`identity`,`text`),name:p(r.name,`name`,`text`),precedence:r.precedence,rule_settings:{allow_child_bypass:r[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:r[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:p(r[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:r[`rule-settings-biso-admin-controls-dcp`],dd:r[`rule-settings-biso-admin-controls-dd`],dk:r[`rule-settings-biso-admin-controls-dk`],download:p(r[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:r[`rule-settings-biso-admin-controls-dp`],du:r[`rule-settings-biso-admin-controls-du`],keyboard:p(r[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:p(r[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:p(r[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:p(r[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:p(r[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:p(r[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:r[`rule-settings-block-page-include-context`],target_uri:p(r[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:r[`rule-settings-block-page-enabled`],block_reason:p(r[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:r[`rule-settings-bypass-parent-rule`],check_session:{duration:p(r[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:r[`rule-settings-check-session-enforce`]},delete_headers:r[`rule-settings-delete-headers`],egress:{ipv4:p(r[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:p(r[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:p(r[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:r[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:r[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:r[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:r[`rule-settings-ip-categories`],ip_indicator_feeds:r[`rule-settings-ip-indicator-feeds`],l4override:{ip:p(r[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:r[`rule-settings-l4override-port`]},notification_settings:{enabled:r[`rule-settings-notification-settings-enabled`],include_context:r[`rule-settings-notification-settings-include-context`],msg:p(r[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:p(r[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:p(r[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:r[`rule-settings-override-ips`],payload_log:{enabled:r[`rule-settings-payload-log-enabled`]},quarantine:{file_types:r[`rule-settings-quarantine-file-types`]},redirect:{include_context:r[`rule-settings-redirect-include-context`],preserve_path_and_query:r[`rule-settings-redirect-preserve-path-and-query`],target_uri:p(r[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:p(r[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:p(r[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:r[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:p(r[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:p(r[`schedule-fri`],`schedule-fri`,`text`),mon:p(r[`schedule-mon`],`schedule-mon`,`text`),sat:p(r[`schedule-sat`],`schedule-sat`,`text`),sun:p(r[`schedule-sun`],`schedule-sun`,`text`),thu:p(r[`schedule-thu`],`schedule-thu`,`text`),time_zone:p(r[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:p(r[`schedule-tue`],`schedule-tue`,`text`),wed:p(r[`schedule-wed`],`schedule-wed`,`text`)},traffic:p(r.traffic,`traffic`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.gateway.rules.update({...e,account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}r.action===void 0&&(r.action=await g(`action`,"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`])),r.name===void 0&&(r.name=await h(`name`,`Specify the rule name.`));let d=f({action:p(r.action,`action`,`text`),description:p(r.description,`description`,`text`),device_posture:p(r[`device-posture`],`device-posture`,`text`),enabled:r.enabled,expiration:{duration:r[`expiration-duration`]},filters:r.filters,identity:p(r.identity,`identity`,`text`),name:p(r.name,`name`,`text`),precedence:r.precedence,rule_settings:{allow_child_bypass:r[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:r[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:p(r[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:r[`rule-settings-biso-admin-controls-dcp`],dd:r[`rule-settings-biso-admin-controls-dd`],dk:r[`rule-settings-biso-admin-controls-dk`],download:p(r[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:r[`rule-settings-biso-admin-controls-dp`],du:r[`rule-settings-biso-admin-controls-du`],keyboard:p(r[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:p(r[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:p(r[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:p(r[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:p(r[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:p(r[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:r[`rule-settings-block-page-include-context`],target_uri:p(r[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:r[`rule-settings-block-page-enabled`],block_reason:p(r[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:r[`rule-settings-bypass-parent-rule`],check_session:{duration:p(r[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:r[`rule-settings-check-session-enforce`]},delete_headers:r[`rule-settings-delete-headers`],egress:{ipv4:p(r[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:p(r[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:p(r[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:r[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:r[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:r[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:r[`rule-settings-ip-categories`],ip_indicator_feeds:r[`rule-settings-ip-indicator-feeds`],l4override:{ip:p(r[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:r[`rule-settings-l4override-port`]},notification_settings:{enabled:r[`rule-settings-notification-settings-enabled`],include_context:r[`rule-settings-notification-settings-include-context`],msg:p(r[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:p(r[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:p(r[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:r[`rule-settings-override-ips`],payload_log:{enabled:r[`rule-settings-payload-log-enabled`]},quarantine:{file_types:r[`rule-settings-quarantine-file-types`]},redirect:{include_context:r[`rule-settings-redirect-include-context`],preserve_path_and_query:r[`rule-settings-redirect-preserve-path-and-query`],target_uri:p(r[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:p(r[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:p(r[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:r[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:p(r[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:p(r[`schedule-fri`],`schedule-fri`,`text`),mon:p(r[`schedule-mon`],`schedule-mon`,`text`),sat:p(r[`schedule-sat`],`schedule-sat`,`text`),sun:p(r[`schedule-sun`],`schedule-sun`,`text`),thu:p(r[`schedule-thu`],`schedule-thu`,`text`),time_zone:p(r[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:p(r[`schedule-tue`],`schedule-tue`,`text`),wed:p(r[`schedule-wed`],`schedule-wed`,`text`)},traffic:p(r.traffic,`traffic`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.gateway.rules.update({...d,account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},Rm={command:`rules`,describe:`Operations for gateway.rules`,builder:e=>e.command(xm).command(Cm).command(Tm).command(Dm).command(km).command(Nm).command(jm).command(Fm).command(Lm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},zm={command:`gateway`,describe:`Operations for gateway`,builder:e=>e.command(ip).command(fp).command(Cf).command(Af).command(Nf).command(Kf).command(np).command(sp).command(up).command(Ap).command(Vp).command(Kp).command(Zp).command(cm).command(ym).command(Rm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bm(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Vm={command:`create`,describe:`Adds a new identity provider to Access.`,builder:Bm,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust identity-providers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/identity_providers`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?void 0:u(i.body)});return}let l=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=f:i.accountId=f,i.body){let e=u(i.body);o(await c(`Creating`,async()=>l.zeroTrust.identityProviders.create({body:e,account_or_zone:d,account_or_zone_id:f})),{successLabel:`Created`});return}if(i.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Hm(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Um={command:`delete <identity-provider-id>`,describe:`Deletes an identity provider from Access.`,builder:Hm,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust identity-providers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/identity_providers/${i[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(i[`identity-provider-id`]))}`,pathParams:{"account-or-zone":String(t),"identity-provider-id":String(i[`identity-provider-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(u===`zones`?i.zoneId=d:i.accountId=d,!await _({force:!!i.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>l.zeroTrust.identityProviders.delete({account_or_zone:u,account_or_zone_id:d,identity_provider_id:i[`identity-provider-id`]})),{successLabel:`Deleted`})}};function Wm(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gm={command:`get <identity-provider-id>`,describe:`Fetches a configured identity provider.`,builder:Wm,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust identity-providers get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/identity_providers/${i[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(i[`identity-provider-id`]))}`,pathParams:{"account-or-zone":String(t),"identity-provider-id":String(i[`identity-provider-id`]??``),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.identityProviders.get({account_or_zone:u,account_or_zone_id:d,identity_provider_id:i[`identity-provider-id`]})),{successLabel:`Loaded`})}};function Km(e){return e.option(`scim-enabled`,{type:`string`,description:`Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qm={command:`list`,describe:`Lists all configured identity providers.`,builder:Km,handler:async i=>{let l={scim_enabled:i[`scim-enabled`],page:i.page,per_page:i[`per-page`]};if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust identity-providers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/identity_providers`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},query:l,bodyKind:`none`});return}let u=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},u,{quiet:i.quiet}):i.local?e:await t();d===`zones`?i.zoneId=f:i.accountId=f,o(await c(`Loading`,async()=>u.zeroTrust.identityProviders.list({account_or_zone:d,account_or_zone_id:f,...l})),{successLabel:`Loaded`})}};function Jm(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ym={command:`create <identity-provider-id>`,describe:"Creates a new SAML encryption certificate set and assigns it to the specified SAML Identity Provider. This endpoint is idempotent - if the IdP already has a certificate set assigned, the existing certificate set is returned with a 200 status. **Workflow for enabling SAML encryption:** 1. Call this endpoint to create and assign a certificate set to the IdP 2. Update the IdP configuration (PUT `/identity_providers/{id}`) with: - `config.enable_encryption: true` - `saml_certificate_set_id: <uid from step 1>` 3. Configure the certificate's public key in your external SAML Identity Provider",builder:Jm,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust identity-providers saml-certificate create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/identity_providers/${r[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(r[`identity-provider-id`]))}/saml_certificate`,pathParams:{"identity-provider-id":String(r[`identity-provider-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Creating`,async()=>i.zeroTrust.identityProviders.samlCertificate.create({account_id:l,identity_provider_id:r[`identity-provider-id`]})),{successLabel:`Created`})}},Xm={command:`saml-certificate`,describe:`Operations for identity-providers.saml-certificate`,builder:e=>e.command(Ym).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Zm(e){return e.option(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`cf-resource-id`,{type:`string`,description:'The unique Cloudflare-generated Id of the SCIM Group resource; also known as the "Id".\nPass once for a single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to look up multiple groups in one request,\nup to 50 values. Mutually exclusive with `idp_resource_id`, `name`,\n`search_contains`, and `search_starts_with`.'}).option(`idp-resource-id`,{type:`string`,description:'The IdP-generated Id of the SCIM Group resource; also known as the "external Id".\nPass once for a single lookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to look up multiple groups in one request,\nup to 50 values. Mutually exclusive with `cf_resource_id`, `name`,\n`search_contains`, and `search_starts_with`.'}).option(`name`,{type:`string`,description:`The display name of the SCIM Group resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qm={command:`list`,describe:`Lists SCIM Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:Zm,handler:async r=>{let i={cf_resource_id:r[`cf-resource-id`],idp_resource_id:r[`idp-resource-id`],name:r.name,page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust identity-providers scim groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/identity_providers/${r[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(r[`identity-provider-id`]))}/scim/groups`,pathParams:{"identity-provider-id":String(r[`identity-provider-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.identityProviders.scim.groups.list({account_id:u,identity_provider_id:r[`identity-provider-id`],...i})),{successLabel:`Loaded`})}},$m={command:`groups`,describe:`Operations for identity-providers.scim.groups`,builder:e=>e.command(Qm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function eh(e){return e.option(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`cf-resource-id`,{type:`string`,description:'The unique Cloudflare-generated Id of the SCIM User resource; also known as the "Id".\nPass once for a single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to look up multiple users in one request,\nup to 50 values. Mutually exclusive with `idp_resource_id`, `username`, `email`,\n`name`, `search_contains`, and `search_starts_with`.'}).option(`idp-resource-id`,{type:`string`,description:'The IdP-generated Id of the SCIM User resource; also known as the "external Id".\nPass once for a single lookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to look up multiple users in one request,\nup to 50 values. Mutually exclusive with `cf_resource_id`, `username`, `email`,\n`name`, `search_contains`, and `search_starts_with`.'}).option(`username`,{type:`string`,description:`The username of the SCIM User resource.`}).option(`email`,{type:`string`,description:`The email address of the SCIM User resource.`}).option(`name`,{type:`string`,description:`The name of the SCIM User resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const th={command:`list`,describe:`Lists SCIM User resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:eh,handler:async r=>{let i={cf_resource_id:r[`cf-resource-id`],idp_resource_id:r[`idp-resource-id`],username:r.username,email:r.email,name:r.name,page:r.page,per_page:r[`per-page`]};if(r.dryRun){s({command:`cf zero-trust identity-providers scim users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/identity_providers/${r[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(r[`identity-provider-id`]))}/scim/users`,pathParams:{"identity-provider-id":String(r[`identity-provider-id`]??``)},query:i,bodyKind:`none`});return}let l=await a(r),u=r.local?e:await t();r.accountId=u,o(await c(`Loading`,async()=>l.zeroTrust.identityProviders.scim.users.list({account_id:u,identity_provider_id:r[`identity-provider-id`],...i})),{successLabel:`Loaded`})}},nh={command:`users`,describe:`Operations for identity-providers.scim.users`,builder:e=>e.command(th).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},rh={command:`scim`,describe:`Operations for identity-providers.scim`,builder:e=>e.command($m).command(nh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ih(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ah={command:`update <identity-provider-id>`,describe:`Updates a configured identity provider.`,builder:ih,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust identity-providers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/identity_providers/${i[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(i[`identity-provider-id`]))}`,pathParams:{"account-or-zone":String(t),"identity-provider-id":String(i[`identity-provider-id`]??``),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?void 0:u(i.body)});return}let l=await a(i),d=i.zone===void 0?`accounts`:`zones`,f=d===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=f:i.accountId=f,i.body){let e=u(i.body);o(await c(`Updating`,async()=>l.zeroTrust.identityProviders.update({body:e,account_or_zone:d,account_or_zone_id:f,identity_provider_id:i[`identity-provider-id`]})),{successLabel:`Updated`});return}if(i.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},oh={command:`identity-providers`,describe:`Operations for identity-providers`,builder:e=>e.command(Vm).command(Um).command(Gm).command(qm).command(ah).command(Xm).command(rh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function sh(e){return e.option(`allow-authenticate-via-warp`,{type:`boolean`,description:`When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.`,default:!1}).option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`auto-redirect-to-identity`,{type:`boolean`,description:"When set to `true`, users skip the identity provider selection step during login.",default:!1}).option(`deny-unmatched-requests`,{type:`boolean`,description:"Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names` array."}).option(`deny-unmatched-requests-exempted-zone-names`,{type:`string`,array:!0,description:"Contains zone names to exempt from the `deny_unmatched_requests` feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request."}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`,default:!1}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:"Lists the MFA methods that users can authenticate with. The `piv_key` and `ssh_fido2_key` values are supported only for infrastructure applications."}).option(`mfa-config-amr-matching-session-duration`,{type:`string`,description:`Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).`}).option(`mfa-config-required-aaguids`,{type:`string`,description:`Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`mfa-piv-key-requirements-pin-policy`,{type:`string`,description:"Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN required), `once` (PIN required once per session), `always` (PIN required for each use).",choices:[`never`,`once`,`always`]}).option(`mfa-piv-key-requirements-require-fips-device`,{type:`boolean`,description:`Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.`}).option(`mfa-piv-key-requirements-ssh-key-size`,{type:`string`,array:!0,description:`Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.`}).option(`mfa-piv-key-requirements-ssh-key-type`,{type:`string`,array:!0,description:"Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and `rsa`."}).option(`mfa-piv-key-requirements-touch-policy`,{type:`string`,description:"Defines when physical touch is required to use the SSH key. Valid values: `never` (no touch required), `always` (touch required for each use), `cached` (touch cached for 15 seconds).",choices:[`never`,`always`,`cached`]}).option(`mfa-required-for-all-apps`,{type:`boolean`,description:`Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: 'allowed_authenticators' cannot contain only the infrastructure SSH authenticators ('piv_key' and 'ssh_fido2_key') if the organization has any non-infrastructure applications.`,default:!1}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`warp-auth-non-browser-401`,{type:`boolean`,description:`When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page.`,default:!1}).option(`warp-auth-session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ch={command:`create`,describe:`Sets up a Zero Trust organization for your account or zone.`,builder:sh,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust organizations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/organizations`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?f({allow_authenticate_via_warp:i[`allow-authenticate-via-warp`],auth_domain:p(i[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:i[`auto-redirect-to-identity`],deny_unmatched_requests:i[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:i[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:i[`is-ui-read-only`],login_design:{background_color:p(i[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(i[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(i[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(i[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(i[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:i[`mfa-config-allowed-authenticators`],amr_matching_session_duration:p(i[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:p(i[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:p(i[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:p(i[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:i[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:i[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:i[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:p(i[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:i[`mfa-required-for-all-apps`],name:p(i.name,`name`,`text`),session_duration:p(i[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:p(i[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(i[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_non_browser_401:i[`warp-auth-non-browser-401`],warp_auth_session_duration:p(i[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)}):u(i.body)});return}let l=await a(i),d=i.zone===void 0?`accounts`:`zones`,m=d===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=m:i.accountId=m,i.body){let e=u(i.body);o(await c(`Creating`,async()=>l.zeroTrust.organizations.create({...e,account_or_zone:d,account_or_zone_id:m})),{successLabel:`Created`});return}i[`auth-domain`]===void 0&&(i[`auth-domain`]=await h(`auth-domain`,`The unique subdomain assigned to your Zero Trust organization.`)),i.name===void 0&&(i.name=await h(`name`,`The name of your Zero Trust organization.`));let g=f({allow_authenticate_via_warp:i[`allow-authenticate-via-warp`],auth_domain:p(i[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:i[`auto-redirect-to-identity`],deny_unmatched_requests:i[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:i[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:i[`is-ui-read-only`],login_design:{background_color:p(i[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(i[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(i[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(i[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(i[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:i[`mfa-config-allowed-authenticators`],amr_matching_session_duration:p(i[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:p(i[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:p(i[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:p(i[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:i[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:i[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:i[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:p(i[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:i[`mfa-required-for-all-apps`],name:p(i.name,`name`,`text`),session_duration:p(i[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:p(i[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(i[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_non_browser_401:i[`warp-auth-non-browser-401`],warp_auth_session_duration:p(i[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)});o(await c(`Creating`,async()=>l.zeroTrust.organizations.create({...g,account_or_zone:d,account_or_zone_id:m})),{successLabel:`Created`})}};function lh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const uh={command:`get`,describe:`Returns the DoH settings for your Zero Trust organization.`,builder:lh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust organizations doh get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/organizations/doh`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.organizations.doh.get({account_id:l})),{successLabel:`Loaded`})}};function dh(e){return e.option(`doh-jwt-duration`,{type:`string`,description:"The duration the DoH JWT is valid for. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.  Note that the maximum duration for this setting is the same as the key rotation period on the account. Default expiration is 24h"}).option(`service-token-id`,{type:`string`,description:`The uuid of the service token you want to use for DoH authentication`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const fh={command:`update`,describe:`Updates the DoH settings for your Zero Trust organization.`,builder:dh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust organizations doh update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/organizations/doh`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({doh_jwt_duration:p(r[`doh-jwt-duration`],`doh-jwt-duration`,`text`),service_token_id:p(r[`service-token-id`],`service-token-id`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.organizations.doh.update({...e,account_id:l})),{successLabel:`Updated`});return}let d=f({doh_jwt_duration:p(r[`doh-jwt-duration`],`doh-jwt-duration`,`text`),service_token_id:p(r[`service-token-id`],`service-token-id`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.organizations.doh.update({...d,account_id:l})),{successLabel:`Updated`})}},ph={command:`doh`,describe:`Operations for organizations.doh`,builder:e=>e.command(uh).command(fh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function mh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const hh={command:`list`,describe:`Returns the configuration for your Zero Trust organization.`,builder:mh,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust organizations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/organizations`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`none`});return}let l=await a(i),u=i.zone===void 0?`accounts`:`zones`,d=u===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();u===`zones`?i.zoneId=d:i.accountId=d,o(await c(`Loading`,async()=>l.zeroTrust.organizations.list({account_or_zone:u,account_or_zone_id:d})),{successLabel:`Loaded`})}};function gh(e){return e.option(`devices`,{type:`boolean`,description:"When set to `true`, all devices associated with the user will be revoked."}).option(`email`,{type:`string`,description:`The email of the user to revoke.`}).option(`user-uid`,{type:`string`,description:`The uuid of the user to revoke.`}).option(`warp-session-reauth`,{type:`boolean`,description:"When set to `true`, the user will be required to re-authenticate to WARP for all Gateway policies that enforce a WARP client session duration. When `false`, the user’s WARP session will remain active"}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _h={command:`revoke-users`,describe:`Revokes a user's access across all applications.`,builder:gh,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust organizations revoke-users`,method:`POST`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/organizations/revoke_user`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?f({devices:i.devices,email:p(i.email,`email`,`text`),user_uid:p(i[`user-uid`],`user-uid`,`text`),warp_session_reauth:i[`warp-session-reauth`]}):u(i.body)});return}let l=await a(i),d=i.zone===void 0?`accounts`:`zones`,m=d===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=m:i.accountId=m,!await _({force:!!i.force,message:`This operation revokes all access tokens for a user destructively.`})){process.stderr.write(`Aborted.
+`);return}if(i.body){let e=u(i.body);o(await c(`Deleting`,async()=>l.zeroTrust.organizations.revokeUsers({...e,account_or_zone:d,account_or_zone_id:m})),{successLabel:`Deleted`});return}i.email===void 0&&(i.email=await h(`email`,`The email of the user to revoke.`));let g=f({devices:i.devices,email:p(i.email,`email`,`text`),user_uid:p(i[`user-uid`],`user-uid`,`text`),warp_session_reauth:i[`warp-session-reauth`]});o(await c(`Deleting`,async()=>l.zeroTrust.organizations.revokeUsers({...g,account_or_zone:d,account_or_zone_id:m})),{successLabel:`Deleted`})}};function vh(e){return e.option(`allow-authenticate-via-warp`,{type:`boolean`,description:`When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.`}).option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`auto-redirect-to-identity`,{type:`boolean`,description:"When set to `true`, users skip the identity provider selection step during login."}).option(`custom-pages-forbidden`,{type:`string`,description:`The uid of the custom page to use when a user is denied access after failing a non-identity rule.`}).option(`custom-pages-identity-denied`,{type:`string`,description:`The uid of the custom page to use when a user is denied access.`}).option(`deny-unmatched-requests`,{type:`boolean`,description:"Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names` array."}).option(`deny-unmatched-requests-exempted-zone-names`,{type:`string`,array:!0,description:"Contains zone names to exempt from the `deny_unmatched_requests` feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request."}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:"Lists the MFA methods that users can authenticate with. The `piv_key` and `ssh_fido2_key` values are supported only for infrastructure applications."}).option(`mfa-config-amr-matching-session-duration`,{type:`string`,description:`Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).`}).option(`mfa-config-required-aaguids`,{type:`string`,description:`Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`mfa-piv-key-requirements-pin-policy`,{type:`string`,description:"Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN required), `once` (PIN required once per session), `always` (PIN required for each use).",choices:[`never`,`once`,`always`]}).option(`mfa-piv-key-requirements-require-fips-device`,{type:`boolean`,description:`Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.`}).option(`mfa-piv-key-requirements-ssh-key-size`,{type:`string`,array:!0,description:`Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.`}).option(`mfa-piv-key-requirements-ssh-key-type`,{type:`string`,array:!0,description:"Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and `rsa`."}).option(`mfa-piv-key-requirements-touch-policy`,{type:`string`,description:"Defines when physical touch is required to use the SSH key. Valid values: `never` (no touch required), `always` (touch required for each use), `cached` (touch cached for 15 seconds).",choices:[`never`,`always`,`cached`]}).option(`mfa-required-for-all-apps`,{type:`boolean`,description:`Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: 'allowed_authenticators' cannot contain only the infrastructure SSH authenticators ('piv_key' and 'ssh_fido2_key') if the organization has any non-infrastructure applications.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`warp-auth-non-browser-401`,{type:`boolean`,description:`When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page.`}).option(`warp-auth-session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const yh={command:`update`,describe:`Updates the configuration for your Zero Trust organization.`,builder:vh,handler:async i=>{if(i.dryRun){let e=i.zone===void 0?await n():void 0,t=i.zone===void 0?`accounts`:`zones`,r=i.zone??e??`<account-id>`;s({command:`cf zero-trust organizations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/${t}/${r}/access/organizations`,pathParams:{"account-or-zone":String(t),"account-or-zone-id":String(r)},bodyKind:`json`,body:i.body===void 0?f({allow_authenticate_via_warp:i[`allow-authenticate-via-warp`],auth_domain:p(i[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:i[`auto-redirect-to-identity`],custom_pages:{forbidden:p(i[`custom-pages-forbidden`],`custom-pages-forbidden`,`text`),identity_denied:p(i[`custom-pages-identity-denied`],`custom-pages-identity-denied`,`text`)},deny_unmatched_requests:i[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:i[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:i[`is-ui-read-only`],login_design:{background_color:p(i[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(i[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(i[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(i[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(i[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:i[`mfa-config-allowed-authenticators`],amr_matching_session_duration:p(i[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:p(i[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:p(i[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:p(i[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:i[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:i[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:i[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:p(i[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:i[`mfa-required-for-all-apps`],name:p(i.name,`name`,`text`),session_duration:p(i[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:p(i[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(i[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_non_browser_401:i[`warp-auth-non-browser-401`],warp_auth_session_duration:p(i[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)}):u(i.body)});return}let l=await a(i),d=i.zone===void 0?`accounts`:`zones`,m=d===`zones`?await r({zone:i.zone},l,{quiet:i.quiet}):i.local?e:await t();if(d===`zones`?i.zoneId=m:i.accountId=m,i.body){let e=u(i.body);o(await c(`Updating`,async()=>l.zeroTrust.organizations.update({...e,account_or_zone:d,account_or_zone_id:m})),{successLabel:`Updated`});return}let h=f({allow_authenticate_via_warp:i[`allow-authenticate-via-warp`],auth_domain:p(i[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:i[`auto-redirect-to-identity`],custom_pages:{forbidden:p(i[`custom-pages-forbidden`],`custom-pages-forbidden`,`text`),identity_denied:p(i[`custom-pages-identity-denied`],`custom-pages-identity-denied`,`text`)},deny_unmatched_requests:i[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:i[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:i[`is-ui-read-only`],login_design:{background_color:p(i[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(i[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(i[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(i[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(i[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:i[`mfa-config-allowed-authenticators`],amr_matching_session_duration:p(i[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:p(i[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:p(i[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:p(i[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:i[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:i[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:i[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:p(i[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:i[`mfa-required-for-all-apps`],name:p(i.name,`name`,`text`),session_duration:p(i[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:p(i[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(i[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_non_browser_401:i[`warp-auth-non-browser-401`],warp_auth_session_duration:p(i[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)});o(await c(`Updating`,async()=>l.zeroTrust.organizations.update({...h,account_or_zone:d,account_or_zone_id:m})),{successLabel:`Updated`})}},bh={command:`organizations`,describe:`Operations for organizations`,builder:e=>e.command(ch).command(hh).command(_h).command(yh).command(ph).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function xh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sh={command:`list`,describe:`Lists all DLP custom profiles in an account.`,builder:xh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust profiles custom list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/custom`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.profiles.custom.list({account_id:l})),{successLabel:`Loaded`})}},Ch={command:`custom`,describe:`Profiles operations`,builder:e=>e.command(Sh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function wh(e){return e.option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`entries`,{type:`string`,description:`The entries field. Provide as a JSON array of objects or @path/to/file.json.`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Predefined profiles can not be created. This endpoint will only update an existing predefined profiles settings.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const Th={command:`create`,describe:`Creates a DLP predefined profile. Only supports enabling/disabling entries.`,builder:wh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust profiles predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:p(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},entries:d(r.entries,`entries`),ocr_enabled:r[`ocr-enabled`],profile_id:p(r[`profile-id`],`profile-id`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.profiles.predefined.create({...e,account_id:l})),{successLabel:`Created`});return}r[`profile-id`]===void 0&&(r[`profile-id`]=await h(`profile-id`,`The profile_id field`));let m=f({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:p(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},entries:d(r.entries,`entries`),ocr_enabled:r[`ocr-enabled`],profile_id:p(r[`profile-id`],`profile-id`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.profiles.predefined.create({...m,account_id:l})),{successLabel:`Created`})}};function Eh(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dh={command:`get <profile-id>`,describe:`Fetches a predefined DLP profile by id.`,builder:Eh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust profiles predefined get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.profiles.predefined.get({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Loaded`})}};function Oh(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`entries`,{type:`string`,description:`The entries field. Provide as a JSON array of objects or @path/to/file.json.`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the predefined profile.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const kh={command:`update <profile-id>`,describe:`Updates a DLP predefined profile. Only supports enabling/disabling entries.`,builder:Oh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust profiles predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/profiles/predefined/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:p(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},entries:d(r.entries,`entries`),ocr_enabled:r[`ocr-enabled`]}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.profiles.predefined.update({...e,account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Updated`});return}let m=f({ai_context_enabled:r[`ai-context-enabled`],allowed_match_count:r[`allowed-match-count`],confidence_threshold:p(r[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:r[`context-awareness-enabled`],skip:{files:r[`context-awareness-skip-files`]}},entries:d(r.entries,`entries`),ocr_enabled:r[`ocr-enabled`]});o(await c(`Updating`,async()=>i.zeroTrust.profiles.predefined.update({...m,account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Updated`})}},Ah={command:`predefined`,describe:`Profiles operations`,builder:e=>e.command(Th).command(Dh).command(kh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},jh={command:`profiles`,describe:`Operations for profiles`,builder:e=>e.command(Ch).command(Ah).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Mh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Nh={command:`get`,describe:`Retrieves configured risk score behaviors that define how user actions affect their overall risk score.`,builder:Mh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring behaviours get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/behaviors`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.behaviours.get({account_id:l})),{successLabel:`Loaded`})}};function Ph(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Behaviors.`})}const Fh={command:`update`,describe:`Updates risk score behavior configurations, defining weights and thresholds for risk calculation.`,builder:Ph,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring behaviours update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/behaviors`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.riskScoring.behaviours.update({body:e,account_id:l})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ih={command:`behaviours`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(Nh).command(Fh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Lh(e){return e.positional(`user-id`,{type:`string`,description:`User ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Rh={command:`get <user-id>`,describe:`Retrieves the detailed risk score breakdown for a specific user, including contributing factors.`,builder:Lh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.get({account_id:l,user_id:r[`user-id`]})),{successLabel:`Loaded`})}};function zh(e){return e.option(`integration-type`,{type:`string`,description:`The integration_type field`,choices:[`Okta`]}).option(`reference-id`,{type:`string`,description:`A reference id that can be supplied by the client. Currently this should be set to the Access-Okta IDP ID (a UUIDv4).
+https://developers.cloudflare.com/api/operations/access-identity-providers-get-an-access-identity-provider`}).option(`tenant-url`,{type:`string`,description:`The base url of the tenant, e.g. "https://tenant.okta.com".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Bh={command:`create`,describe:`Creates a new Zero Trust risk score integration, connecting external risk signals to Cloudflare's risk scoring system.`,builder:zh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({integration_type:p(r[`integration-type`],`integration-type`,`text`),reference_id:p(r[`reference-id`],`reference-id`,`text`),tenant_url:p(r[`tenant-url`],`tenant-url`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Creating`,async()=>i.zeroTrust.riskScoring.integrations.create({...e,account_id:l})),{successLabel:`Created`});return}r[`integration-type`]===void 0&&(r[`integration-type`]=await g(`integration-type`,`The integration_type field`,[`Okta`])),r[`tenant-url`]===void 0&&(r[`tenant-url`]=await h(`tenant-url`,`The base url of the tenant, e.g. "https://tenant.okta.com".`));let d=f({integration_type:p(r[`integration-type`],`integration-type`,`text`),reference_id:p(r[`reference-id`],`reference-id`,`text`),tenant_url:p(r[`tenant-url`],`tenant-url`,`text`)});o(await c(`Creating`,async()=>i.zeroTrust.riskScoring.integrations.create({...d,account_id:l})),{successLabel:`Created`})}};function Vh(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Hh={command:`delete <integration-id>`,describe:`Removes a Zero Trust risk score integration, disconnecting the external risk signal source.`,builder:Vh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.riskScoring.integrations.delete({account_id:l,integration_id:r[`integration-id`]})),{successLabel:`Deleted`})}};function Uh(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Wh={command:`get <integration-id>`,describe:`Gets a Zero Trust risk score integration by ID.`,builder:Uh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.integrations.get({account_id:l,integration_id:r[`integration-id`]})),{successLabel:`Loaded`})}};function Gh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kh={command:`list`,describe:`Lists all configured Zero Trust risk score integrations for the account.`,builder:Gh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.integrations.list({account_id:l})),{successLabel:`Loaded`})}};function qh(e){return e.positional(`reference-id`,{type:`string`,description:`Reference ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jh={command:`get <reference-id>`,describe:`Retrieves a Zero Trust risk score integration using its external reference ID.`,builder:qh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations references get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations/reference_id/${r[`reference-id`]==null?`<reference-id>`:encodeURIComponent(String(r[`reference-id`]))}`,pathParams:{"reference-id":String(r[`reference-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.integrations.references.get({account_id:l,reference_id:r[`reference-id`]})),{successLabel:`Loaded`})}},Yh={command:`references`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(Jh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Xh(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`active`,{type:`boolean`,description:`Whether this integration is enabled. If disabled, no risk changes will be exported to the third-party.`}).option(`reference-id`,{type:`string`,description:`A reference id that can be supplied by the client. Currently this should be set to the Access-Okta IDP ID (a UUIDv4).
+https://developers.cloudflare.com/api/operations/access-identity-providers-get-an-access-identity-provider`}).option(`tenant-url`,{type:`string`,description:`The base url of the tenant, e.g. "https://tenant.okta.com".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Zh={command:`update <integration-id>`,describe:`Overwrite the reference_id, tenant_url, and active values with the ones provided.`,builder:Xh,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring integrations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/integrations/${r[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(r[`integration-id`]))}`,pathParams:{"integration-id":String(r[`integration-id`]??``)},bodyKind:`json`,body:r.body===void 0?f({active:r.active,reference_id:p(r[`reference-id`],`reference-id`,`text`),tenant_url:p(r[`tenant-url`],`tenant-url`,`text`)}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.riskScoring.integrations.update({...e,account_id:l,integration_id:r[`integration-id`]})),{successLabel:`Updated`});return}if(r.active===void 0)throw Error(`--active is required (or pass --body with this field set).`);r[`tenant-url`]===void 0&&(r[`tenant-url`]=await h(`tenant-url`,`The base url of the tenant, e.g. "https://tenant.okta.com".`));let d=f({active:r.active,reference_id:p(r[`reference-id`],`reference-id`,`text`),tenant_url:p(r[`tenant-url`],`tenant-url`,`text`)});o(await c(`Updating`,async()=>i.zeroTrust.riskScoring.integrations.update({...d,account_id:l,integration_id:r[`integration-id`]})),{successLabel:`Updated`})}},Qh={command:`integrations`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(Bh).command(Hh).command(Wh).command(Kh).command(Zh).command(Yh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $h(e){return e.positional(`user-id`,{type:`string`,description:`User ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const eg={command:`reset <user-id>`,describe:`Resets risk scores for specified users, clearing their accumulated risk history.`,builder:$h,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring reset`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/reset`,pathParams:{"user-id":String(r[`user-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force,message:`This operation wipes risk-scoring history.`})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.riskScoring.reset({account_id:l,user_id:r[`user-id`]})),{successLabel:`Deleted`})}};function tg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ng={command:`get`,describe:`Gets an aggregate summary of risk scores across the account, including distribution and trends.`,builder:tg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust risk-scoring summary get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/zt_risk_scoring/summary`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.riskScoring.summary.get({account_id:l})),{successLabel:`Loaded`})}},rg={command:`summary`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(ng).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ig={command:`risk-scoring`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(Rh).command(eg).command(Ih).command(Qh).command(rg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ag(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const og={command:`edit`,describe:"Removes a user from a Zero Trust seat when both `access_seat` and `gateway_seat` are set to false.",builder:ag,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust seats edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/seats`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.seats.edit({body:e,account_id:l})),{successLabel:`Updated`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},sg={command:`seats`,describe:`Operations for seats`,builder:e=>e.command(og).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const lg={command:`delete`,describe:`Deletes account-level DLP settings and returns the initial values.`,builder:cg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust settings delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.settings.delete({account_id:l})),{successLabel:`Deleted`})}};function ug(e){return e.option(`ai-context-analysis`,{type:`boolean`,description:`Whether AI context analysis is enabled at the account level.`}).option(`ocr`,{type:`boolean`,description:`Whether OCR is enabled at the account level.`}).option(`payload-logging-masking-level`,{type:`string`,description:"Masking level for payload logs.\n\n- `full`: The entire payload is masked.\n- `partial`: Only partial payload content is masked.\n- `clear`: No masking is applied to the payload content.\n- `default`: DLP uses its default masking behavior.",choices:[`full`,`partial`,`clear`,`default`]}).option(`payload-logging-public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
 
 - Set to a non-empty base64 string to enable payload logging with the given key.
 - Set to an empty string to disable payload logging.
-- Omit or set to null to leave unchanged (PATCH) or reset to disabled (PUT).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`DLP settings fields to update.`})}const ug={command:`edit`,describe:`Missing fields keep their existing values.`,builder:lg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({ai_context_analysis:r[`ai-context-analysis`],ocr:r.ocr,payload_logging:{masking_level:f(r[`payload-logging-masking-level`],`payload-logging-masking-level`,`text`),public_key:f(r[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.settings.edit({body:e,account_id:u})),{successLabel:`Updated`});return}let p=d({ai_context_analysis:r[`ai-context-analysis`],ocr:r.ocr,payload_logging:{masking_level:f(r[`payload-logging-masking-level`],`payload-logging-masking-level`,`text`),public_key:f(r[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}});o(await c(`Updating`,async()=>i.zeroTrust.settings.edit({body:p,account_id:u})),{successLabel:`Updated`})}};function dg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fg={command:`get`,describe:`Gets the account-level DLP settings.`,builder:dg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.settings.get({account_id:l})),{successLabel:`Loaded`})}};function pg(e){return e.option(`ai-context-analysis`,{type:`boolean`,description:`Whether AI context analysis is enabled at the account level.`}).option(`ocr`,{type:`boolean`,description:`Whether OCR is enabled at the account level.`}).option(`payload-logging-masking-level`,{type:`string`,description:"Masking level for payload logs.\n\n- `full`: The entire payload is masked.\n- `partial`: Only partial payload content is masked.\n- `clear`: No masking is applied to the payload content.\n- `default`: DLP uses its default masking behavior.",choices:[`full`,`partial`,`clear`,`default`]}).option(`payload-logging-public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
+- Omit or set to null to leave unchanged (PATCH) or reset to disabled (PUT).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`DLP settings fields to update.`})}const dg={command:`edit`,describe:`Missing fields keep their existing values.`,builder:ug,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({ai_context_analysis:r[`ai-context-analysis`],ocr:r.ocr,payload_logging:{masking_level:p(r[`payload-logging-masking-level`],`payload-logging-masking-level`,`text`),public_key:p(r[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.settings.edit({body:e,account_id:l})),{successLabel:`Updated`});return}let d=f({ai_context_analysis:r[`ai-context-analysis`],ocr:r.ocr,payload_logging:{masking_level:p(r[`payload-logging-masking-level`],`payload-logging-masking-level`,`text`),public_key:p(r[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}});o(await c(`Updating`,async()=>i.zeroTrust.settings.edit({body:d,account_id:l})),{successLabel:`Updated`})}};function fg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pg={command:`get`,describe:`Gets the account-level DLP settings.`,builder:fg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();r.accountId=l,o(await c(`Loading`,async()=>i.zeroTrust.settings.get({account_id:l})),{successLabel:`Loaded`})}};function mg(e){return e.option(`ai-context-analysis`,{type:`boolean`,description:`Whether AI context analysis is enabled at the account level.`}).option(`ocr`,{type:`boolean`,description:`Whether OCR is enabled at the account level.`}).option(`payload-logging-masking-level`,{type:`string`,description:"Masking level for payload logs.\n\n- `full`: The entire payload is masked.\n- `partial`: Only partial payload content is masked.\n- `clear`: No masking is applied to the payload content.\n- `default`: DLP uses its default masking behavior.",choices:[`full`,`partial`,`clear`,`default`]}).option(`payload-logging-public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
 
 - Set to a non-empty base64 string to enable payload logging with the given key.
 - Set to an empty string to disable payload logging.
-- Omit or set to null to leave unchanged (PATCH) or reset to disabled (PUT).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`New DLP settings.`})}const mg={command:`update`,describe:`Missing fields are reset to initial (unconfigured) values.`,builder:pg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({ai_context_analysis:r[`ai-context-analysis`],ocr:r.ocr,payload_logging:{masking_level:f(r[`payload-logging-masking-level`],`payload-logging-masking-level`,`text`),public_key:f(r[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}}):l(r.body)});return}let i=await a(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);o(await c(`Updating`,async()=>i.zeroTrust.settings.update({body:e,account_id:u})),{successLabel:`Updated`});return}let p=d({ai_context_analysis:r[`ai-context-analysis`],ocr:r.ocr,payload_logging:{masking_level:f(r[`payload-logging-masking-level`],`payload-logging-masking-level`,`text`),public_key:f(r[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}});o(await c(`Updating`,async()=>i.zeroTrust.settings.update({body:p,account_id:u})),{successLabel:`Updated`})}},hg={command:`settings`,describe:`Settings operations`,builder:e=>e.command(cg).command(ug).command(fg).command(mg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function gg(e){return e.positional(`authenticator-id`,{type:`string`,description:`The unique identifier for the MFA device.`,demandOption:!0}).option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const _g={command:`delete <authenticator-id>`,describe:`Deletes a specific MFA device, including a PIV key or FIDO2 key enrollment, for a user. This action is only available if MFA is turned on for the organization. Successful deletion revokes the enrollment and returns a null result.`,builder:gg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust users mfa authenticators delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/mfa_authenticators/${r[`authenticator-id`]==null?`<authenticator-id>`:encodeURIComponent(String(r[`authenticator-id`]))}`,pathParams:{"user-id":String(r[`user-id`]??``),"authenticator-id":String(r[`authenticator-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await g({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}o(await c(`Deleting`,async()=>i.zeroTrust.users.mfa.authenticators.delete({account_id:l,user_id:r[`user-id`],authenticator_id:r[`authenticator-id`]})),{successLabel:`Deleted`})}},vg={command:`authenticators`,describe:`Operations for users.mfa.authenticators`,builder:e=>e.command(_g).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},yg={command:`mfa`,describe:`Operations for users.mfa`,builder:e=>e.command(vg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},bg={command:`users`,describe:`Operations for users`,builder:e=>e.command(yg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},xg={command:`zero-trust`,describe:`Cloudflare's SASE platform — secure access, device posture, DLP, tunnels, gateway policies, and network segmentation`,builder:e=>e.command(pr).command(Tr).command(Qr).command(ri).command(es).command(Nc).command(ef).command(yf).command(Rm).command(ah).command(yh).command(Ah).command(rg).command(og).command(hg).command(bg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{xg as default};
+- Omit or set to null to leave unchanged (PATCH) or reset to disabled (PUT).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`New DLP settings.`})}const hg={command:`update`,describe:`Missing fields are reset to initial (unconfigured) values.`,builder:mg,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?f({ai_context_analysis:r[`ai-context-analysis`],ocr:r.ocr,payload_logging:{masking_level:p(r[`payload-logging-masking-level`],`payload-logging-masking-level`,`text`),public_key:p(r[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}}):u(r.body)});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,r.body){let e=u(r.body);o(await c(`Updating`,async()=>i.zeroTrust.settings.update({body:e,account_id:l})),{successLabel:`Updated`});return}let d=f({ai_context_analysis:r[`ai-context-analysis`],ocr:r.ocr,payload_logging:{masking_level:p(r[`payload-logging-masking-level`],`payload-logging-masking-level`,`text`),public_key:p(r[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}});o(await c(`Updating`,async()=>i.zeroTrust.settings.update({body:d,account_id:l})),{successLabel:`Updated`})}},gg={command:`settings`,describe:`Settings operations`,builder:e=>e.command(lg).command(dg).command(pg).command(hg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function _g(e){return e.positional(`authenticator-id`,{type:`string`,description:`The unique identifier for the MFA device.`,demandOption:!0}).option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const vg={command:`delete <authenticator-id>`,describe:`Deletes a specific MFA device, including a PIV key or FIDO2 key enrollment, for a user. This action is only available if MFA is turned on for the organization. Successful deletion revokes the enrollment and returns a null result.`,builder:_g,handler:async r=>{if(r.dryRun){s({command:`cf zero-trust users mfa authenticators delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/users/${r[`user-id`]==null?`<user-id>`:encodeURIComponent(String(r[`user-id`]))}/mfa_authenticators/${r[`authenticator-id`]==null?`<authenticator-id>`:encodeURIComponent(String(r[`authenticator-id`]))}`,pathParams:{"user-id":String(r[`user-id`]??``),"authenticator-id":String(r[`authenticator-id`]??``)},bodyKind:`none`});return}let i=await a(r),l=r.local?e:await t();if(r.accountId=l,!await _({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}o(await c(`Deleting`,async()=>i.zeroTrust.users.mfa.authenticators.delete({account_id:l,user_id:r[`user-id`],authenticator_id:r[`authenticator-id`]})),{successLabel:`Deleted`})}},yg={command:`authenticators`,describe:`Operations for users.mfa.authenticators`,builder:e=>e.command(vg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},bg={command:`mfa`,describe:`Operations for users.mfa`,builder:e=>e.command(yg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},xg={command:`users`,describe:`Operations for users`,builder:e=>e.command(bg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Sg={command:`zero-trust`,describe:`Cloudflare's SASE platform — secure access, device posture, DLP, tunnels, gateway policies, and network segmentation`,builder:e=>e.command(mr).command(Er).command($r).command(ii).command(ts).command(Pc).command(tf).command(bf).command(zm).command(oh).command(bh).command(jh).command(ig).command(sg).command(gg).command(xg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{Sg as default};