cf 0.3.0 → 0.5.0

package/dist/{zero-trust-CP96wnSh.mjs → zero-trust-UNVZFnKu.mjs}

@@ -1,54 +1,54 @@
 #!/usr/bin/env node
-import{C as e,D as t,E as n,S as r,T as i,_ as a,i as o,n as s}from"./auth-ffdf9yR0.mjs";import{n as c,t as l}from"./body-parser-DKa8Ipg1.mjs";import{t as u}from"./output-BJFNwj7b.mjs";import{n as d,t as f}from"./progress-CrCGTq7N.mjs";import{n as p,t as m}from"./input-validation-zEO81MWN.mjs";import{t as h}from"./local-VJaJ3BZ1.mjs";import{t as g}from"./cli-types-CRIDdDw3.mjs";import{n as ee,t as te}from"./raw-fetch-Dlccg0Tr.mjs";function _(e){return e.option(`allow-code-mode`,{type:`boolean`,description:`Allow remote code execution in Dynamic Workers (beta)`,default:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`hostname`,{type:`string`,description:`The hostname field`}).option(`id`,{type:`string`,description:`portal id`}).option(`name`,{type:`string`,description:`The name field`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound MCP traffic through Zero Trust Secure Web Gateway`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const v={command:`create`,describe:`Creates a new MCP portal for managing AI tool access through Cloudflare Access.`,builder:_,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access ai-controls mcp portals create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/ai-controls/mcp/portals`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({allow_code_mode:n[`allow-code-mode`],description:p(n.description,`description`,`text`),hostname:p(n.hostname,`hostname`,`text`),id:p(n.id,`id`,`text`),name:p(n.name,`name`,`text`),secure_web_gateway:n[`secure-web-gateway`]}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.access.aiControls.mcp.portals.create({...e,account_id:i})),{successLabel:`Created`});return}n.hostname===void 0&&(n.hostname=await t(`hostname`,`The hostname field`)),n.id===void 0&&(n.id=await t(`id`,`portal id`)),n.name===void 0&&(n.name=await t(`name`,`The name field`));let o=l({allow_code_mode:n[`allow-code-mode`],description:p(n.description,`description`,`text`),hostname:p(n.hostname,`hostname`,`text`),id:p(n.id,`id`,`text`),name:p(n.name,`name`,`text`),secure_web_gateway:n[`secure-web-gateway`]});u(await f(`Creating`,async()=>r.zeroTrust.access.aiControls.mcp.portals.create({...o,account_id:i})),{successLabel:`Created`})}};function y(e){return e.positional(`id`,{type:`string`,description:`portal id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const b={command:`delete <id>`,describe:`Deletes an MCP portal from the account.`,builder:y,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access ai-controls mcp portals delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/ai-controls/mcp/portals/${t.id==null?`<id>`:encodeURIComponent(String(t.id))}`,pathParams:{id:String(t.id??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.aiControls.mcp.portals.delete({account_id:r,id:t.id})),{successLabel:`Deleted`})}};function x(e){return e.option(`page`,{type:`number`,description:`Page`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`search`,{type:`string`,description:`Search by id, name, hostname`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const S={command:`list`,describe:`Lists all MCP portals configured for the account.`,builder:x,handler:async t=>{let n={page:t.page,per_page:t[`per-page`],search:t.search};if(t.dryRun){d({command:`cf zero-trust access ai-controls mcp portals list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/ai-controls/mcp/portals`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.access.aiControls.mcp.portals.list({account_id:i,...n})),{successLabel:`Loaded`})}};function C(e){return e.positional(`id`,{type:`string`,description:`portal id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const w={command:`read <id>`,describe:`Read the details of a single MCP Portal, including its configured servers.`,builder:C,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access ai-controls mcp portals read`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/ai-controls/mcp/portals/${t.id==null?`<id>`:encodeURIComponent(String(t.id))}`,pathParams:{id:String(t.id??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.aiControls.mcp.portals.read({account_id:r,id:t.id})),{successLabel:`Loaded`})}};function T(e){return e.positional(`id`,{type:`string`,description:`portal id`,demandOption:!0}).option(`allow-code-mode`,{type:`boolean`,description:`Allow remote code execution in Dynamic Workers (beta)`}).option(`description`,{type:`string`,description:`The description field`}).option(`hostname`,{type:`string`,description:`The hostname field`}).option(`name`,{type:`string`,description:`The name field`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound MCP traffic through Zero Trust Secure Web Gateway`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const E={command:`update <id>`,describe:`Updates an MCP portal configuration.`,builder:T,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access ai-controls mcp portals update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/ai-controls/mcp/portals/${t.id==null?`<id>`:encodeURIComponent(String(t.id))}`,pathParams:{id:String(t.id??``)},bodyKind:`json`,body:t.body===void 0?l({allow_code_mode:t[`allow-code-mode`],description:p(t.description,`description`,`text`),hostname:p(t.hostname,`hostname`,`text`),name:p(t.name,`name`,`text`),secure_web_gateway:t[`secure-web-gateway`]}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.access.aiControls.mcp.portals.update({...e,account_id:r,id:t.id})),{successLabel:`Updated`});return}let i=l({allow_code_mode:t[`allow-code-mode`],description:p(t.description,`description`,`text`),hostname:p(t.hostname,`hostname`,`text`),name:p(t.name,`name`,`text`),secure_web_gateway:t[`secure-web-gateway`]});u(await f(`Updating`,async()=>n.zeroTrust.access.aiControls.mcp.portals.update({...i,account_id:r,id:t.id})),{successLabel:`Updated`})}},D={command:`portals`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(v).command(b).command(S).command(w).command(E).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function O(e){return e.option(`auth-credentials`,{type:`string`,description:`The auth_credentials field`}).option(`auth-type`,{type:`string`,description:`The auth_type field`,choices:[`oauth`,`bearer`,`unauthenticated`]}).option(`description`,{type:`string`,description:`The description field`}).option(`hostname`,{type:`string`,description:`The hostname field`}).option(`id`,{type:`string`,description:`server id`}).option(`is-shared-oauth-callback-enabled`,{type:`boolean`,description:`When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker's per-env rollout mode KV key.`,default:!1}).option(`name`,{type:`string`,description:`The name field`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const k={command:`create`,describe:`Creates a new MCP portal for managing AI tool access through Cloudflare Access.`,builder:O,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust access ai-controls mcp servers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/ai-controls/mcp/servers`,pathParams:{},bodyKind:`json`,body:r.body===void 0?l({auth_credentials:p(r[`auth-credentials`],`auth-credentials`,`text`),auth_type:p(r[`auth-type`],`auth-type`,`text`),description:p(r.description,`description`,`text`),hostname:p(r.hostname,`hostname`,`text`),id:p(r.id,`id`,`text`),is_shared_oauth_callback_enabled:r[`is-shared-oauth-callback-enabled`],name:p(r.name,`name`,`text`),secure_web_gateway:r[`secure-web-gateway`]}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Creating`,async()=>i.zeroTrust.access.aiControls.mcp.servers.create({...e,account_id:o})),{successLabel:`Created`});return}r[`auth-type`]===void 0&&(r[`auth-type`]=await n(`auth-type`,`The auth_type field`,[`oauth`,`bearer`,`unauthenticated`])),r.hostname===void 0&&(r.hostname=await t(`hostname`,`The hostname field`)),r.id===void 0&&(r.id=await t(`id`,`server id`)),r.name===void 0&&(r.name=await t(`name`,`The name field`));let m=l({auth_credentials:p(r[`auth-credentials`],`auth-credentials`,`text`),auth_type:p(r[`auth-type`],`auth-type`,`text`),description:p(r.description,`description`,`text`),hostname:p(r.hostname,`hostname`,`text`),id:p(r.id,`id`,`text`),is_shared_oauth_callback_enabled:r[`is-shared-oauth-callback-enabled`],name:p(r.name,`name`,`text`),secure_web_gateway:r[`secure-web-gateway`]});u(await f(`Creating`,async()=>i.zeroTrust.access.aiControls.mcp.servers.create({...m,account_id:o})),{successLabel:`Created`})}};function A(e){return e.positional(`id`,{type:`string`,description:`server id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const j={command:`delete <id>`,describe:`Deletes an MCP portal from the account.`,builder:A,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access ai-controls mcp servers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/ai-controls/mcp/servers/${t.id==null?`<id>`:encodeURIComponent(String(t.id))}`,pathParams:{id:String(t.id??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.aiControls.mcp.servers.delete({account_id:r,id:t.id})),{successLabel:`Deleted`})}};function M(e){return e.option(`page`,{type:`number`,description:`Page`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`search`,{type:`string`,description:`Search by id, name`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const N={command:`list`,describe:`Lists all MCP portals configured for the account.`,builder:M,handler:async t=>{let n={page:t.page,per_page:t[`per-page`],search:t.search};if(t.dryRun){d({command:`cf zero-trust access ai-controls mcp servers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/ai-controls/mcp/servers`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.access.aiControls.mcp.servers.list({account_id:i,...n})),{successLabel:`Loaded`})}};function P(e){return e.positional(`id`,{type:`string`,description:`server id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const F={command:`read <id>`,describe:`Retrieves gateway configuration for MCP portals.`,builder:P,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access ai-controls mcp servers read`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/ai-controls/mcp/servers/${t.id==null?`<id>`:encodeURIComponent(String(t.id))}`,pathParams:{id:String(t.id??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.aiControls.mcp.servers.read({account_id:r,id:t.id})),{successLabel:`Loaded`})}};function I(e){return e.positional(`id`,{type:`string`,description:`portal id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const L={command:`sync <id>`,describe:`Syncs an MCP server's capabilities and returns the updated server state, including any connection errors.`,builder:I,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access ai-controls mcp servers sync`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/ai-controls/mcp/servers/${t.id==null?`<id>`:encodeURIComponent(String(t.id))}/sync`,pathParams:{id:String(t.id??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Creating`,async()=>n.zeroTrust.access.aiControls.mcp.servers.sync({account_id:r,id:t.id})),{successLabel:`Created`})}};function R(e){return e.positional(`id`,{type:`string`,description:`server id`,demandOption:!0}).option(`auth-credentials`,{type:`string`,description:`The auth_credentials field`}).option(`description`,{type:`string`,description:`The description field`}).option(`is-shared-oauth-callback-enabled`,{type:`boolean`,description:`When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker's per-env rollout mode KV key.`}).option(`name`,{type:`string`,description:`The name field`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const z={command:`update <id>`,describe:`Updates an MCP portal configuration.`,builder:R,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access ai-controls mcp servers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/ai-controls/mcp/servers/${t.id==null?`<id>`:encodeURIComponent(String(t.id))}`,pathParams:{id:String(t.id??``)},bodyKind:`json`,body:t.body===void 0?l({auth_credentials:p(t[`auth-credentials`],`auth-credentials`,`text`),description:p(t.description,`description`,`text`),is_shared_oauth_callback_enabled:t[`is-shared-oauth-callback-enabled`],name:p(t.name,`name`,`text`),secure_web_gateway:t[`secure-web-gateway`]}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.access.aiControls.mcp.servers.update({...e,account_id:r,id:t.id})),{successLabel:`Updated`});return}let i=l({auth_credentials:p(t[`auth-credentials`],`auth-credentials`,`text`),description:p(t.description,`description`,`text`),is_shared_oauth_callback_enabled:t[`is-shared-oauth-callback-enabled`],name:p(t.name,`name`,`text`),secure_web_gateway:t[`secure-web-gateway`]});u(await f(`Updating`,async()=>n.zeroTrust.access.aiControls.mcp.servers.update({...i,account_id:r,id:t.id})),{successLabel:`Updated`})}},B={command:`servers`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(k).command(j).command(N).command(F).command(L).command(z).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},V={command:`mcp`,describe:`Operations for access.ai-controls.mcp`,builder:e=>e.command(D).command(B).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},H={command:`ai-controls`,describe:`Operations for access.ai-controls`,builder:e=>e.command(V).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function U(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const W={command:`create <app-id>`,describe:`Generates a new short-lived certificate CA and public key.`,builder:U,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access applications cas create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/ca`,pathParams:{"app-id":String(t[`app-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Creating`,async()=>n.zeroTrust.access.applications.cas.create({account_id:r,app_id:t[`app-id`]})),{successLabel:`Created`})}};function G(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const K={command:`delete <app-id>`,describe:`Deletes a short-lived certificate CA.`,builder:G,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access applications cas delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/ca`,pathParams:{"app-id":String(t[`app-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.applications.cas.delete({account_id:r,app_id:t[`app-id`]})),{successLabel:`Deleted`})}};function q(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const J={command:`get <app-id>`,describe:`Fetches a short-lived certificate CA and its public key.`,builder:q,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access applications cas get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/ca`,pathParams:{"app-id":String(t[`app-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.applications.cas.get({account_id:r,app_id:t[`app-id`]})),{successLabel:`Loaded`})}};function Y(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const X={command:`list`,describe:`Lists short-lived certificate CAs and their public keys.`,builder:Y,handler:async t=>{let n={page:t.page,per_page:t[`per-page`]};if(t.dryRun){d({command:`cf zero-trust access applications cas list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps/ca`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.access.applications.cas.list({account_id:i,...n})),{successLabel:`Loaded`})}},Z={command:`cas`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(W).command(K).command(J).command(X).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Q(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ne={command:`create`,describe:`Adds a new application to Access.`,builder:Q,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access applications create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps`,pathParams:{},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.access.applications.create({body:e,account_id:r})),{successLabel:`Created`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function re(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ie={command:`delete <app-id>`,describe:`Deletes an application from Access.`,builder:re,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access applications delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}`,pathParams:{"app-id":String(t[`app-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.applications.delete({account_id:r,app_id:t[`app-id`]})),{successLabel:`Deleted`})}};function ae(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const oe={command:`get <app-id>`,describe:`Fetches information about an Access application.`,builder:ae,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access applications get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}`,pathParams:{"app-id":String(t[`app-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.applications.get({account_id:r,app_id:t[`app-id`]})),{successLabel:`Loaded`})}};function se(e){return e.option(`name`,{type:`string`,description:`The name of the app.`}).option(`domain`,{type:`string`,description:`The domain of the app.`}).option(`aud`,{type:`string`,description:`The aud of the app.`}).option(`target-attributes`,{type:`string`,description:`Target Criteria attributes in key=value format.`}).option(`exact`,{type:`boolean`,description:`True for only exact string matches against passed name/domain query parameters.`}).option(`search`,{type:`string`,description:`Search for apps by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ce={command:`list`,describe:`Lists all Access applications in an account.`,builder:se,handler:async t=>{let n={name:t.name,domain:t.domain,aud:t.aud,target_attributes:t[`target-attributes`],exact:t.exact,search:t.search,page:t.page,per_page:t[`per-page`]};if(t.dryRun){d({command:`cf zero-trust access applications list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.access.applications.list({account_id:i,...n})),{successLabel:`Loaded`})}};function le(e){return e.positional(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy within an app.
-`}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`}).option(`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`,{type:`string`,array:!0,description:`Clipboard formats allowed when copying from local machine to remote RDP session.`}).option(`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`,{type:`string`,array:!0,description:`Clipboard formats allowed when copying from remote RDP session to local machine.`}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:`Lists the MFA methods that users can authenticate with.`}).option(`mfa-config-mfa-disabled`,{type:`boolean`,description:`Indicates whether to disable MFA for this resource. This option is available at the application and policy level.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.",default:`24h`}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ue={command:`create <app-id>`,describe:`Creates a policy applying exclusive to a single application that defines the users or groups who can reach it. We recommend creating a reusable policy instead and subsequently referencing its ID in the application's 'policies' array.`,builder:le,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust access applications policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}/policies`,pathParams:{"app-id":String(r[`app-id`]??``)},bodyKind:`json`,body:r.body===void 0?l({precedence:r.precedence,approval_required:r[`approval-required`],connection_rules:{rdp:{allowed_clipboard_local_to_remote_formats:r[`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`],allowed_clipboard_remote_to_local_formats:r[`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`]}},isolation_required:r[`isolation-required`],mfa_config:{allowed_authenticators:r[`mfa-config-allowed-authenticators`],mfa_disabled:r[`mfa-config-mfa-disabled`],session_duration:p(r[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},purpose_justification_prompt:p(r[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:r[`purpose-justification-required`],session_duration:p(r[`session-duration`],`session-duration`,`text`),decision:p(r.decision,`decision`,`text`),name:p(r.name,`name`,`text`)}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Creating`,async()=>i.zeroTrust.access.applications.policies.create({body:e,account_id:o,app_id:r[`app-id`]})),{successLabel:`Created`});return}r.decision===void 0&&(r.decision=await n(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),r.name===void 0&&(r.name=await t(`name`,`The name of the Access policy.`));let m=l({precedence:r.precedence,approval_required:r[`approval-required`],connection_rules:{rdp:{allowed_clipboard_local_to_remote_formats:r[`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`],allowed_clipboard_remote_to_local_formats:r[`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`]}},isolation_required:r[`isolation-required`],mfa_config:{allowed_authenticators:r[`mfa-config-allowed-authenticators`],mfa_disabled:r[`mfa-config-mfa-disabled`],session_duration:p(r[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},purpose_justification_prompt:p(r[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:r[`purpose-justification-required`],session_duration:p(r[`session-duration`],`session-duration`,`text`),decision:p(r.decision,`decision`,`text`),name:p(r.name,`name`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.access.applications.policies.create({body:m,account_id:o,app_id:r[`app-id`]})),{successLabel:`Created`})}};function de(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const fe={command:`delete <policy-id>`,describe:`Deletes an Access policy specific to an application. To delete a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint.`,builder:de,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access applications policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/policies/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}`,pathParams:{"app-id":String(t[`app-id`]??``),"policy-id":String(t[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.applications.policies.delete({account_id:r,app_id:t[`app-id`],policy_id:t[`policy-id`]})),{successLabel:`Deleted`})}};function pe(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const me={command:`get <policy-id>`,describe:`Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.`,builder:pe,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access applications policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/policies/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}`,pathParams:{"app-id":String(t[`app-id`]??``),"policy-id":String(t[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.applications.policies.get({account_id:r,app_id:t[`app-id`],policy_id:t[`policy-id`]})),{successLabel:`Loaded`})}};function he(e){return e.option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ge={command:`list`,describe:`Lists Access policies configured for an application. Returns both exclusively scoped and reusable policies used by the application.`,builder:he,handler:async t=>{let n={page:t.page,per_page:t[`per-page`]};if(t.dryRun){d({command:`cf zero-trust access applications policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/policies`,pathParams:{"app-id":String(t[`app-id`]??``)},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.access.applications.policies.list({account_id:i,app_id:t[`app-id`],...n})),{successLabel:`Loaded`})}};function _e(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy within an app.
-`}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`}).option(`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`,{type:`string`,array:!0,description:`Clipboard formats allowed when copying from local machine to remote RDP session.`}).option(`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`,{type:`string`,array:!0,description:`Clipboard formats allowed when copying from remote RDP session to local machine.`}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:`Lists the MFA methods that users can authenticate with.`}).option(`mfa-config-mfa-disabled`,{type:`boolean`,description:`Indicates whether to disable MFA for this resource. This option is available at the application and policy level.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ve={command:`update <policy-id>`,describe:`Updates an Access policy specific to an application. To update a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint.`,builder:_e,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust access applications policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps/${r[`app-id`]==null?`<app-id>`:encodeURIComponent(String(r[`app-id`]))}/policies/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"app-id":String(r[`app-id`]??``),"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?l({precedence:r.precedence,approval_required:r[`approval-required`],connection_rules:{rdp:{allowed_clipboard_local_to_remote_formats:r[`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`],allowed_clipboard_remote_to_local_formats:r[`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`]}},isolation_required:r[`isolation-required`],mfa_config:{allowed_authenticators:r[`mfa-config-allowed-authenticators`],mfa_disabled:r[`mfa-config-mfa-disabled`],session_duration:p(r[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},purpose_justification_prompt:p(r[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:r[`purpose-justification-required`],session_duration:p(r[`session-duration`],`session-duration`,`text`),decision:p(r.decision,`decision`,`text`),name:p(r.name,`name`,`text`)}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Updating`,async()=>i.zeroTrust.access.applications.policies.update({body:e,account_id:o,app_id:r[`app-id`],policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}r.decision===void 0&&(r.decision=await n(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),r.name===void 0&&(r.name=await t(`name`,`The name of the Access policy.`));let m=l({precedence:r.precedence,approval_required:r[`approval-required`],connection_rules:{rdp:{allowed_clipboard_local_to_remote_formats:r[`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`],allowed_clipboard_remote_to_local_formats:r[`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`]}},isolation_required:r[`isolation-required`],mfa_config:{allowed_authenticators:r[`mfa-config-allowed-authenticators`],mfa_disabled:r[`mfa-config-mfa-disabled`],session_duration:p(r[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},purpose_justification_prompt:p(r[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:r[`purpose-justification-required`],session_duration:p(r[`session-duration`],`session-duration`,`text`),decision:p(r.decision,`decision`,`text`),name:p(r.name,`name`,`text`)});u(await f(`Updating`,async()=>i.zeroTrust.access.applications.policies.update({body:m,account_id:o,app_id:r[`app-id`],policy_id:r[`policy-id`]})),{successLabel:`Updated`})}},ye={command:`policies`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(ue).command(fe).command(me).command(ge).command(ve).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function be(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xe={command:`create`,describe:`Starts an Access policy test.`,builder:be,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access applications policy-tests create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/policy-tests`,pathParams:{},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.access.applications.policyTests.create({...e,account_id:r})),{successLabel:`Created`});return}u(await f(`Creating`,async()=>n.zeroTrust.access.applications.policyTests.create({account_id:r})),{successLabel:`Created`})}};function Se(e){return e.positional(`policy-test-id`,{type:`string`,description:`The UUID of the policy test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ce={command:`get <policy-test-id>`,describe:`Fetches the current status of a given Access policy test.`,builder:Se,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access applications policy-tests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/policy-tests/${t[`policy-test-id`]==null?`<policy-test-id>`:encodeURIComponent(String(t[`policy-test-id`]))}`,pathParams:{"policy-test-id":String(t[`policy-test-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.applications.policyTests.get({account_id:r,policy_test_id:t[`policy-test-id`]})),{successLabel:`Loaded`})}};function we(e){return e.option(`policy-test-id`,{type:`string`,description:`The UUID of the policy test.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`status`,{type:`string`,description:`Filter users by their policy evaluation status.`,choices:[`success`,`fail`,`error`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Te={command:`list`,describe:`Fetches a single page of user results from an Access policy test.`,builder:g(we),handler:async t=>{let n={page:t.page,per_page:t[`per-page`],status:t.status};if(t.dryRun){d({command:`cf zero-trust access applications policy-tests users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/policy-tests/${t[`policy-test-id`]==null?`<policy-test-id>`:encodeURIComponent(String(t[`policy-test-id`]))}/users`,pathParams:{"policy-test-id":String(t[`policy-test-id`]??``)},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.access.applications.policyTests.users.list({account_id:i,policy_test_id:t[`policy-test-id`],...n})),{successLabel:`Loaded`})}},Ee={command:`users`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Te).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},De={command:`policy-tests`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(xe).command(Ce).command(Ee).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Oe(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ke={command:`revoke-tokens <app-id>`,describe:`Revokes all tokens issued for an application.`,builder:Oe,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access applications revoke-tokens`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/revoke_tokens`,pathParams:{"app-id":String(t[`app-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force,message:`This operation invalidates every service token for the app.`})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.applications.revokeTokens({account_id:r,app_id:t[`app-id`]})),{successLabel:`Deleted`})}};function Ae(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const je={command:`edit <app-id>`,describe:`Updates Access application settings.`,builder:Ae,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access applications settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/settings`,pathParams:{"app-id":String(t[`app-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({allow_iframe:t[`allow-iframe`],skip_interstitial:t[`skip-interstitial`]}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.access.applications.settings.edit({body:e,account_id:r,app_id:t[`app-id`]})),{successLabel:`Updated`});return}let i=l({allow_iframe:t[`allow-iframe`],skip_interstitial:t[`skip-interstitial`]});u(await f(`Updating`,async()=>n.zeroTrust.access.applications.settings.edit({body:i,account_id:r,app_id:t[`app-id`]})),{successLabel:`Updated`})}};function Me(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ne={command:`update <app-id>`,describe:`Updates Access application settings.`,builder:Me,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access applications settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/settings`,pathParams:{"app-id":String(t[`app-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({allow_iframe:t[`allow-iframe`],skip_interstitial:t[`skip-interstitial`]}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.access.applications.settings.update({body:e,account_id:r,app_id:t[`app-id`]})),{successLabel:`Updated`});return}let i=l({allow_iframe:t[`allow-iframe`],skip_interstitial:t[`skip-interstitial`]});u(await f(`Updating`,async()=>n.zeroTrust.access.applications.settings.update({body:i,account_id:r,app_id:t[`app-id`]})),{successLabel:`Updated`})}},Pe={command:`settings`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(je).command(Ne).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Fe(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ie={command:`update <app-id>`,describe:`Updates an Access application.`,builder:Fe,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access applications update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}`,pathParams:{"app-id":String(t[`app-id`]??``)},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.access.applications.update({body:e,account_id:r,app_id:t[`app-id`]})),{successLabel:`Updated`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Le(e){return e.option(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Re={command:`list`,describe:`Tests if a specific user has permission to access an application.`,builder:Le,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access applications user-policy-checks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/user_policy_checks`,pathParams:{"app-id":String(t[`app-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.applications.userPolicyChecks.list({account_id:r,app_id:t[`app-id`]})),{successLabel:`Loaded`})}},ze={command:`user-policy-checks`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Re).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Be={command:`applications`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(ne).command(ie).command(oe).command(ce).command(ke).command(Ie).command(Z).command(ye).command(De).command(Pe).command(ze).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ve(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const He={command:`create <bookmark-id>`,describe:`Create a new Bookmark application.`,builder:Ve,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access bookmarks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/bookmarks/${t[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(t[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(t[`bookmark-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Creating`,async()=>n.zeroTrust.access.bookmarks.create({account_id:r,bookmark_id:t[`bookmark-id`]})),{successLabel:`Created`})}};function Ue(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const We={command:`delete <bookmark-id>`,describe:`Deletes a Bookmark application.`,builder:Ue,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access bookmarks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/bookmarks/${t[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(t[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(t[`bookmark-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.bookmarks.delete({account_id:r,bookmark_id:t[`bookmark-id`]})),{successLabel:`Deleted`})}};function Ge(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ke={command:`get <bookmark-id>`,describe:`Fetches a single Bookmark application.`,builder:Ge,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access bookmarks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/bookmarks/${t[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(t[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(t[`bookmark-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.bookmarks.get({account_id:r,bookmark_id:t[`bookmark-id`]})),{successLabel:`Loaded`})}};function qe(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Je={command:`list`,describe:`Lists Bookmark applications.`,builder:qe,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access bookmarks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/bookmarks`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.bookmarks.list({account_id:r})),{successLabel:`Loaded`})}};function Ye(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xe={command:`update <bookmark-id>`,describe:`Updates a configured Bookmark application.`,builder:Ye,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access bookmarks update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/bookmarks/${t[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(t[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(t[`bookmark-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Updating`,async()=>n.zeroTrust.access.bookmarks.update({account_id:r,bookmark_id:t[`bookmark-id`]})),{successLabel:`Updated`})}},Ze={command:`bookmarks`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(He).command(We).command(Ke).command(Je).command(Xe).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qe(e){return e.option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`certificate`,{type:`string`,description:`The certificate content.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const $e={command:`create`,describe:`Adds a new mTLS root certificate to Access.`,builder:Qe,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/certificates`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({associated_hostnames:n[`associated-hostnames`],certificate:p(n.certificate,`certificate`,`text`),name:p(n.name,`name`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.access.certificates.create({...e,account_id:i})),{successLabel:`Created`});return}n.certificate===void 0&&(n.certificate=await t(`certificate`,`The certificate content.`)),n.name===void 0&&(n.name=await t(`name`,`The name of the certificate.`));let o=l({associated_hostnames:n[`associated-hostnames`],certificate:p(n.certificate,`certificate`,`text`),name:p(n.name,`name`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.access.certificates.create({...o,account_id:i})),{successLabel:`Created`})}};function et(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const tt={command:`delete <certificate-id>`,describe:`Deletes an mTLS certificate.`,builder:et,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/certificates/${t[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(t[`certificate-id`]))}`,pathParams:{"certificate-id":String(t[`certificate-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.certificates.delete({account_id:r,certificate_id:t[`certificate-id`]})),{successLabel:`Deleted`})}};function nt(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const rt={command:`get <certificate-id>`,describe:`Fetches a single mTLS certificate.`,builder:nt,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/certificates/${t[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(t[`certificate-id`]))}`,pathParams:{"certificate-id":String(t[`certificate-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.certificates.get({account_id:r,certificate_id:t[`certificate-id`]})),{successLabel:`Loaded`})}};function it(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const at={command:`list`,describe:`Lists all mTLS root certificates.`,builder:it,handler:async t=>{let n={page:t.page,per_page:t[`per-page`]};if(t.dryRun){d({command:`cf zero-trust access certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/certificates`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.access.certificates.list({account_id:i,...n})),{successLabel:`Loaded`})}};function ot(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const st={command:`get`,describe:`List all mTLS hostname settings for this account.`,builder:ot,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access certificates settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/certificates/settings`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.certificates.settings.get({account_id:r})),{successLabel:`Loaded`})}};function ct(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const lt={command:`update`,describe:`Updates an mTLS certificate's hostname settings.`,builder:ct,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access certificates settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/certificates/settings`,pathParams:{},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.access.certificates.settings.update({...e,account_id:r})),{successLabel:`Updated`});return}u(await f(`Updating`,async()=>o(n,`PUT`,`/accounts/${r}/access/certificates/settings`)),{successLabel:`Updated`})}},ut={command:`settings`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(st).command(lt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function dt(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ft={command:`update <certificate-id>`,describe:`Updates a configured mTLS certificate.`,builder:dt,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access certificates update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/certificates/${t[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(t[`certificate-id`]))}`,pathParams:{"certificate-id":String(t[`certificate-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({associated_hostnames:t[`associated-hostnames`],name:p(t.name,`name`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.access.certificates.update({...e,account_id:r,certificate_id:t[`certificate-id`]})),{successLabel:`Updated`});return}if(t[`associated-hostnames`]===void 0)throw Error(`--associated-hostnames is required (or pass --body with this field set).`);let i=l({associated_hostnames:t[`associated-hostnames`],name:p(t.name,`name`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.access.certificates.update({...i,account_id:r,certificate_id:t[`certificate-id`]})),{successLabel:`Updated`})}},pt={command:`certificates`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command($e).command(tt).command(rt).command(at).command(ft).command(ut).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function mt(e){return e.option(`app-count`,{type:`number`,description:`Number of apps the custom page is assigned to.`}).option(`custom-html`,{type:`string`,description:`Custom page HTML.`}).option(`name`,{type:`string`,description:`Custom page name.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`]}).option(`uid`,{type:`string`,description:`UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ht={command:`create`,describe:`Create a custom page`,builder:mt,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust access custom-pages create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/custom_pages`,pathParams:{},bodyKind:`json`,body:r.body===void 0?l({app_count:r[`app-count`],custom_html:p(r[`custom-html`],`custom-html`,`text`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`),uid:p(r.uid,`uid`,`text`)}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Creating`,async()=>i.zeroTrust.access.customPages.create({body:e,account_id:o})),{successLabel:`Created`});return}r[`custom-html`]===void 0&&(r[`custom-html`]=await t(`custom-html`,`Custom page HTML.`)),r.name===void 0&&(r.name=await t(`name`,`Custom page name.`)),r.type===void 0&&(r.type=await n(`type`,`Custom page type.`,[`identity_denied`,`forbidden`]));let m=l({app_count:r[`app-count`],custom_html:p(r[`custom-html`],`custom-html`,`text`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`),uid:p(r.uid,`uid`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.access.customPages.create({body:m,account_id:o})),{successLabel:`Created`})}};function gt(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const _t={command:`delete <custom-page-id>`,describe:`Delete a custom page`,builder:gt,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access custom-pages delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/custom_pages/${t[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(t[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(t[`custom-page-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.customPages.delete({account_id:r,custom_page_id:t[`custom-page-id`]})),{successLabel:`Deleted`})}};function vt(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yt={command:`get <custom-page-id>`,describe:`Fetches a custom page and also returns its HTML.`,builder:vt,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access custom-pages get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/custom_pages/${t[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(t[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(t[`custom-page-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.customPages.get({account_id:r,custom_page_id:t[`custom-page-id`]})),{successLabel:`Loaded`})}};function bt(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xt={command:`list`,describe:`List custom pages`,builder:bt,handler:async t=>{let n={page:t.page,per_page:t[`per-page`]};if(t.dryRun){d({command:`cf zero-trust access custom-pages list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/custom_pages`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.access.customPages.list({account_id:i,...n})),{successLabel:`Loaded`})}};function St(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-count`,{type:`number`,description:`Number of apps the custom page is assigned to.`}).option(`custom-html`,{type:`string`,description:`Custom page HTML.`}).option(`name`,{type:`string`,description:`Custom page name.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`]}).option(`uid`,{type:`string`,description:`UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ct={command:`update <custom-page-id>`,describe:`Update a custom page`,builder:St,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust access custom-pages update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/custom_pages/${r[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(r[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(r[`custom-page-id`]??``)},bodyKind:`json`,body:r.body===void 0?l({app_count:r[`app-count`],custom_html:p(r[`custom-html`],`custom-html`,`text`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`),uid:p(r.uid,`uid`,`text`)}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Updating`,async()=>i.zeroTrust.access.customPages.update({body:e,account_id:o,custom_page_id:r[`custom-page-id`]})),{successLabel:`Updated`});return}r[`custom-html`]===void 0&&(r[`custom-html`]=await t(`custom-html`,`Custom page HTML.`)),r.name===void 0&&(r.name=await t(`name`,`Custom page name.`)),r.type===void 0&&(r.type=await n(`type`,`Custom page type.`,[`identity_denied`,`forbidden`]));let m=l({app_count:r[`app-count`],custom_html:p(r[`custom-html`],`custom-html`,`text`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`),uid:p(r.uid,`uid`,`text`)});u(await f(`Updating`,async()=>i.zeroTrust.access.customPages.update({body:m,account_id:o,custom_page_id:r[`custom-page-id`]})),{successLabel:`Updated`})}},wt={command:`custom-pages`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(ht).command(_t).command(yt).command(xt).command(Ct).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Tt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Et={command:`create`,describe:`Adds a new SSH Certificate Authority (CA).`,builder:Tt,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access gateway-ca create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/gateway_ca`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Creating`,async()=>n.zeroTrust.access.gatewayCa.create({account_id:r})),{successLabel:`Created`})}};function Dt(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ot={command:`delete <certificate-id>`,describe:`Deletes an SSH Certificate Authority.`,builder:Dt,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access gateway-ca delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/gateway_ca/${t[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(t[`certificate-id`]))}`,pathParams:{"certificate-id":String(t[`certificate-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.gatewayCa.delete({account_id:r,certificate_id:t[`certificate-id`]})),{successLabel:`Deleted`})}};function kt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const At={command:`list`,describe:`Lists SSH Certificate Authorities (CA).`,builder:kt,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access gateway-ca list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/gateway_ca`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.gatewayCa.list({account_id:r})),{successLabel:`Loaded`})}},jt={command:`gateway-ca`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Et).command(Ot).command(At).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Mt(e){return e.option(`is-default`,{type:`boolean`,description:`Whether this is the default group`}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Nt={command:`create`,describe:`Creates a new Access group.`,builder:Mt,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/groups`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({is_default:n[`is-default`],name:p(n.name,`name`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.access.groups.create({...e,account_id:i})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await t(`name`,`The name of the Access group.`));let o=l({is_default:n[`is-default`],name:p(n.name,`name`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.access.groups.create({...o,account_id:i})),{successLabel:`Created`})}};function Pt(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ft={command:`delete <group-id>`,describe:`Deletes an Access group.`,builder:Pt,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/groups/${t[`group-id`]==null?`<group-id>`:encodeURIComponent(String(t[`group-id`]))}`,pathParams:{"group-id":String(t[`group-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.groups.delete({account_id:r,group_id:t[`group-id`]})),{successLabel:`Deleted`})}};function It(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Lt={command:`get <group-id>`,describe:`Fetches a single Access group.`,builder:It,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/groups/${t[`group-id`]==null?`<group-id>`:encodeURIComponent(String(t[`group-id`]))}`,pathParams:{"group-id":String(t[`group-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.groups.get({account_id:r,group_id:t[`group-id`]})),{successLabel:`Loaded`})}};function Rt(e){return e.option(`name`,{type:`string`,description:`The name of the group.`}).option(`search`,{type:`string`,description:`Search for groups by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zt={command:`list`,describe:`Lists all Access groups.`,builder:Rt,handler:async t=>{let n={name:t.name,search:t.search,page:t.page,per_page:t[`per-page`]};if(t.dryRun){d({command:`cf zero-trust access groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/groups`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.access.groups.list({account_id:i,...n})),{successLabel:`Loaded`})}};function Bt(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`is-default`,{type:`boolean`,description:`Whether this is the default group`}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Vt={command:`update <group-id>`,describe:`Updates a configured Access group.`,builder:Bt,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/groups/${n[`group-id`]==null?`<group-id>`:encodeURIComponent(String(n[`group-id`]))}`,pathParams:{"group-id":String(n[`group-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({is_default:n[`is-default`],name:p(n.name,`name`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Updating`,async()=>r.zeroTrust.access.groups.update({...e,account_id:i,group_id:n[`group-id`]})),{successLabel:`Updated`});return}n.name===void 0&&(n.name=await t(`name`,`The name of the Access group.`));let o=l({is_default:n[`is-default`],name:p(n.name,`name`,`text`)});u(await f(`Updating`,async()=>r.zeroTrust.access.groups.update({...o,account_id:i,group_id:n[`group-id`]})),{successLabel:`Updated`})}},Ht={command:`groups`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Nt).command(Ft).command(Lt).command(zt).command(Vt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ut(e){return e.option(`target-ids`,{type:`string`,array:!0,description:`List of target IDs to bulk delete`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wt={command:`bulk-delete-v2`,describe:`Removes one or more targets.`,builder:Ut,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access infrastructure targets bulk-delete-v2`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/infrastructure/targets/batch_delete`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({target_ids:t[`target-ids`]}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force,message:`This operation bulk-deletes infrastructure targets destructively.`})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=c(t.body);u(await f(`Deleting`,async()=>n.zeroTrust.access.infrastructure.targets.bulkDeleteV2({...e,account_id:r})),{successLabel:`Deleted`});return}if(t[`target-ids`]===void 0)throw Error(`--target-ids is required (or pass --body with this field set).`);let o=l({target_ids:t[`target-ids`]});u(await f(`Deleting`,async()=>n.zeroTrust.access.infrastructure.targets.bulkDeleteV2({...o,account_id:r})),{successLabel:`Deleted`})}};function Gt(e){return e.option(`target-ids`,{type:`string`,array:!0,description:`List of target IDs to bulk delete`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Kt={command:`bulk-delete`,describe:`Removes one or more targets.`,builder:Gt,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access infrastructure targets bulk-delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/infrastructure/targets/batch`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({target_ids:t[`target-ids`]}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=c(t.body);u(await f(`Deleting`,async()=>n.zeroTrust.access.infrastructure.targets.bulkDelete({...e,account_id:r})),{successLabel:`Deleted`});return}if(t[`target-ids`]===void 0)throw Error(`--target-ids is required (or pass --body with this field set).`);let o=l({target_ids:t[`target-ids`]});u(await f(`Deleting`,async()=>n.zeroTrust.access.infrastructure.targets.bulkDelete({...o,account_id:r})),{successLabel:`Deleted`})}};function qt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Jt={command:`bulk-update`,describe:`Adds one or more targets.`,builder:qt,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access infrastructure targets bulk-update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/infrastructure/targets/batch`,pathParams:{},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.access.infrastructure.targets.bulkUpdate({body:e,account_id:r})),{successLabel:`Updated`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Yt(e){return e.option(`hostname`,{type:`string`,description:`A non-unique field that refers to a target. Case insensitive, maximum
+import{E as e,S as t,T as n,g as r,w as i,x as a}from"./oauth-Bk-F-tIO.mjs";import{i as o,n as s}from"./auth-CSC4yhEJ.mjs";import{n as c,t as l}from"./body-parser-DWSy7uZ8.mjs";import{t as u}from"./output-B6fBFRqe.mjs";import{n as d,t as f}from"./progress-DrDErV9w.mjs";import{n as p,t as m}from"./input-validation-_fMCApaH.mjs";import{t as h}from"./local-CYc9q7l2.mjs";import{t as g}from"./cli-types-BeyOc81z.mjs";import{n as ee,t as te}from"./raw-fetch-_n0lMAnD.mjs";function _(e){return e.option(`allow-code-mode`,{type:`boolean`,description:`Allow remote code execution in Dynamic Workers (beta)`,default:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`hostname`,{type:`string`,description:`The hostname field`}).option(`id`,{type:`string`,description:`portal id`}).option(`name`,{type:`string`,description:`The name field`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound MCP traffic through Zero Trust Secure Web Gateway`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const v={command:`create`,describe:`Creates a new MCP portal for managing AI tool access through Cloudflare Access.`,builder:_,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access ai-controls mcp portals create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/ai-controls/mcp/portals`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({allow_code_mode:n[`allow-code-mode`],description:p(n.description,`description`,`text`),hostname:p(n.hostname,`hostname`,`text`),id:p(n.id,`id`,`text`),name:p(n.name,`name`,`text`),secure_web_gateway:n[`secure-web-gateway`]}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.access.aiControls.mcp.portals.create({...e,account_id:a})),{successLabel:`Created`});return}n.hostname===void 0&&(n.hostname=await e(`hostname`,`The hostname field`)),n.id===void 0&&(n.id=await e(`id`,`portal id`)),n.name===void 0&&(n.name=await e(`name`,`The name field`));let o=l({allow_code_mode:n[`allow-code-mode`],description:p(n.description,`description`,`text`),hostname:p(n.hostname,`hostname`,`text`),id:p(n.id,`id`,`text`),name:p(n.name,`name`,`text`),secure_web_gateway:n[`secure-web-gateway`]});u(await f(`Creating`,async()=>i.zeroTrust.access.aiControls.mcp.portals.create({...o,account_id:a})),{successLabel:`Created`})}};function y(e){return e.positional(`id`,{type:`string`,description:`portal id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const b={command:`delete <id>`,describe:`Deletes an MCP portal from the account.`,builder:y,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access ai-controls mcp portals delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/ai-controls/mcp/portals/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.aiControls.mcp.portals.delete({account_id:a,id:e.id})),{successLabel:`Deleted`})}};function x(e){return e.option(`page`,{type:`number`,description:`Page`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`search`,{type:`string`,description:`Search by id, name, hostname`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const S={command:`list`,describe:`Lists all MCP portals configured for the account.`,builder:x,handler:async e=>{let n={page:e.page,per_page:e[`per-page`],search:e.search};if(e.dryRun){d({command:`cf zero-trust access ai-controls mcp portals list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/ai-controls/mcp/portals`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.access.aiControls.mcp.portals.list({account_id:a,...n})),{successLabel:`Loaded`})}};function C(e){return e.positional(`id`,{type:`string`,description:`portal id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const w={command:`read <id>`,describe:`Read the details of a single MCP Portal, including its configured servers.`,builder:C,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access ai-controls mcp portals read`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/ai-controls/mcp/portals/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.aiControls.mcp.portals.read({account_id:i,id:e.id})),{successLabel:`Loaded`})}};function T(e){return e.positional(`id`,{type:`string`,description:`portal id`,demandOption:!0}).option(`allow-code-mode`,{type:`boolean`,description:`Allow remote code execution in Dynamic Workers (beta)`}).option(`description`,{type:`string`,description:`The description field`}).option(`hostname`,{type:`string`,description:`The hostname field`}).option(`name`,{type:`string`,description:`The name field`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound MCP traffic through Zero Trust Secure Web Gateway`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const E={command:`update <id>`,describe:`Updates an MCP portal configuration.`,builder:T,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access ai-controls mcp portals update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/ai-controls/mcp/portals/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`json`,body:e.body===void 0?l({allow_code_mode:e[`allow-code-mode`],description:p(e.description,`description`,`text`),hostname:p(e.hostname,`hostname`,`text`),name:p(e.name,`name`,`text`),secure_web_gateway:e[`secure-web-gateway`]}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.access.aiControls.mcp.portals.update({...t,account_id:i,id:e.id})),{successLabel:`Updated`});return}let a=l({allow_code_mode:e[`allow-code-mode`],description:p(e.description,`description`,`text`),hostname:p(e.hostname,`hostname`,`text`),name:p(e.name,`name`,`text`),secure_web_gateway:e[`secure-web-gateway`]});u(await f(`Updating`,async()=>n.zeroTrust.access.aiControls.mcp.portals.update({...a,account_id:i,id:e.id})),{successLabel:`Updated`})}},D={command:`portals`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(v).command(b).command(S).command(w).command(E).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function O(e){return e.option(`auth-credentials`,{type:`string`,description:`The auth_credentials field`}).option(`auth-type`,{type:`string`,description:`The auth_type field`,choices:[`oauth`,`bearer`,`unauthenticated`]}).option(`client-secret`,{type:`string`,description:`Pre-registered OAuth client_secret. Write-only - accepted on create/update when auth_credentials.auth_mode is 'manual'. Stored AES-GCM-encrypted in server_oauth_secrets; never returned by read endpoints.`}).option(`description`,{type:`string`,description:`The description field`}).option(`hostname`,{type:`string`,description:`The hostname field`}).option(`id`,{type:`string`,description:`server id`}).option(`is-shared-oauth-callback-enabled`,{type:`boolean`,description:`When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker's per-env rollout mode KV key.`,default:!1}).option(`name`,{type:`string`,description:`The name field`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const k={command:`create`,describe:`Creates a new MCP portal for managing AI tool access through Cloudflare Access.`,builder:O,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust access ai-controls mcp servers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/ai-controls/mcp/servers`,pathParams:{},bodyKind:`json`,body:i.body===void 0?l({auth_credentials:p(i[`auth-credentials`],`auth-credentials`,`text`),auth_type:p(i[`auth-type`],`auth-type`,`text`),client_secret:p(i[`client-secret`],`client-secret`,`text`),description:p(i.description,`description`,`text`),hostname:p(i.hostname,`hostname`,`text`),id:p(i.id,`id`,`text`),is_shared_oauth_callback_enabled:i[`is-shared-oauth-callback-enabled`],name:p(i.name,`name`,`text`),secure_web_gateway:i[`secure-web-gateway`]}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Creating`,async()=>a.zeroTrust.access.aiControls.mcp.servers.create({...e,account_id:o})),{successLabel:`Created`});return}i[`auth-type`]===void 0&&(i[`auth-type`]=await n(`auth-type`,`The auth_type field`,[`oauth`,`bearer`,`unauthenticated`])),i.hostname===void 0&&(i.hostname=await e(`hostname`,`The hostname field`)),i.id===void 0&&(i.id=await e(`id`,`server id`)),i.name===void 0&&(i.name=await e(`name`,`The name field`));let m=l({auth_credentials:p(i[`auth-credentials`],`auth-credentials`,`text`),auth_type:p(i[`auth-type`],`auth-type`,`text`),client_secret:p(i[`client-secret`],`client-secret`,`text`),description:p(i.description,`description`,`text`),hostname:p(i.hostname,`hostname`,`text`),id:p(i.id,`id`,`text`),is_shared_oauth_callback_enabled:i[`is-shared-oauth-callback-enabled`],name:p(i.name,`name`,`text`),secure_web_gateway:i[`secure-web-gateway`]});u(await f(`Creating`,async()=>a.zeroTrust.access.aiControls.mcp.servers.create({...m,account_id:o})),{successLabel:`Created`})}};function A(e){return e.positional(`id`,{type:`string`,description:`server id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const j={command:`delete <id>`,describe:`Deletes an MCP portal from the account.`,builder:A,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access ai-controls mcp servers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/ai-controls/mcp/servers/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.aiControls.mcp.servers.delete({account_id:a,id:e.id})),{successLabel:`Deleted`})}};function M(e){return e.option(`page`,{type:`number`,description:`Page`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`search`,{type:`string`,description:`Search by id, name`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const N={command:`list`,describe:`Lists all MCP portals configured for the account.`,builder:M,handler:async e=>{let n={page:e.page,per_page:e[`per-page`],search:e.search};if(e.dryRun){d({command:`cf zero-trust access ai-controls mcp servers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/ai-controls/mcp/servers`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.access.aiControls.mcp.servers.list({account_id:a,...n})),{successLabel:`Loaded`})}};function P(e){return e.positional(`id`,{type:`string`,description:`server id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const F={command:`read <id>`,describe:`Retrieves gateway configuration for MCP portals.`,builder:P,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access ai-controls mcp servers read`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/ai-controls/mcp/servers/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.aiControls.mcp.servers.read({account_id:i,id:e.id})),{successLabel:`Loaded`})}};function I(e){return e.positional(`id`,{type:`string`,description:`portal id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const L={command:`sync <id>`,describe:`Syncs an MCP server's capabilities and returns the updated server state, including any connection errors.`,builder:I,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access ai-controls mcp servers sync`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/ai-controls/mcp/servers/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}/sync`,pathParams:{id:String(e.id??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Creating`,async()=>n.zeroTrust.access.aiControls.mcp.servers.sync({account_id:i,id:e.id})),{successLabel:`Created`})}};function R(e){return e.positional(`id`,{type:`string`,description:`server id`,demandOption:!0}).option(`auth-credentials`,{type:`string`,description:`The auth_credentials field`}).option(`client-secret`,{type:`string`,description:`Pre-registered OAuth client_secret. Write-only - accepted on create/update when auth_credentials.auth_mode is 'manual'. Stored AES-GCM-encrypted in server_oauth_secrets; never returned by read endpoints.`}).option(`description`,{type:`string`,description:`The description field`}).option(`is-shared-oauth-callback-enabled`,{type:`boolean`,description:`When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true. Effective behavior is gated by the gateway worker's per-env rollout mode KV key.`}).option(`name`,{type:`string`,description:`The name field`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const z={command:`update <id>`,describe:`Updates an MCP portal configuration.`,builder:R,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access ai-controls mcp servers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/ai-controls/mcp/servers/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`json`,body:e.body===void 0?l({auth_credentials:p(e[`auth-credentials`],`auth-credentials`,`text`),client_secret:p(e[`client-secret`],`client-secret`,`text`),description:p(e.description,`description`,`text`),is_shared_oauth_callback_enabled:e[`is-shared-oauth-callback-enabled`],name:p(e.name,`name`,`text`),secure_web_gateway:e[`secure-web-gateway`]}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.access.aiControls.mcp.servers.update({...t,account_id:i,id:e.id})),{successLabel:`Updated`});return}let a=l({auth_credentials:p(e[`auth-credentials`],`auth-credentials`,`text`),client_secret:p(e[`client-secret`],`client-secret`,`text`),description:p(e.description,`description`,`text`),is_shared_oauth_callback_enabled:e[`is-shared-oauth-callback-enabled`],name:p(e.name,`name`,`text`),secure_web_gateway:e[`secure-web-gateway`]});u(await f(`Updating`,async()=>n.zeroTrust.access.aiControls.mcp.servers.update({...a,account_id:i,id:e.id})),{successLabel:`Updated`})}},B={command:`servers`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(k).command(j).command(N).command(F).command(L).command(z).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},V={command:`mcp`,describe:`Operations for access.ai-controls.mcp`,builder:e=>e.command(D).command(B).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},H={command:`ai-controls`,describe:`Operations for access.ai-controls`,builder:e=>e.command(V).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function U(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const W={command:`create <app-id>`,describe:`Generates a new short-lived certificate CA and public key.`,builder:U,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access applications cas create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Creating`,async()=>n.zeroTrust.access.applications.cas.create({account_id:i,app_id:e[`app-id`]})),{successLabel:`Created`})}};function G(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const K={command:`delete <app-id>`,describe:`Deletes a short-lived certificate CA.`,builder:G,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access applications cas delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.applications.cas.delete({account_id:a,app_id:e[`app-id`]})),{successLabel:`Deleted`})}};function q(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const J={command:`get <app-id>`,describe:`Fetches a short-lived certificate CA and its public key.`,builder:q,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access applications cas get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.applications.cas.get({account_id:i,app_id:e[`app-id`]})),{successLabel:`Loaded`})}};function Y(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const X={command:`list`,describe:`Lists short-lived certificate CAs and their public keys.`,builder:Y,handler:async e=>{let n={page:e.page,per_page:e[`per-page`]};if(e.dryRun){d({command:`cf zero-trust access applications cas list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps/ca`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.access.applications.cas.list({account_id:a,...n})),{successLabel:`Loaded`})}},Z={command:`cas`,describe:`Operations for access.applications.cas`,builder:e=>e.command(W).command(K).command(J).command(X).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Q(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ne={command:`create`,describe:`Adds a new application to Access.`,builder:Q,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access applications create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.access.applications.create({body:t,account_id:i})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function re(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ie={command:`delete <app-id>`,describe:`Deletes an application from Access.`,builder:re,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access applications delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.applications.delete({account_id:a,app_id:e[`app-id`]})),{successLabel:`Deleted`})}};function ae(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const oe={command:`get <app-id>`,describe:`Fetches information about an Access application.`,builder:ae,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access applications get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.applications.get({account_id:i,app_id:e[`app-id`]})),{successLabel:`Loaded`})}};function se(e){return e.option(`name`,{type:`string`,description:`The name of the app.`}).option(`domain`,{type:`string`,description:`The domain of the app.`}).option(`aud`,{type:`string`,description:`The aud of the app.`}).option(`target-attributes`,{type:`string`,description:`Target Criteria attributes in key=value format.`}).option(`exact`,{type:`boolean`,description:`True for only exact string matches against passed name/domain query parameters.`}).option(`search`,{type:`string`,description:`Search for apps by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ce={command:`list`,describe:`Lists all Access applications in an account.`,builder:se,handler:async e=>{let n={name:e.name,domain:e.domain,aud:e.aud,target_attributes:e[`target-attributes`],exact:e.exact,search:e.search,page:e.page,per_page:e[`per-page`]};if(e.dryRun){d({command:`cf zero-trust access applications list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.access.applications.list({account_id:a,...n})),{successLabel:`Loaded`})}};function le(e){return e.positional(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy within an app.
+`}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`}).option(`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`,{type:`string`,array:!0,description:`Clipboard formats allowed when copying from local machine to remote RDP session.`}).option(`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`,{type:`string`,array:!0,description:`Clipboard formats allowed when copying from remote RDP session to local machine.`}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:`Lists the MFA methods that users can authenticate with.`}).option(`mfa-config-mfa-disabled`,{type:`boolean`,description:`Indicates whether to disable MFA for this resource. This option is available at the application and policy level.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.",default:`24h`}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ue={command:`create <app-id>`,describe:`Creates a policy applying exclusive to a single application that defines the users or groups who can reach it. We recommend creating a reusable policy instead and subsequently referencing its ID in the application's 'policies' array.`,builder:le,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust access applications policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/policies`,pathParams:{"app-id":String(i[`app-id`]??``)},bodyKind:`json`,body:i.body===void 0?l({precedence:i.precedence,approval_required:i[`approval-required`],connection_rules:{rdp:{allowed_clipboard_local_to_remote_formats:i[`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`],allowed_clipboard_remote_to_local_formats:i[`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`]}},isolation_required:i[`isolation-required`],mfa_config:{allowed_authenticators:i[`mfa-config-allowed-authenticators`],mfa_disabled:i[`mfa-config-mfa-disabled`],session_duration:p(i[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},purpose_justification_prompt:p(i[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:i[`purpose-justification-required`],session_duration:p(i[`session-duration`],`session-duration`,`text`),decision:p(i.decision,`decision`,`text`),name:p(i.name,`name`,`text`)}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Creating`,async()=>a.zeroTrust.access.applications.policies.create({body:e,account_id:o,app_id:i[`app-id`]})),{successLabel:`Created`});return}i.decision===void 0&&(i.decision=await n(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),i.name===void 0&&(i.name=await e(`name`,`The name of the Access policy.`));let m=l({precedence:i.precedence,approval_required:i[`approval-required`],connection_rules:{rdp:{allowed_clipboard_local_to_remote_formats:i[`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`],allowed_clipboard_remote_to_local_formats:i[`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`]}},isolation_required:i[`isolation-required`],mfa_config:{allowed_authenticators:i[`mfa-config-allowed-authenticators`],mfa_disabled:i[`mfa-config-mfa-disabled`],session_duration:p(i[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},purpose_justification_prompt:p(i[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:i[`purpose-justification-required`],session_duration:p(i[`session-duration`],`session-duration`,`text`),decision:p(i.decision,`decision`,`text`),name:p(i.name,`name`,`text`)});u(await f(`Creating`,async()=>a.zeroTrust.access.applications.policies.create({body:m,account_id:o,app_id:i[`app-id`]})),{successLabel:`Created`})}};function de(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const fe={command:`delete <policy-id>`,describe:`Deletes an Access policy specific to an application. To delete a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint.`,builder:de,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access applications policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.applications.policies.delete({account_id:a,app_id:e[`app-id`],policy_id:e[`policy-id`]})),{successLabel:`Deleted`})}};function pe(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const me={command:`get <policy-id>`,describe:`Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.`,builder:pe,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access applications policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.applications.policies.get({account_id:i,app_id:e[`app-id`],policy_id:e[`policy-id`]})),{successLabel:`Loaded`})}};function he(e){return e.option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ge={command:`list`,describe:`Lists Access policies configured for an application. Returns both exclusively scoped and reusable policies used by the application.`,builder:he,handler:async e=>{let n={page:e.page,per_page:e[`per-page`]};if(e.dryRun){d({command:`cf zero-trust access applications policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies`,pathParams:{"app-id":String(e[`app-id`]??``)},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.access.applications.policies.list({account_id:a,app_id:e[`app-id`],...n})),{successLabel:`Loaded`})}};function _e(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy within an app.
+`}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`}).option(`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`,{type:`string`,array:!0,description:`Clipboard formats allowed when copying from local machine to remote RDP session.`}).option(`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`,{type:`string`,array:!0,description:`Clipboard formats allowed when copying from remote RDP session to local machine.`}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:`Lists the MFA methods that users can authenticate with.`}).option(`mfa-config-mfa-disabled`,{type:`boolean`,description:`Indicates whether to disable MFA for this resource. This option is available at the application and policy level.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ve={command:`update <policy-id>`,describe:`Updates an Access policy specific to an application. To update a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint.`,builder:_e,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust access applications policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps/${i[`app-id`]==null?`<app-id>`:encodeURIComponent(String(i[`app-id`]))}/policies/${i[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(i[`policy-id`]))}`,pathParams:{"app-id":String(i[`app-id`]??``),"policy-id":String(i[`policy-id`]??``)},bodyKind:`json`,body:i.body===void 0?l({precedence:i.precedence,approval_required:i[`approval-required`],connection_rules:{rdp:{allowed_clipboard_local_to_remote_formats:i[`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`],allowed_clipboard_remote_to_local_formats:i[`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`]}},isolation_required:i[`isolation-required`],mfa_config:{allowed_authenticators:i[`mfa-config-allowed-authenticators`],mfa_disabled:i[`mfa-config-mfa-disabled`],session_duration:p(i[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},purpose_justification_prompt:p(i[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:i[`purpose-justification-required`],session_duration:p(i[`session-duration`],`session-duration`,`text`),decision:p(i.decision,`decision`,`text`),name:p(i.name,`name`,`text`)}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Updating`,async()=>a.zeroTrust.access.applications.policies.update({body:e,account_id:o,app_id:i[`app-id`],policy_id:i[`policy-id`]})),{successLabel:`Updated`});return}i.decision===void 0&&(i.decision=await n(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),i.name===void 0&&(i.name=await e(`name`,`The name of the Access policy.`));let m=l({precedence:i.precedence,approval_required:i[`approval-required`],connection_rules:{rdp:{allowed_clipboard_local_to_remote_formats:i[`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`],allowed_clipboard_remote_to_local_formats:i[`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`]}},isolation_required:i[`isolation-required`],mfa_config:{allowed_authenticators:i[`mfa-config-allowed-authenticators`],mfa_disabled:i[`mfa-config-mfa-disabled`],session_duration:p(i[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},purpose_justification_prompt:p(i[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:i[`purpose-justification-required`],session_duration:p(i[`session-duration`],`session-duration`,`text`),decision:p(i.decision,`decision`,`text`),name:p(i.name,`name`,`text`)});u(await f(`Updating`,async()=>a.zeroTrust.access.applications.policies.update({body:m,account_id:o,app_id:i[`app-id`],policy_id:i[`policy-id`]})),{successLabel:`Updated`})}},ye={command:`policies`,describe:`Operations for access.applications.policies`,builder:e=>e.command(ue).command(fe).command(me).command(ge).command(ve).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function be(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xe={command:`create`,describe:`Starts an Access policy test.`,builder:be,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access applications policy-tests create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/policy-tests`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.access.applications.policyTests.create({...t,account_id:i})),{successLabel:`Created`});return}u(await f(`Creating`,async()=>n.zeroTrust.access.applications.policyTests.create({account_id:i})),{successLabel:`Created`})}};function Se(e){return e.positional(`policy-test-id`,{type:`string`,description:`The UUID of the policy test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ce={command:`get <policy-test-id>`,describe:`Fetches the current status of a given Access policy test.`,builder:Se,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access applications policy-tests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/policy-tests/${e[`policy-test-id`]==null?`<policy-test-id>`:encodeURIComponent(String(e[`policy-test-id`]))}`,pathParams:{"policy-test-id":String(e[`policy-test-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.applications.policyTests.get({account_id:i,policy_test_id:e[`policy-test-id`]})),{successLabel:`Loaded`})}};function we(e){return e.option(`policy-test-id`,{type:`string`,description:`The UUID of the policy test.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`status`,{type:`string`,description:`Filter users by their policy evaluation status.`,choices:[`success`,`fail`,`error`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Te={command:`list`,describe:`Fetches a single page of user results from an Access policy test.`,builder:g(we),handler:async e=>{let n={page:e.page,per_page:e[`per-page`],status:e.status};if(e.dryRun){d({command:`cf zero-trust access applications policy-tests users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/policy-tests/${e[`policy-test-id`]==null?`<policy-test-id>`:encodeURIComponent(String(e[`policy-test-id`]))}/users`,pathParams:{"policy-test-id":String(e[`policy-test-id`]??``)},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.access.applications.policyTests.users.list({account_id:a,policy_test_id:e[`policy-test-id`],...n})),{successLabel:`Loaded`})}},Ee={command:`users`,describe:`Operations for access.applications.policy-tests.users`,builder:e=>e.command(Te).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},De={command:`policy-tests`,describe:`Operations for access.applications.policy-tests`,builder:e=>e.command(xe).command(Ce).command(Ee).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Oe(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ke={command:`revoke-tokens <app-id>`,describe:`Revokes all tokens issued for an application.`,builder:Oe,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access applications revoke-tokens`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/revoke_tokens`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force,message:`This operation invalidates every service token for the app.`})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.applications.revokeTokens({account_id:a,app_id:e[`app-id`]})),{successLabel:`Deleted`})}};function Ae(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const je={command:`edit <app-id>`,describe:`Updates Access application settings.`,builder:Ae,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access applications settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/settings`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.access.applications.settings.edit({body:t,account_id:i,app_id:e[`app-id`]})),{successLabel:`Updated`});return}let a=l({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]});u(await f(`Updating`,async()=>n.zeroTrust.access.applications.settings.edit({body:a,account_id:i,app_id:e[`app-id`]})),{successLabel:`Updated`})}};function Me(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ne={command:`update <app-id>`,describe:`Updates Access application settings.`,builder:Me,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access applications settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/settings`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.access.applications.settings.update({body:t,account_id:i,app_id:e[`app-id`]})),{successLabel:`Updated`});return}let a=l({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]});u(await f(`Updating`,async()=>n.zeroTrust.access.applications.settings.update({body:a,account_id:i,app_id:e[`app-id`]})),{successLabel:`Updated`})}},Pe={command:`settings`,describe:`Operations for access.applications.settings`,builder:e=>e.command(je).command(Ne).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Fe(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ie={command:`update <app-id>`,describe:`Updates an Access application.`,builder:Fe,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access applications update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.access.applications.update({body:t,account_id:i,app_id:e[`app-id`]})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Le(e){return e.option(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Re={command:`list`,describe:`Tests if a specific user has permission to access an application.`,builder:Le,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access applications user-policy-checks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/user_policy_checks`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.applications.userPolicyChecks.list({account_id:i,app_id:e[`app-id`]})),{successLabel:`Loaded`})}},ze={command:`user-policy-checks`,describe:`Operations for access.applications.user-policy-checks`,builder:e=>e.command(Re).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Be={command:`applications`,describe:`Operations for access.applications`,builder:e=>e.command(ne).command(ie).command(oe).command(ce).command(ke).command(Ie).command(Z).command(ye).command(De).command(Pe).command(ze).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ve(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const He={command:`create <bookmark-id>`,describe:`Create a new Bookmark application.`,builder:Ve,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access bookmarks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/bookmarks/${e[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(e[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(e[`bookmark-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Creating`,async()=>n.zeroTrust.access.bookmarks.create({account_id:i,bookmark_id:e[`bookmark-id`]})),{successLabel:`Created`})}};function Ue(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const We={command:`delete <bookmark-id>`,describe:`Deletes a Bookmark application.`,builder:Ue,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access bookmarks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/bookmarks/${e[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(e[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(e[`bookmark-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.bookmarks.delete({account_id:a,bookmark_id:e[`bookmark-id`]})),{successLabel:`Deleted`})}};function Ge(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ke={command:`get <bookmark-id>`,describe:`Fetches a single Bookmark application.`,builder:Ge,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access bookmarks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/bookmarks/${e[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(e[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(e[`bookmark-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.bookmarks.get({account_id:i,bookmark_id:e[`bookmark-id`]})),{successLabel:`Loaded`})}};function qe(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Je={command:`list`,describe:`Lists Bookmark applications.`,builder:qe,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access bookmarks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/bookmarks`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.bookmarks.list({account_id:i})),{successLabel:`Loaded`})}};function Ye(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xe={command:`update <bookmark-id>`,describe:`Updates a configured Bookmark application.`,builder:Ye,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access bookmarks update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/bookmarks/${e[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(e[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(e[`bookmark-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Updating`,async()=>n.zeroTrust.access.bookmarks.update({account_id:i,bookmark_id:e[`bookmark-id`]})),{successLabel:`Updated`})}},Ze={command:`bookmarks`,describe:`Operations for access.bookmarks`,builder:e=>e.command(He).command(We).command(Ke).command(Je).command(Xe).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qe(e){return e.option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`certificate`,{type:`string`,description:`The certificate content.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const $e={command:`create`,describe:`Adds a new mTLS root certificate to Access.`,builder:Qe,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/certificates`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({associated_hostnames:n[`associated-hostnames`],certificate:p(n.certificate,`certificate`,`text`),name:p(n.name,`name`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.access.certificates.create({...e,account_id:a})),{successLabel:`Created`});return}n.certificate===void 0&&(n.certificate=await e(`certificate`,`The certificate content.`)),n.name===void 0&&(n.name=await e(`name`,`The name of the certificate.`));let o=l({associated_hostnames:n[`associated-hostnames`],certificate:p(n.certificate,`certificate`,`text`),name:p(n.name,`name`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.access.certificates.create({...o,account_id:a})),{successLabel:`Created`})}};function et(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const tt={command:`delete <certificate-id>`,describe:`Deletes an mTLS certificate.`,builder:et,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.certificates.delete({account_id:a,certificate_id:e[`certificate-id`]})),{successLabel:`Deleted`})}};function nt(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const rt={command:`get <certificate-id>`,describe:`Fetches a single mTLS certificate.`,builder:nt,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.certificates.get({account_id:i,certificate_id:e[`certificate-id`]})),{successLabel:`Loaded`})}};function it(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const at={command:`list`,describe:`Lists all mTLS root certificates.`,builder:it,handler:async e=>{let n={page:e.page,per_page:e[`per-page`]};if(e.dryRun){d({command:`cf zero-trust access certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/certificates`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.access.certificates.list({account_id:a,...n})),{successLabel:`Loaded`})}};function ot(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const st={command:`get`,describe:`List all mTLS hostname settings for this account.`,builder:ot,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access certificates settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/certificates/settings`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.certificates.settings.get({account_id:i})),{successLabel:`Loaded`})}};function ct(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const lt={command:`update`,describe:`Updates an mTLS certificate's hostname settings.`,builder:ct,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access certificates settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/certificates/settings`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.access.certificates.settings.update({...t,account_id:i})),{successLabel:`Updated`});return}u(await f(`Updating`,async()=>o(n,`PUT`,`/accounts/${i}/access/certificates/settings`)),{successLabel:`Updated`})}},ut={command:`settings`,describe:`Operations for access.certificates.settings`,builder:e=>e.command(st).command(lt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function dt(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ft={command:`update <certificate-id>`,describe:`Updates a configured mTLS certificate.`,builder:dt,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access certificates update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({associated_hostnames:e[`associated-hostnames`],name:p(e.name,`name`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.access.certificates.update({...t,account_id:i,certificate_id:e[`certificate-id`]})),{successLabel:`Updated`});return}if(e[`associated-hostnames`]===void 0)throw Error(`--associated-hostnames is required (or pass --body with this field set).`);let a=l({associated_hostnames:e[`associated-hostnames`],name:p(e.name,`name`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.access.certificates.update({...a,account_id:i,certificate_id:e[`certificate-id`]})),{successLabel:`Updated`})}},pt={command:`certificates`,describe:`Operations for access.certificates`,builder:e=>e.command($e).command(tt).command(rt).command(at).command(ft).command(ut).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function mt(e){return e.option(`app-count`,{type:`number`,description:`Number of apps the custom page is assigned to.`}).option(`custom-html`,{type:`string`,description:`Custom page HTML.`}).option(`name`,{type:`string`,description:`Custom page name.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`]}).option(`uid`,{type:`string`,description:`UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ht={command:`create`,describe:`Create a custom page`,builder:mt,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust access custom-pages create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/custom_pages`,pathParams:{},bodyKind:`json`,body:i.body===void 0?l({app_count:i[`app-count`],custom_html:p(i[`custom-html`],`custom-html`,`text`),name:p(i.name,`name`,`text`),type:p(i.type,`type`,`text`),uid:p(i.uid,`uid`,`text`)}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Creating`,async()=>a.zeroTrust.access.customPages.create({body:e,account_id:o})),{successLabel:`Created`});return}i[`custom-html`]===void 0&&(i[`custom-html`]=await e(`custom-html`,`Custom page HTML.`)),i.name===void 0&&(i.name=await e(`name`,`Custom page name.`)),i.type===void 0&&(i.type=await n(`type`,`Custom page type.`,[`identity_denied`,`forbidden`]));let m=l({app_count:i[`app-count`],custom_html:p(i[`custom-html`],`custom-html`,`text`),name:p(i.name,`name`,`text`),type:p(i.type,`type`,`text`),uid:p(i.uid,`uid`,`text`)});u(await f(`Creating`,async()=>a.zeroTrust.access.customPages.create({body:m,account_id:o})),{successLabel:`Created`})}};function gt(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const _t={command:`delete <custom-page-id>`,describe:`Delete a custom page`,builder:gt,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access custom-pages delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/custom_pages/${e[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(e[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(e[`custom-page-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.customPages.delete({account_id:a,custom_page_id:e[`custom-page-id`]})),{successLabel:`Deleted`})}};function vt(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yt={command:`get <custom-page-id>`,describe:`Fetches a custom page and also returns its HTML.`,builder:vt,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access custom-pages get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/custom_pages/${e[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(e[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(e[`custom-page-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.customPages.get({account_id:i,custom_page_id:e[`custom-page-id`]})),{successLabel:`Loaded`})}};function bt(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xt={command:`list`,describe:`List custom pages`,builder:bt,handler:async e=>{let n={page:e.page,per_page:e[`per-page`]};if(e.dryRun){d({command:`cf zero-trust access custom-pages list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/custom_pages`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.access.customPages.list({account_id:a,...n})),{successLabel:`Loaded`})}};function St(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-count`,{type:`number`,description:`Number of apps the custom page is assigned to.`}).option(`custom-html`,{type:`string`,description:`Custom page HTML.`}).option(`name`,{type:`string`,description:`Custom page name.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`]}).option(`uid`,{type:`string`,description:`UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ct={command:`update <custom-page-id>`,describe:`Update a custom page`,builder:St,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust access custom-pages update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/custom_pages/${i[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(i[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(i[`custom-page-id`]??``)},bodyKind:`json`,body:i.body===void 0?l({app_count:i[`app-count`],custom_html:p(i[`custom-html`],`custom-html`,`text`),name:p(i.name,`name`,`text`),type:p(i.type,`type`,`text`),uid:p(i.uid,`uid`,`text`)}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Updating`,async()=>a.zeroTrust.access.customPages.update({body:e,account_id:o,custom_page_id:i[`custom-page-id`]})),{successLabel:`Updated`});return}i[`custom-html`]===void 0&&(i[`custom-html`]=await e(`custom-html`,`Custom page HTML.`)),i.name===void 0&&(i.name=await e(`name`,`Custom page name.`)),i.type===void 0&&(i.type=await n(`type`,`Custom page type.`,[`identity_denied`,`forbidden`]));let m=l({app_count:i[`app-count`],custom_html:p(i[`custom-html`],`custom-html`,`text`),name:p(i.name,`name`,`text`),type:p(i.type,`type`,`text`),uid:p(i.uid,`uid`,`text`)});u(await f(`Updating`,async()=>a.zeroTrust.access.customPages.update({body:m,account_id:o,custom_page_id:i[`custom-page-id`]})),{successLabel:`Updated`})}},wt={command:`custom-pages`,describe:`Operations for access.custom-pages`,builder:e=>e.command(ht).command(_t).command(yt).command(xt).command(Ct).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Tt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Et={command:`create`,describe:`Adds a new SSH Certificate Authority (CA).`,builder:Tt,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access gateway-ca create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/gateway_ca`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Creating`,async()=>n.zeroTrust.access.gatewayCa.create({account_id:i})),{successLabel:`Created`})}};function Dt(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ot={command:`delete <certificate-id>`,describe:`Deletes an SSH Certificate Authority.`,builder:Dt,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access gateway-ca delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/gateway_ca/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.gatewayCa.delete({account_id:a,certificate_id:e[`certificate-id`]})),{successLabel:`Deleted`})}};function kt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const At={command:`list`,describe:`Lists SSH Certificate Authorities (CA).`,builder:kt,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access gateway-ca list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/gateway_ca`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.gatewayCa.list({account_id:i})),{successLabel:`Loaded`})}},jt={command:`gateway-ca`,describe:`Operations for access.gateway-ca`,builder:e=>e.command(Et).command(Ot).command(At).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Mt(e){return e.option(`is-default`,{type:`boolean`,description:`Whether this is the default group`}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Nt={command:`create`,describe:`Creates a new Access group.`,builder:Mt,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/groups`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({is_default:n[`is-default`],name:p(n.name,`name`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.access.groups.create({...e,account_id:a})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await e(`name`,`The name of the Access group.`));let o=l({is_default:n[`is-default`],name:p(n.name,`name`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.access.groups.create({...o,account_id:a})),{successLabel:`Created`})}};function Pt(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ft={command:`delete <group-id>`,describe:`Deletes an Access group.`,builder:Pt,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.groups.delete({account_id:a,group_id:e[`group-id`]})),{successLabel:`Deleted`})}};function It(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Lt={command:`get <group-id>`,describe:`Fetches a single Access group.`,builder:It,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.groups.get({account_id:i,group_id:e[`group-id`]})),{successLabel:`Loaded`})}};function Rt(e){return e.option(`name`,{type:`string`,description:`The name of the group.`}).option(`search`,{type:`string`,description:`Search for groups by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zt={command:`list`,describe:`Lists all Access groups.`,builder:Rt,handler:async e=>{let n={name:e.name,search:e.search,page:e.page,per_page:e[`per-page`]};if(e.dryRun){d({command:`cf zero-trust access groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/groups`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.access.groups.list({account_id:a,...n})),{successLabel:`Loaded`})}};function Bt(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`is-default`,{type:`boolean`,description:`Whether this is the default group`}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Vt={command:`update <group-id>`,describe:`Updates a configured Access group.`,builder:Bt,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/groups/${n[`group-id`]==null?`<group-id>`:encodeURIComponent(String(n[`group-id`]))}`,pathParams:{"group-id":String(n[`group-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({is_default:n[`is-default`],name:p(n.name,`name`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Updating`,async()=>i.zeroTrust.access.groups.update({...e,account_id:a,group_id:n[`group-id`]})),{successLabel:`Updated`});return}n.name===void 0&&(n.name=await e(`name`,`The name of the Access group.`));let o=l({is_default:n[`is-default`],name:p(n.name,`name`,`text`)});u(await f(`Updating`,async()=>i.zeroTrust.access.groups.update({...o,account_id:a,group_id:n[`group-id`]})),{successLabel:`Updated`})}},Ht={command:`groups`,describe:`Operations for access.groups`,builder:e=>e.command(Nt).command(Ft).command(Lt).command(zt).command(Vt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ut(e){return e.option(`target-ids`,{type:`string`,array:!0,description:`List of target IDs to bulk delete`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wt={command:`bulk-delete-v2`,describe:`Removes one or more targets.`,builder:Ut,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access infrastructure targets bulk-delete-v2`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/infrastructure/targets/batch_delete`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({target_ids:e[`target-ids`]}):c(e.body)});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force,message:`This operation bulk-deletes infrastructure targets destructively.`})){process.stderr.write(`Aborted.
+`);return}if(e.body){let t=c(e.body);u(await f(`Deleting`,async()=>n.zeroTrust.access.infrastructure.targets.bulkDeleteV2({...t,account_id:a})),{successLabel:`Deleted`});return}if(e[`target-ids`]===void 0)throw Error(`--target-ids is required (or pass --body with this field set).`);let o=l({target_ids:e[`target-ids`]});u(await f(`Deleting`,async()=>n.zeroTrust.access.infrastructure.targets.bulkDeleteV2({...o,account_id:a})),{successLabel:`Deleted`})}};function Gt(e){return e.option(`target-ids`,{type:`string`,array:!0,description:`List of target IDs to bulk delete`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Kt={command:`bulk-delete`,describe:`Removes one or more targets.`,builder:Gt,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access infrastructure targets bulk-delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/infrastructure/targets/batch`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({target_ids:e[`target-ids`]}):c(e.body)});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}if(e.body){let t=c(e.body);u(await f(`Deleting`,async()=>n.zeroTrust.access.infrastructure.targets.bulkDelete({...t,account_id:a})),{successLabel:`Deleted`});return}if(e[`target-ids`]===void 0)throw Error(`--target-ids is required (or pass --body with this field set).`);let o=l({target_ids:e[`target-ids`]});u(await f(`Deleting`,async()=>n.zeroTrust.access.infrastructure.targets.bulkDelete({...o,account_id:a})),{successLabel:`Deleted`})}};function qt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Jt={command:`bulk-update`,describe:`Adds one or more targets.`,builder:qt,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access infrastructure targets bulk-update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/infrastructure/targets/batch`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.access.infrastructure.targets.bulkUpdate({body:t,account_id:i})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Yt(e){return e.option(`hostname`,{type:`string`,description:`A non-unique field that refers to a target. Case insensitive, maximum
 length of 255 characters, supports the use of special characters dash
 and period, does not support spaces, and must start and end with an
-alphanumeric character.`}).option(`ip-ipv4-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv4-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`ip-ipv6-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv6-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Xt={command:`create`,describe:`Create new target`,builder:Yt,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access infrastructure targets create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/infrastructure/targets`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({hostname:p(n.hostname,`hostname`,`text`),ip:{ipv4:{ip_addr:p(n[`ip-ipv4-ip-addr`],`ip-ipv4-ip-addr`,`text`),virtual_network_id:p(n[`ip-ipv4-virtual-network-id`],`ip-ipv4-virtual-network-id`,`text`)},ipv6:{ip_addr:p(n[`ip-ipv6-ip-addr`],`ip-ipv6-ip-addr`,`text`),virtual_network_id:p(n[`ip-ipv6-virtual-network-id`],`ip-ipv6-virtual-network-id`,`text`)}}}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.access.infrastructure.targets.create({...e,account_id:i})),{successLabel:`Created`});return}n.hostname===void 0&&(n.hostname=await t(`hostname`,`A non-unique field that refers to a target. Case insensitive, maximum length of 255 characters, supports the use of special characters dash and period, does not support spaces, and must start and end with an alphanumeric character.`));let o=l({hostname:p(n.hostname,`hostname`,`text`),ip:{ipv4:{ip_addr:p(n[`ip-ipv4-ip-addr`],`ip-ipv4-ip-addr`,`text`),virtual_network_id:p(n[`ip-ipv4-virtual-network-id`],`ip-ipv4-virtual-network-id`,`text`)},ipv6:{ip_addr:p(n[`ip-ipv6-ip-addr`],`ip-ipv6-ip-addr`,`text`),virtual_network_id:p(n[`ip-ipv6-virtual-network-id`],`ip-ipv6-virtual-network-id`,`text`)}}});u(await f(`Creating`,async()=>r.zeroTrust.access.infrastructure.targets.create({...o,account_id:i})),{successLabel:`Created`})}};function Zt(e){return e.positional(`target-id`,{type:`string`,description:`Target identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Qt={command:`delete <target-id>`,describe:`Delete target`,builder:Zt,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access infrastructure targets delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/infrastructure/targets/${t[`target-id`]==null?`<target-id>`:encodeURIComponent(String(t[`target-id`]))}`,pathParams:{"target-id":String(t[`target-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.infrastructure.targets.delete({account_id:r,target_id:t[`target-id`]})),{successLabel:`Deleted`})}};function $t(e){return e.positional(`target-id`,{type:`string`,description:`Target identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const en={command:`get <target-id>`,describe:`Get target`,builder:$t,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access infrastructure targets get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/infrastructure/targets/${t[`target-id`]==null?`<target-id>`:encodeURIComponent(String(t[`target-id`]))}`,pathParams:{"target-id":String(t[`target-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.infrastructure.targets.get({account_id:r,target_id:t[`target-id`]})),{successLabel:`Loaded`})}};function tn(e){return e.option(`hostname`,{type:`string`,description:`Hostname of a target`}).option(`hostname-contains`,{type:`string`,description:`Partial match to the hostname of a target`}).option(`virtual-network-id`,{type:`string`,description:`Private virtual network identifier of the target`}).option(`ip-v4`,{type:`string`,description:`IPv4 address of the target`}).option(`ip-v6`,{type:`string`,description:`IPv6 address of the target`}).option(`created-before`,{type:`string`,description:`Date and time at which the target was created before (inclusive)`}).option(`created-after`,{type:`string`,description:`Date and time at which the target was created after (inclusive)`}).option(`modified-before`,{type:`string`,description:`Date and time at which the target was modified before (inclusive)`}).option(`modified-after`,{type:`string`,description:`Date and time at which the target was modified after (inclusive)`}).option(`ips`,{type:`string`,description:"Filters for targets that have any of the following IP addresses. Specify\n`ips` multiple times in query parameter to build list of candidates."}).option(`target-ids`,{type:`string`,description:`Filters for targets that have any of the following UUIDs. Specify
+alphanumeric character.`}).option(`ip-ipv4-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv4-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`ip-ipv6-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv6-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Xt={command:`create`,describe:`Create new target`,builder:Yt,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access infrastructure targets create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/infrastructure/targets`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({hostname:p(n.hostname,`hostname`,`text`),ip:{ipv4:{ip_addr:p(n[`ip-ipv4-ip-addr`],`ip-ipv4-ip-addr`,`text`),virtual_network_id:p(n[`ip-ipv4-virtual-network-id`],`ip-ipv4-virtual-network-id`,`text`)},ipv6:{ip_addr:p(n[`ip-ipv6-ip-addr`],`ip-ipv6-ip-addr`,`text`),virtual_network_id:p(n[`ip-ipv6-virtual-network-id`],`ip-ipv6-virtual-network-id`,`text`)}}}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.access.infrastructure.targets.create({...e,account_id:a})),{successLabel:`Created`});return}n.hostname===void 0&&(n.hostname=await e(`hostname`,`A non-unique field that refers to a target. Case insensitive, maximum length of 255 characters, supports the use of special characters dash and period, does not support spaces, and must start and end with an alphanumeric character.`));let o=l({hostname:p(n.hostname,`hostname`,`text`),ip:{ipv4:{ip_addr:p(n[`ip-ipv4-ip-addr`],`ip-ipv4-ip-addr`,`text`),virtual_network_id:p(n[`ip-ipv4-virtual-network-id`],`ip-ipv4-virtual-network-id`,`text`)},ipv6:{ip_addr:p(n[`ip-ipv6-ip-addr`],`ip-ipv6-ip-addr`,`text`),virtual_network_id:p(n[`ip-ipv6-virtual-network-id`],`ip-ipv6-virtual-network-id`,`text`)}}});u(await f(`Creating`,async()=>i.zeroTrust.access.infrastructure.targets.create({...o,account_id:a})),{successLabel:`Created`})}};function Zt(e){return e.positional(`target-id`,{type:`string`,description:`Target identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Qt={command:`delete <target-id>`,describe:`Delete target`,builder:Zt,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access infrastructure targets delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/infrastructure/targets/${e[`target-id`]==null?`<target-id>`:encodeURIComponent(String(e[`target-id`]))}`,pathParams:{"target-id":String(e[`target-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.infrastructure.targets.delete({account_id:a,target_id:e[`target-id`]})),{successLabel:`Deleted`})}};function $t(e){return e.positional(`target-id`,{type:`string`,description:`Target identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const en={command:`get <target-id>`,describe:`Get target`,builder:$t,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access infrastructure targets get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/infrastructure/targets/${e[`target-id`]==null?`<target-id>`:encodeURIComponent(String(e[`target-id`]))}`,pathParams:{"target-id":String(e[`target-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.infrastructure.targets.get({account_id:i,target_id:e[`target-id`]})),{successLabel:`Loaded`})}};function tn(e){return e.option(`hostname`,{type:`string`,description:`Hostname of a target`}).option(`hostname-contains`,{type:`string`,description:`Partial match to the hostname of a target`}).option(`virtual-network-id`,{type:`string`,description:`Private virtual network identifier of the target`}).option(`ip-v4`,{type:`string`,description:`IPv4 address of the target`}).option(`ip-v6`,{type:`string`,description:`IPv6 address of the target`}).option(`created-before`,{type:`string`,description:`Date and time at which the target was created before (inclusive)`}).option(`created-after`,{type:`string`,description:`Date and time at which the target was created after (inclusive)`}).option(`modified-before`,{type:`string`,description:`Date and time at which the target was modified before (inclusive)`}).option(`modified-after`,{type:`string`,description:`Date and time at which the target was modified after (inclusive)`}).option(`ips`,{type:`string`,description:"Filters for targets that have any of the following IP addresses. Specify\n`ips` multiple times in query parameter to build list of candidates."}).option(`target-ids`,{type:`string`,description:`Filters for targets that have any of the following UUIDs. Specify
 \`target_ids\` multiple times in query parameter to build list of
-candidates.`}).option(`ip-like`,{type:`string`,description:"Filters for targets whose IP addresses look like the specified string.\nSupports `*` as a wildcard character"}).option(`ipv4-start`,{type:`string`,description:"Defines an IPv4 filter range's starting value (inclusive). Requires\n`ipv4_end` to be specified as well."}).option(`ipv4-end`,{type:`string`,description:"Defines an IPv4 filter range's ending value (inclusive). Requires\n`ipv4_start` to be specified as well."}).option(`ipv6-start`,{type:`string`,description:"Defines an IPv6 filter range's starting value (inclusive). Requires\n`ipv6_end` to be specified as well."}).option(`ipv6-end`,{type:`string`,description:"Defines an IPv6 filter range's ending value (inclusive). Requires\n`ipv6_start` to be specified as well."}).option(`page`,{type:`number`,description:`Current page in the response`}).option(`per-page`,{type:`number`,description:`Max amount of entries returned per page`}).option(`order`,{type:`string`,description:`The field to sort by.`,choices:[`hostname`,`created_at`]}).option(`direction`,{type:`string`,description:`The sorting direction.`,choices:[`asc`,`desc`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const nn={command:`list`,describe:`Lists and sorts an account’s targets. Filters are optional and are ANDed together.`,builder:g(tn),handler:async t=>{let n={hostname:t.hostname,hostname_contains:t[`hostname-contains`],virtual_network_id:t[`virtual-network-id`],ip_v4:t[`ip-v4`],ip_v6:t[`ip-v6`],created_before:t[`created-before`],created_after:t[`created-after`],modified_before:t[`modified-before`],modified_after:t[`modified-after`],ips:t.ips,target_ids:t[`target-ids`],ip_like:t[`ip-like`],ipv4_start:t[`ipv4-start`],ipv4_end:t[`ipv4-end`],ipv6_start:t[`ipv6-start`],ipv6_end:t[`ipv6-end`],page:t.page,per_page:t[`per-page`],order:t.order,direction:t.direction};if(t.dryRun){d({command:`cf zero-trust access infrastructure targets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/infrastructure/targets`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.access.infrastructure.targets.list({account_id:i,...n})),{successLabel:`Loaded`})}};function rn(e){return e.positional(`target-id`,{type:`string`,description:`Target identifier`,demandOption:!0}).option(`hostname`,{type:`string`,description:`A non-unique field that refers to a target. Case insensitive, maximum
+candidates.`}).option(`ip-like`,{type:`string`,description:"Filters for targets whose IP addresses look like the specified string.\nSupports `*` as a wildcard character"}).option(`ipv4-start`,{type:`string`,description:"Defines an IPv4 filter range's starting value (inclusive). Requires\n`ipv4_end` to be specified as well."}).option(`ipv4-end`,{type:`string`,description:"Defines an IPv4 filter range's ending value (inclusive). Requires\n`ipv4_start` to be specified as well."}).option(`ipv6-start`,{type:`string`,description:"Defines an IPv6 filter range's starting value (inclusive). Requires\n`ipv6_end` to be specified as well."}).option(`ipv6-end`,{type:`string`,description:"Defines an IPv6 filter range's ending value (inclusive). Requires\n`ipv6_start` to be specified as well."}).option(`page`,{type:`number`,description:`Current page in the response`}).option(`per-page`,{type:`number`,description:`Max amount of entries returned per page`}).option(`order`,{type:`string`,description:`The field to sort by.`,choices:[`hostname`,`created_at`]}).option(`direction`,{type:`string`,description:`The sorting direction.`,choices:[`asc`,`desc`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const nn={command:`list`,describe:`Lists and sorts an account’s targets. Filters are optional and are ANDed together.`,builder:g(tn),handler:async e=>{let n={hostname:e.hostname,hostname_contains:e[`hostname-contains`],virtual_network_id:e[`virtual-network-id`],ip_v4:e[`ip-v4`],ip_v6:e[`ip-v6`],created_before:e[`created-before`],created_after:e[`created-after`],modified_before:e[`modified-before`],modified_after:e[`modified-after`],ips:e.ips,target_ids:e[`target-ids`],ip_like:e[`ip-like`],ipv4_start:e[`ipv4-start`],ipv4_end:e[`ipv4-end`],ipv6_start:e[`ipv6-start`],ipv6_end:e[`ipv6-end`],page:e.page,per_page:e[`per-page`],order:e.order,direction:e.direction};if(e.dryRun){d({command:`cf zero-trust access infrastructure targets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/infrastructure/targets`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.access.infrastructure.targets.list({account_id:a,...n})),{successLabel:`Loaded`})}};function rn(e){return e.positional(`target-id`,{type:`string`,description:`Target identifier`,demandOption:!0}).option(`hostname`,{type:`string`,description:`A non-unique field that refers to a target. Case insensitive, maximum
 length of 255 characters, supports the use of special characters dash
 and period, does not support spaces, and must start and end with an
-alphanumeric character.`}).option(`ip-ipv4-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv4-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`ip-ipv6-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv6-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const an={command:`update <target-id>`,describe:`Update target`,builder:rn,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access infrastructure targets update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/infrastructure/targets/${n[`target-id`]==null?`<target-id>`:encodeURIComponent(String(n[`target-id`]))}`,pathParams:{"target-id":String(n[`target-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({hostname:p(n.hostname,`hostname`,`text`),ip:{ipv4:{ip_addr:p(n[`ip-ipv4-ip-addr`],`ip-ipv4-ip-addr`,`text`),virtual_network_id:p(n[`ip-ipv4-virtual-network-id`],`ip-ipv4-virtual-network-id`,`text`)},ipv6:{ip_addr:p(n[`ip-ipv6-ip-addr`],`ip-ipv6-ip-addr`,`text`),virtual_network_id:p(n[`ip-ipv6-virtual-network-id`],`ip-ipv6-virtual-network-id`,`text`)}}}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Updating`,async()=>r.zeroTrust.access.infrastructure.targets.update({...e,account_id:i,target_id:n[`target-id`]})),{successLabel:`Updated`});return}n.hostname===void 0&&(n.hostname=await t(`hostname`,`A non-unique field that refers to a target. Case insensitive, maximum length of 255 characters, supports the use of special characters dash and period, does not support spaces, and must start and end with an alphanumeric character.`));let o=l({hostname:p(n.hostname,`hostname`,`text`),ip:{ipv4:{ip_addr:p(n[`ip-ipv4-ip-addr`],`ip-ipv4-ip-addr`,`text`),virtual_network_id:p(n[`ip-ipv4-virtual-network-id`],`ip-ipv4-virtual-network-id`,`text`)},ipv6:{ip_addr:p(n[`ip-ipv6-ip-addr`],`ip-ipv6-ip-addr`,`text`),virtual_network_id:p(n[`ip-ipv6-virtual-network-id`],`ip-ipv6-virtual-network-id`,`text`)}}});u(await f(`Updating`,async()=>r.zeroTrust.access.infrastructure.targets.update({...o,account_id:i,target_id:n[`target-id`]})),{successLabel:`Updated`})}},on={command:`targets`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Kt).command(Wt).command(Jt).command(Xt).command(Qt).command(en).command(nn).command(an).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},sn={command:`infrastructure`,describe:`Operations for access.infrastructure`,builder:e=>e.command(on).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cn(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ln={command:`get`,describe:`Gets the Access key rotation settings for an account.`,builder:cn,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access keys get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/keys`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.keys.get({account_id:r})),{successLabel:`Loaded`})}};function un(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dn={command:`rotate`,describe:`Perfoms a key rotation for an account.`,builder:un,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access keys rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/keys/rotate`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Creating`,async()=>n.zeroTrust.access.keys.rotate({account_id:r})),{successLabel:`Created`})}};function fn(e){return e.option(`key-rotation-interval-days`,{type:`number`,description:`The number of days between key rotations.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pn={command:`update`,describe:`Updates the Access key rotation settings for an account.`,builder:fn,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access keys update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/keys`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({key_rotation_interval_days:t[`key-rotation-interval-days`]}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.access.keys.update({...e,account_id:r})),{successLabel:`Updated`});return}if(t[`key-rotation-interval-days`]===void 0)throw Error(`--key-rotation-interval-days is required (or pass --body with this field set).`);let i=l({key_rotation_interval_days:t[`key-rotation-interval-days`]});u(await f(`Updating`,async()=>n.zeroTrust.access.keys.update({...i,account_id:r})),{successLabel:`Updated`})}},mn={command:`keys`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(ln).command(dn).command(pn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function hn(e){return e.option(`limit`,{type:`number`,description:`The maximum number of log entries to retrieve.`}).option(`direction`,{type:`string`,description:`The chronological sorting order for the logs.`,choices:[`desc`,`asc`]}).option(`since`,{type:`string`,description:`The earliest event timestamp to query.`}).option(`until`,{type:`string`,description:`The latest event timestamp to query.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`email`,{type:`string`,description:"Filter by user email. Match mode is controlled by `emailOp` (preferred) or the legacy `email_exact` flag.\n- Default (no `emailOp`, `email_exact=false` or unset): substring match — `email=@example.com` returns all events with that domain.\n- Exact match: set `emailOp=eq` (preferred) or `email_exact=true` — e.g. `email=user@example.com&email_exact=true` returns only that user.\n- Explicit substring match: set `emailOp=contains` (without `email_exact=true`). When both are set, `email_exact=true` takes precedence and the match is exact.\n- Exclusion: set `emailOp=neq`. With `email_exact=true` this is an exact-value exclusion; without it, a fuzzy substring exclusion."}).option(`email-exact`,{type:`boolean`,description:"When true, `email` is matched exactly instead of substring matching."}).option(`user-id`,{type:`string`,description:"Deprecated. Accepted for backward compatibility but no longer applied\nas a filter. Use `email` instead."}).option(`allowed-op`,{type:`string`,description:"Operator for the `allowed` filter.",choices:[`eq`,`neq`]}).option(`country-code-op`,{type:`string`,description:"Operator for the `country_code` filter.",choices:[`eq`,`neq`]}).option(`app-type-op`,{type:`string`,description:"Operator for the `app_type` filter.",choices:[`eq`,`neq`]}).option(`app-uid-op`,{type:`string`,description:"Operator for the `app_uid` filter.",choices:[`eq`,`neq`]}).option(`ray-id-op`,{type:`string`,description:"Operator for the `ray_id` filter.",choices:[`eq`,`neq`]}).option(`email-op`,{type:`string`,description:"Operator for the `email` filter.\n`contains` performs a substring (case-sensitive) match. When `email_exact=true`\nis also set, `email_exact` takes precedence and `contains` is ignored.",choices:[`eq`,`neq`,`contains`]}).option(`idp-op`,{type:`string`,description:"Operator for the `idp` filter.",choices:[`eq`,`neq`]}).option(`non-identity-op`,{type:`string`,description:"Operator for the `non_identity` filter.",choices:[`eq`,`neq`]}).option(`user-id-op`,{type:`string`,description:"Deprecated. Accepted for backward compatibility but no longer applied\nas a filter (the `user_id` parameter is itself deprecated).",choices:[`eq`,`neq`]}).option(`fields`,{type:`string`,description:`Comma-separated list of fields to include in the response.
-When omitted, all fields are returned.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gn={command:`list`,describe:`Gets a list of Access authentication audit logs for an account.`,builder:g(hn),handler:async t=>{let n={limit:t.limit,direction:t.direction,since:t.since,until:t.until,page:t.page,per_page:t[`per-page`],email:t.email,email_exact:t[`email-exact`],user_id:t[`user-id`],allowedOp:t[`allowed-op`],country_codeOp:t[`country-code-op`],app_typeOp:t[`app-type-op`],app_uidOp:t[`app-uid-op`],ray_idOp:t[`ray-id-op`],emailOp:t[`email-op`],idpOp:t[`idp-op`],non_identityOp:t[`non-identity-op`],user_idOp:t[`user-id-op`],fields:t.fields};if(t.dryRun){d({command:`cf zero-trust access logs access-requests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/logs/access_requests`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.access.logs.accessRequests.list({account_id:i,...n})),{successLabel:`Loaded`})}},_n={command:`access-requests`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(gn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function vn(e){return e.option(`limit`,{type:`number`,description:`The maximum number of update logs to retrieve.`}).option(`direction`,{type:`string`,description:`The chronological order used to sort the logs.`,choices:[`desc`,`asc`]}).option(`since`,{type:`string`,description:`the timestamp of the earliest update log.`}).option(`until`,{type:`string`,description:`the timestamp of the most-recent update log.`}).option(`idp-id`,{type:`string`,description:`The unique Id of the IdP that has SCIM enabled.`,demandOption:!0}).option(`status`,{type:`string`,description:`The status of the SCIM request.`}).option(`resource-type`,{type:`string`,description:`The resource type of the SCIM request.`}).option(`request-method`,{type:`string`,description:`The request method of the SCIM request.`}).option(`resource-user-email`,{type:`string`,description:"The email address of the SCIM User resource. Pass once for a single\nlookup (`?resource_user_email=A`) or repeat the parameter\n(`?resource_user_email=A&resource_user_email=B`) to filter by multiple\nemails in one request."}).option(`resource-group-name`,{type:`string`,description:"The display name of the SCIM Group resource. Pass once for a single\nlookup (`?resource_group_name=A`) or repeat the parameter\n(`?resource_group_name=A&resource_group_name=B`) to filter by multiple\ngroup names in one request."}).option(`cf-resource-id`,{type:`string`,description:"The unique Cloudflare-generated Id of the SCIM resource. Pass once for\na single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to filter by multiple resources\nin one request."}).option(`idp-resource-id`,{type:`string`,description:"The IdP-generated Id of the SCIM resource. Pass once for a single\nlookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to filter by multiple\nresources in one request."}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yn={command:`list`,describe:`Lists Access SCIM update logs that maintain a record of updates made to User and Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:g(vn),handler:async t=>{let n={limit:t.limit,direction:t.direction,since:t.since,until:t.until,idp_id:t[`idp-id`],status:t.status,resource_type:t[`resource-type`],request_method:t[`request-method`],resource_user_email:t[`resource-user-email`],resource_group_name:t[`resource-group-name`],cf_resource_id:t[`cf-resource-id`],idp_resource_id:t[`idp-resource-id`],page:t.page,per_page:t[`per-page`]};if(t.dryRun){d({command:`cf zero-trust access logs scim updates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/logs/scim/updates`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.access.logs.scim.updates.list({account_id:i,...n})),{successLabel:`Loaded`})}},bn={command:`updates`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(yn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},xn={command:`scim`,describe:`Operations for access.logs.scim`,builder:e=>e.command(bn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Sn={command:`logs`,describe:`Operations for access.logs`,builder:e=>e.command(_n).command(xn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Cn(e){return e.option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const wn={command:`create`,describe:`Creates a new Access reusable policy.`,builder:Cn,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust access policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/policies`,pathParams:{},bodyKind:`json`,body:r.body===void 0?l({decision:p(r.decision,`decision`,`text`),name:p(r.name,`name`,`text`)}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Creating`,async()=>i.zeroTrust.access.policies.create({body:e,account_id:o})),{successLabel:`Created`});return}r.decision===void 0&&(r.decision=await n(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),r.name===void 0&&(r.name=await t(`name`,`The name of the Access policy.`));let m=l({decision:p(r.decision,`decision`,`text`),name:p(r.name,`name`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.access.policies.create({body:m,account_id:o})),{successLabel:`Created`})}};function Tn(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const En={command:`delete <policy-id>`,describe:`Deletes an Access reusable policy.`,builder:Tn,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/policies/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}`,pathParams:{"policy-id":String(t[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.policies.delete({account_id:r,policy_id:t[`policy-id`]})),{successLabel:`Deleted`})}};function Dn(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const On={command:`get <policy-id>`,describe:`Fetches a single Access reusable policy.`,builder:Dn,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/policies/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}`,pathParams:{"policy-id":String(t[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.policies.get({account_id:r,policy_id:t[`policy-id`]})),{successLabel:`Loaded`})}};function kn(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const An={command:`list`,describe:`Lists Access reusable policies.`,builder:kn,handler:async t=>{let n={page:t.page,per_page:t[`per-page`]};if(t.dryRun){d({command:`cf zero-trust access policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/policies`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.access.policies.list({account_id:i,...n})),{successLabel:`Loaded`})}};function jn(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Mn={command:`update <policy-id>`,describe:`Updates a Access reusable policy.`,builder:jn,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust access policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/policies/${r[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(r[`policy-id`]))}`,pathParams:{"policy-id":String(r[`policy-id`]??``)},bodyKind:`json`,body:r.body===void 0?l({decision:p(r.decision,`decision`,`text`),name:p(r.name,`name`,`text`)}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Updating`,async()=>i.zeroTrust.access.policies.update({body:e,account_id:o,policy_id:r[`policy-id`]})),{successLabel:`Updated`});return}r.decision===void 0&&(r.decision=await n(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),r.name===void 0&&(r.name=await t(`name`,`The name of the Access policy.`));let m=l({decision:p(r.decision,`decision`,`text`),name:p(r.name,`name`,`text`)});u(await f(`Updating`,async()=>i.zeroTrust.access.policies.update({body:m,account_id:o,policy_id:r[`policy-id`]})),{successLabel:`Updated`})}},Nn={command:`policies`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(wn).command(En).command(On).command(An).command(Mn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Pn(e){return e.option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.",default:1}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).",default:`8760h`}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Fn={command:`create`,describe:`Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token.`,builder:Pn,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access service-tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/service_tokens`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({client_secret_version:n[`client-secret-version`],duration:p(n.duration,`duration`,`text`),name:p(n.name,`name`,`text`),previous_client_secret_expires_at:p(n[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.access.serviceTokens.create({...e,account_id:i})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await t(`name`,`The name of the service token.`));let o=l({client_secret_version:n[`client-secret-version`],duration:p(n.duration,`duration`,`text`),name:p(n.name,`name`,`text`),previous_client_secret_expires_at:p(n[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.access.serviceTokens.create({...o,account_id:i})),{successLabel:`Created`})}};function In(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ln={command:`delete <service-token-id>`,describe:`Deletes a service token.`,builder:In,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access service-tokens delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/service_tokens/${t[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(t[`service-token-id`]))}`,pathParams:{"service-token-id":String(t[`service-token-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.serviceTokens.delete({account_id:r,service_token_id:t[`service-token-id`]})),{successLabel:`Deleted`})}};function Rn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zn={command:`get <service-token-id>`,describe:`Fetches a single service token.`,builder:Rn,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access service-tokens get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/service_tokens/${t[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(t[`service-token-id`]))}`,pathParams:{"service-token-id":String(t[`service-token-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.serviceTokens.get({account_id:r,service_token_id:t[`service-token-id`]})),{successLabel:`Loaded`})}};function Bn(e){return e.option(`name`,{type:`string`,description:`The name of the service token.`}).option(`search`,{type:`string`,description:`Search for service tokens by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vn={command:`list`,describe:`Lists all service tokens.`,builder:Bn,handler:async t=>{let n={name:t.name,search:t.search,page:t.page,per_page:t[`per-page`]};if(t.dryRun){d({command:`cf zero-trust access service-tokens list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/service_tokens`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.access.serviceTokens.list({account_id:i,...n})),{successLabel:`Loaded`})}};function Hn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Un={command:`refresh <service-token-id>`,describe:`Refreshes the expiration of a service token.`,builder:Hn,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access service-tokens refresh`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/service_tokens/${t[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(t[`service-token-id`]))}/refresh`,pathParams:{"service-token-id":String(t[`service-token-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Creating`,async()=>n.zeroTrust.access.serviceTokens.refresh({account_id:r,service_token_id:t[`service-token-id`]})),{successLabel:`Created`})}};function Wn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. If not provided, it defaults to the current timestamp in order to immediately expire the previous secret."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Gn={command:`rotate <service-token-id>`,describe:`Generates a new Client Secret for a service token and revokes the old one.`,builder:Wn,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access service-tokens rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/service_tokens/${t[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(t[`service-token-id`]))}/rotate`,pathParams:{"service-token-id":String(t[`service-token-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({previous_client_secret_expires_at:p(t[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.access.serviceTokens.rotate({...e,account_id:r,service_token_id:t[`service-token-id`]})),{successLabel:`Created`});return}let i=l({previous_client_secret_expires_at:p(t[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.access.serviceTokens.rotate({...i,account_id:r,service_token_id:t[`service-token-id`]})),{successLabel:`Created`})}};function Kn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`."}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h)."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const qn={command:`update <service-token-id>`,describe:`Updates a configured service token.`,builder:Kn,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access service-tokens update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/service_tokens/${t[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(t[`service-token-id`]))}`,pathParams:{"service-token-id":String(t[`service-token-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({client_secret_version:t[`client-secret-version`],duration:p(t.duration,`duration`,`text`),name:p(t.name,`name`,`text`),previous_client_secret_expires_at:p(t[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.access.serviceTokens.update({...e,account_id:r,service_token_id:t[`service-token-id`]})),{successLabel:`Updated`});return}let i=l({client_secret_version:t[`client-secret-version`],duration:p(t.duration,`duration`,`text`),name:p(t.name,`name`,`text`),previous_client_secret_expires_at:p(t[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.access.serviceTokens.update({...i,account_id:r,service_token_id:t[`service-token-id`]})),{successLabel:`Updated`})}},Jn={command:`service-tokens`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Fn).command(Ln).command(zn).command(Vn).command(Un).command(Gn).command(qn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Yn(e){return e.option(`name`,{type:`string`,description:`The name of the tag`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Xn={command:`create`,describe:`Create a tag`,builder:Yn,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access tags create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/tags`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({name:p(t.name,`name`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.access.tags.create({...e,account_id:r})),{successLabel:`Created`});return}let i=l({name:p(t.name,`name`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.access.tags.create({...i,account_id:r})),{successLabel:`Created`})}};function Zn(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Qn={command:`delete <tag-name>`,describe:`Delete a tag`,builder:Zn,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access tags delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/tags/${t[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(t[`tag-name`]))}`,pathParams:{"tag-name":String(t[`tag-name`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.tags.delete({account_id:r,tag_name:t[`tag-name`]})),{successLabel:`Deleted`})}};function $n(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const er={command:`get <tag-name>`,describe:`Get a tag`,builder:$n,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access tags get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/tags/${t[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(t[`tag-name`]))}`,pathParams:{"tag-name":String(t[`tag-name`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.tags.get({account_id:r,tag_name:t[`tag-name`]})),{successLabel:`Loaded`})}};function tr(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const nr={command:`list`,describe:`List tags`,builder:tr,handler:async t=>{let n={page:t.page,per_page:t[`per-page`]};if(t.dryRun){d({command:`cf zero-trust access tags list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/tags`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.access.tags.list({account_id:i,...n})),{successLabel:`Loaded`})}};function rr(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`name`,{type:`string`,description:`The name of the tag`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A tag`})}const ir={command:`update <tag-name>`,describe:`Update a tag`,builder:rr,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access tags update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/tags/${n[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(n[`tag-name`]))}`,pathParams:{"tag-name":String(n[`tag-name`]??``)},bodyKind:`json`,body:n.body===void 0?l({name:p(n.name,`name`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Updating`,async()=>r.zeroTrust.access.tags.update({...e,account_id:i,tag_name:n[`tag-name`]})),{successLabel:`Updated`});return}n.name===void 0&&(n.name=await t(`name`,`The name of the tag`));let o=l({name:p(n.name,`name`,`text`)});u(await f(`Updating`,async()=>r.zeroTrust.access.tags.update({...o,account_id:i,tag_name:n[`tag-name`]})),{successLabel:`Updated`})}},ar={command:`tags`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Xn).command(Qn).command(er).command(nr).command(ir).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function or(e){return e.positional(`nonce`,{type:`string`,description:`Nonce`,demandOption:!0}).option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sr={command:`get <nonce>`,describe:`Get an active session for a single user.`,builder:or,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access users active-sessions get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/users/${t[`user-id`]==null?`<user-id>`:encodeURIComponent(String(t[`user-id`]))}/active_sessions/${t.nonce==null?`<nonce>`:encodeURIComponent(String(t.nonce))}`,pathParams:{"user-id":String(t[`user-id`]??``),nonce:String(t.nonce??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.users.activeSessions.get({account_id:r,user_id:t[`user-id`],nonce:t.nonce})),{successLabel:`Loaded`})}};function cr(e){return e.option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lr={command:`list`,describe:`Get active sessions for a single user.`,builder:cr,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access users active-sessions list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/users/${t[`user-id`]==null?`<user-id>`:encodeURIComponent(String(t[`user-id`]))}/active_sessions`,pathParams:{"user-id":String(t[`user-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.users.activeSessions.list({account_id:r,user_id:t[`user-id`]})),{successLabel:`Loaded`})}},ur={command:`active-sessions`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(sr).command(lr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function dr(e){return e.option(`email`,{type:`string`,description:`The email of the user.`}).option(`name`,{type:`string`,description:`The name of the user.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const fr={command:`create`,describe:`Creates a new user.`,builder:dr,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access users create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/users`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({email:p(n.email,`email`,`text`),name:p(n.name,`name`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.access.users.create({...e,account_id:i})),{successLabel:`Created`});return}n.email===void 0&&(n.email=await t(`email`,`The email of the user.`));let o=l({email:p(n.email,`email`,`text`),name:p(n.name,`name`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.access.users.create({...o,account_id:i})),{successLabel:`Created`})}};function pr(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const mr={command:`delete <user-id>`,describe:`Deletes a specific user for an account. This will also revoke any active seats and tokens for the user.`,builder:pr,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access users delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/users/${t[`user-id`]==null?`<user-id>`:encodeURIComponent(String(t[`user-id`]))}`,pathParams:{"user-id":String(t[`user-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.users.delete({account_id:r,user_id:t[`user-id`]})),{successLabel:`Deleted`})}};function hr(e){return e.option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gr={command:`list`,describe:`Get all failed login attempts for a single user.`,builder:hr,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access users failed-logins list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/users/${t[`user-id`]==null?`<user-id>`:encodeURIComponent(String(t[`user-id`]))}/failed_logins`,pathParams:{"user-id":String(t[`user-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.users.failedLogins.list({account_id:r,user_id:t[`user-id`]})),{successLabel:`Loaded`})}},_r={command:`failed-logins`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(gr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function vr(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yr={command:`get <user-id>`,describe:`Gets a specific user for an account.`,builder:vr,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access users get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/users/${t[`user-id`]==null?`<user-id>`:encodeURIComponent(String(t[`user-id`]))}`,pathParams:{"user-id":String(t[`user-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.users.get({account_id:r,user_id:t[`user-id`]})),{successLabel:`Loaded`})}};function br(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xr={command:`get <user-id>`,describe:`Get last seen identity for a single user.`,builder:br,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust access users last-seen-identity get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/users/${t[`user-id`]==null?`<user-id>`:encodeURIComponent(String(t[`user-id`]))}/last_seen_identity`,pathParams:{"user-id":String(t[`user-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.access.users.lastSeenIdentity.get({account_id:r,user_id:t[`user-id`]})),{successLabel:`Loaded`})}},Sr={command:`last-seen-identity`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(xr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Cr(e){return e.option(`name`,{type:`string`,description:`The name of the user.`}).option(`email`,{type:`string`,description:`The email of the user.`}).option(`search`,{type:`string`,description:`Search for users by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wr={command:`list`,describe:`Gets a list of users for an account.`,builder:Cr,handler:async t=>{let n={name:t.name,email:t.email,search:t.search,page:t.page,per_page:t[`per-page`]};if(t.dryRun){d({command:`cf zero-trust access users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/users`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.access.users.list({account_id:i,...n})),{successLabel:`Loaded`})}};function Tr(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`email`,{type:`string`,description:`The email of the user.`}).option(`name`,{type:`string`,description:`The name of the user.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Er={command:`update <user-id>`,describe:`Updates a specific user's name for an account. Requires the user's current email as confirmation (email cannot be changed).`,builder:Tr,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access users update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/users/${n[`user-id`]==null?`<user-id>`:encodeURIComponent(String(n[`user-id`]))}`,pathParams:{"user-id":String(n[`user-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({email:p(n.email,`email`,`text`),name:p(n.name,`name`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Updating`,async()=>r.zeroTrust.access.users.update({...e,account_id:i,user_id:n[`user-id`]})),{successLabel:`Updated`});return}n.email===void 0&&(n.email=await t(`email`,`The email of the user.`)),n.name===void 0&&(n.name=await t(`name`,`The name of the user.`));let o=l({email:p(n.email,`email`,`text`),name:p(n.name,`name`,`text`)});u(await f(`Updating`,async()=>r.zeroTrust.access.users.update({...o,account_id:i,user_id:n[`user-id`]})),{successLabel:`Updated`})}},Dr={command:`users`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(fr).command(mr).command(yr).command(wr).command(Er).command(ur).command(_r).command(Sr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Or={command:`access`,describe:`Operations for access`,builder:e=>e.command(H).command(Be).command(Ze).command(pt).command(wt).command(jt).command(Ht).command(sn).command(mn).command(Sn).command(Nn).command(Jn).command(ar).command(Dr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function kr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ar={command:`create <app-id>`,describe:`Generates a new short-lived certificate CA and public key.`,builder:kr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps ca create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Creating`,async()=>t.zeroTrust.apps.ca.create({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Created`})}};function jr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Mr={command:`delete <app-id>`,describe:`Deletes a short-lived certificate CA.`,builder:jr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps ca delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i({force:!!e.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>t.zeroTrust.apps.ca.delete({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Deleted`})}};function Nr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pr={command:`get <app-id>`,describe:`Fetches a short-lived certificate CA and its public key.`,builder:Nr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps ca get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.apps.ca.get({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Loaded`})}};function Fr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ir={command:`list`,describe:`Lists short-lived certificate CAs and their public keys.`,builder:Fr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps ca list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/ca`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.apps.ca.list({zone_id:n})),{successLabel:`Loaded`})}},Lr={command:`ca`,describe:`Apps operations`,builder:e=>e.command(Ar).command(Mr).command(Pr).command(Ir).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Rr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const zr={command:`create`,describe:`Adds a new application to Access.`,builder:Rr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Creating`,async()=>t.zeroTrust.apps.create({body:r,zone_id:n})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Br(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Vr={command:`delete <app-id>`,describe:`Deletes an application from Access.`,builder:Br,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i({force:!!e.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>t.zeroTrust.apps.delete({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Deleted`})}};function Hr(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ur={command:`get <app-id>`,describe:`Fetches information about an Access application.`,builder:Hr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.apps.get({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Loaded`})}};function Wr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gr={command:`list`,describe:`List all Access Applications in a zone.`,builder:Wr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.apps.list({zone_id:n})),{successLabel:`Loaded`})}};function Kr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`,default:!1}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy.`,default:!1}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy.`}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const qr={command:`create <app-id>`,describe:`Create a new Access policy for an application.`,builder:Kr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({approval_required:e[`approval-required`],decision:p(e.decision,`decision`,`text`),isolation_required:e[`isolation-required`],name:p(e.name,`name`,`text`),precedence:e.precedence,purpose_justification_prompt:p(e[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:e[`purpose-justification-required`]}):c(e.body)});return}let i=await s(e),a=await r({zone:e.zone},i,{quiet:e.quiet});if(e.zoneId=a,e.body){let t=c(e.body);u(await f(`Creating`,async()=>i.zeroTrust.apps.policies.create({...t,zone_id:a,app_id:e[`app-id`]})),{successLabel:`Created`});return}e.decision===void 0&&(e.decision=await n(`decision`,`The action Access will take if a user matches this policy.`,[`allow`,`deny`,`non_identity`,`bypass`])),e.name===void 0&&(e.name=await t(`name`,`The name of the Access policy.`));let o=l({approval_required:e[`approval-required`],decision:p(e.decision,`decision`,`text`),isolation_required:e[`isolation-required`],name:p(e.name,`name`,`text`),precedence:e.precedence,purpose_justification_prompt:p(e[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:e[`purpose-justification-required`]});u(await f(`Creating`,async()=>i.zeroTrust.apps.policies.create({...o,zone_id:a,app_id:e[`app-id`]})),{successLabel:`Created`})}};function Jr(e){return e.positional(`policy-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Yr={command:`delete <policy-id>`,describe:`Delete an Access policy.`,builder:Jr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``),"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i({force:!!e.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>t.zeroTrust.apps.policies.delete({zone_id:n,app_id:e[`app-id`],policy_id:e[`policy-id`]})),{successLabel:`Deleted`})}};function Xr(e){return e.positional(`policy-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zr={command:`get <policy-id>`,describe:`Fetches a single Access policy.`,builder:Xr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``),"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.apps.policies.get({zone_id:n,app_id:e[`app-id`],policy_id:e[`policy-id`]})),{successLabel:`Loaded`})}};function Qr(e){return e.option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $r={command:`list`,describe:`Lists Access policies configured for an application.`,builder:Qr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.apps.policies.list({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Loaded`})}};function ei(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ti={command:`update <policy-id>`,describe:`Converts an application-scoped policy to a reusable policy. The policy will no longer be exclusively scoped to the application. Further updates to the policy should go through the /accounts/{account_id}/policies/{uid} endpoint.`,builder:ei,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust apps policies make reusable update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/policies/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}/make_reusable`,pathParams:{"app-id":String(t[`app-id`]??``),"policy-id":String(t[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Updating`,async()=>n.zeroTrust.apps.policies.make.reusable.update({account_id:r,app_id:t[`app-id`],policy_id:t[`policy-id`]})),{successLabel:`Updated`})}},ni={command:`reusable`,describe:`Apps operations`,builder:e=>e.command(ti).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ri={command:`make`,describe:`Operations for apps.policies.make`,builder:e=>e.command(ni).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ii(e){return e.positional(`policy-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy.`}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy.`}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ai={command:`update <policy-id>`,describe:`Update a configured Access policy.`,builder:ii,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``),"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({approval_required:e[`approval-required`],decision:p(e.decision,`decision`,`text`),isolation_required:e[`isolation-required`],name:p(e.name,`name`,`text`),precedence:e.precedence,purpose_justification_prompt:p(e[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:e[`purpose-justification-required`]}):c(e.body)});return}let i=await s(e),a=await r({zone:e.zone},i,{quiet:e.quiet});if(e.zoneId=a,e.body){let t=c(e.body);u(await f(`Updating`,async()=>i.zeroTrust.apps.policies.update({...t,zone_id:a,app_id:e[`app-id`],policy_id:e[`policy-id`]})),{successLabel:`Updated`});return}e.decision===void 0&&(e.decision=await n(`decision`,`The action Access will take if a user matches this policy.`,[`allow`,`deny`,`non_identity`,`bypass`])),e.name===void 0&&(e.name=await t(`name`,`The name of the Access policy.`));let o=l({approval_required:e[`approval-required`],decision:p(e.decision,`decision`,`text`),isolation_required:e[`isolation-required`],name:p(e.name,`name`,`text`),precedence:e.precedence,purpose_justification_prompt:p(e[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:e[`purpose-justification-required`]});u(await f(`Updating`,async()=>i.zeroTrust.apps.policies.update({...o,zone_id:a,app_id:e[`app-id`],policy_id:e[`policy-id`]})),{successLabel:`Updated`})}},oi={command:`policies`,describe:`Apps operations`,builder:e=>e.command(qr).command(Yr).command(Zr).command($r).command(ai).command(ri).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function si(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ci={command:`list`,describe:`Retrieve the statuses of your applications.`,builder:si,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust apps review status list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/apps/review_status`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.apps.review.status.list({account_id:r})),{successLabel:`Loaded`})}};function li(e){return e.option(`approved-apps`,{type:`string`,array:!0,description:`Contains the ids of the approved applications.`}).option(`in-review-apps`,{type:`string`,array:!0,description:`Contains the ids of the applications in review.`}).option(`unapproved-apps`,{type:`string`,array:!0,description:`Contains the ids of the unapproved applications.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ui={command:`update`,describe:`Update the statuses of your applications.`,builder:li,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust apps review status update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/apps/review_status`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({approved_apps:t[`approved-apps`],in_review_apps:t[`in-review-apps`],unapproved_apps:t[`unapproved-apps`]}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.apps.review.status.update({...e,account_id:r})),{successLabel:`Updated`});return}if(t[`approved-apps`]===void 0)throw Error(`--approved-apps is required (or pass --body with this field set).`);if(t[`in-review-apps`]===void 0)throw Error(`--in-review-apps is required (or pass --body with this field set).`);if(t[`unapproved-apps`]===void 0)throw Error(`--unapproved-apps is required (or pass --body with this field set).`);let i=l({approved_apps:t[`approved-apps`],in_review_apps:t[`in-review-apps`],unapproved_apps:t[`unapproved-apps`]});u(await f(`Updating`,async()=>n.zeroTrust.apps.review.status.update({...i,account_id:r})),{successLabel:`Updated`})}},di={command:`status`,describe:`Operations for apps.review.status`,builder:e=>e.command(ci).command(ui).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},fi={command:`review`,describe:`Operations for apps.review`,builder:e=>e.command(di).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pi(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const mi={command:`create <app-id>`,describe:`Revokes all tokens issued for an application.`,builder:pi,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps revoke tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/revoke_tokens`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i({force:!!e.force,message:`This operation revokes all service tokens for the application.`})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>t.zeroTrust.apps.revoke.tokens.create({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Deleted`})}},hi={command:`tokens`,describe:`Apps operations`,builder:e=>e.command(mi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},gi={command:`revoke`,describe:`Operations for apps.revoke`,builder:e=>e.command(hi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function _i(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const vi={command:`edit <app-id>`,describe:`Updates application settings.`,builder:_i,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/settings`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]}):c(e.body)});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.apps.settings.edit({body:r,zone_id:n,app_id:e[`app-id`]})),{successLabel:`Updated`});return}let i=l({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]});u(await f(`Updating`,async()=>t.zeroTrust.apps.settings.edit({body:i,zone_id:n,app_id:e[`app-id`]})),{successLabel:`Updated`})}};function yi(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const bi={command:`update <app-id>`,describe:`Updates application settings.`,builder:yi,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/settings`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]}):c(e.body)});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.apps.settings.update({body:r,zone_id:n,app_id:e[`app-id`]})),{successLabel:`Updated`});return}let i=l({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]});u(await f(`Updating`,async()=>t.zeroTrust.apps.settings.update({body:i,zone_id:n,app_id:e[`app-id`]})),{successLabel:`Updated`})}},xi={command:`settings`,describe:`Apps operations`,builder:e=>e.command(vi).command(bi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Si(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ci={command:`update <app-id>`,describe:`Updates an Access application.`,builder:Si,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.apps.update({body:r,zone_id:n,app_id:e[`app-id`]})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function wi(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ti={command:`get <app-id>`,describe:`Tests if a specific user has permission to access an application.`,builder:wi,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps user policy checks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/user_policy_checks`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.apps.user.policy.checks.get({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Loaded`})}},Ei={command:`checks`,describe:`Apps operations`,builder:e=>e.command(Ti).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Di={command:`policy`,describe:`Operations for apps.user.policy`,builder:e=>e.command(Ei).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Oi={command:`user`,describe:`Operations for apps.user`,builder:e=>e.command(Di).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ki={command:`apps`,describe:`Apps operations`,builder:e=>e.command(zr).command(Vr).command(Ur).command(Gr).command(Ci).command(Lr).command(oi).command(fi).command(gi).command(xi).command(Oi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ai(e){return e.option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`certificate`,{type:`string`,description:`The certificate content.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ji={command:`create`,describe:`Adds a new mTLS root certificate to Access.`,builder:Ai,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({associated_hostnames:e[`associated-hostnames`],certificate:p(e.certificate,`certificate`,`text`),name:p(e.name,`name`,`text`)}):c(e.body)});return}let n=await s(e),i=await r({zone:e.zone},n,{quiet:e.quiet});if(e.zoneId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.certificates.create({...t,zone_id:i})),{successLabel:`Created`});return}e.certificate===void 0&&(e.certificate=await t(`certificate`,`The certificate content.`)),e.name===void 0&&(e.name=await t(`name`,`The name of the certificate.`));let a=l({associated_hostnames:e[`associated-hostnames`],certificate:p(e.certificate,`certificate`,`text`),name:p(e.name,`name`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.certificates.create({...a,zone_id:i})),{successLabel:`Created`})}};function Mi(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ni={command:`delete <certificate-id>`,describe:`Deletes an mTLS certificate.`,builder:Mi,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i({force:!!e.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>t.zeroTrust.certificates.delete({zone_id:n,certificate_id:e[`certificate-id`]})),{successLabel:`Deleted`})}};function Pi(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fi={command:`get <certificate-id>`,describe:`Fetches a single mTLS certificate.`,builder:Pi,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.certificates.get({zone_id:n,certificate_id:e[`certificate-id`]})),{successLabel:`Loaded`})}};function Ii(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Li={command:`list`,describe:`Lists all mTLS certificates.`,builder:Ii,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.certificates.list({zone_id:n})),{successLabel:`Loaded`})}};function Ri(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zi={command:`list`,describe:`List all mTLS hostname settings for this zone.`,builder:Ri,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust certificates settings list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/settings`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.certificates.settings.list({zone_id:n})),{successLabel:`Loaded`})}};function Bi(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Vi={command:`update`,describe:`Updates an mTLS certificate's hostname settings.`,builder:Bi,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust certificates settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/settings`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.certificates.settings.update({...r,zone_id:n})),{successLabel:`Updated`});return}u(await f(`Updating`,async()=>o(t,`PUT`,`/zones/${e.zoneId}/access/certificates/settings`)),{successLabel:`Updated`})}},Hi={command:`settings`,describe:`Certificates operations`,builder:e=>e.command(zi).command(Vi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ui(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wi={command:`update <certificate-id>`,describe:`Updates a configured mTLS certificate.`,builder:Ui,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust certificates update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({associated_hostnames:e[`associated-hostnames`],name:p(e.name,`name`,`text`)}):c(e.body)});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.certificates.update({...r,zone_id:n,certificate_id:e[`certificate-id`]})),{successLabel:`Updated`});return}if(e[`associated-hostnames`]===void 0)throw Error(`--associated-hostnames is required (or pass --body with this field set).`);let i=l({associated_hostnames:e[`associated-hostnames`],name:p(e.name,`name`,`text`)});u(await f(`Updating`,async()=>t.zeroTrust.certificates.update({...i,zone_id:n,certificate_id:e[`certificate-id`]})),{successLabel:`Updated`})}},Gi={command:`certificates`,describe:`Certificates operations`,builder:e=>e.command(ji).command(Ni).command(Fi).command(Li).command(Wi).command(Hi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ki(e){return e.option(`icmp-proxy-enabled`,{type:`boolean`,description:`A flag to enable the ICMP proxy for the account network.`}).option(`offramp-warp-enabled`,{type:`boolean`,description:`A flag to enable WARP to WARP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const qi={command:`edit`,describe:`Updates the Zero Trust Connectivity Settings for the given account.`,builder:Ki,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust connectivity-settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zerotrust/connectivity_settings`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({icmp_proxy_enabled:t[`icmp-proxy-enabled`],offramp_warp_enabled:t[`offramp-warp-enabled`]}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.connectivitySettings.edit({...e,account_id:r})),{successLabel:`Updated`});return}let i=l({icmp_proxy_enabled:t[`icmp-proxy-enabled`],offramp_warp_enabled:t[`offramp-warp-enabled`]});u(await f(`Updating`,async()=>n.zeroTrust.connectivitySettings.edit({...i,account_id:r})),{successLabel:`Updated`})}};function Ji(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yi={command:`get`,describe:`Gets the Zero Trust Connectivity Settings for the given account.`,builder:Ji,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust connectivity-settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zerotrust/connectivity_settings`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.connectivitySettings.get({account_id:r})),{successLabel:`Loaded`})}},Xi={command:`connectivity-settings`,describe:`Operations for connectivity-settings`,builder:e=>e.command(qi).command(Yi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Zi(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qi={command:`list`,describe:`Retrieves a list of all available target environments with their display names. This endpoint is in Beta.`,builder:Zi,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices client target environments list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/client-versions/target-environments`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.client.target.environments.list({account_id:r})),{successLabel:`Loaded`})}},$i={command:`environments`,describe:`Operations for devices.client.target.environments`,builder:e=>e.command(Qi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ea={command:`target`,describe:`Operations for devices.client.target`,builder:e=>e.command($i).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ta(e){return e.option(`target-environment`,{type:`string`,description:`The target environment for the client version (e.g., windows, macos).`,demandOption:!0}).option(`release-track`,{type:`string`,description:`The release track (ga for General Availability, beta for Beta releases).`,choices:[`ga`,`beta`],demandOption:!0}).option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The maximum number of versions to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const na={command:`list`,describe:`Lists available WARP client versions for a specific target environment and release track. This endpoint is in Beta.`,builder:g(ta),handler:async t=>{let n={target_environment:t[`target-environment`],release_track:t[`release-track`],page:t.page,per_page:t[`per-page`]};if(t.dryRun){d({command:`cf zero-trust devices client versions list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/client-versions`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.devices.client.versions.list({account_id:i,...n})),{successLabel:`Loaded`})}},ra={command:`versions`,describe:`Operations for devices.client.versions`,builder:e=>e.command(na).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ia={command:`client`,describe:`Operations for devices.client`,builder:e=>e.command(ea).command(ra).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function aa(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for the deployment group.`}).option(`policy-ids`,{type:`string`,array:!0,description:`Contains an optional list of policy IDs assigned to a group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const oa={command:`create`,describe:`Creates a new deployment group. Policy IDs must be unique across all deployment groups. This endpoint is in Beta.`,builder:aa,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust devices deployment groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/deployment-groups`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({name:p(n.name,`name`,`text`),policy_ids:n[`policy-ids`]}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.devices.deployment.groups.create({...e,account_id:i})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await t(`name`,`A user-friendly name for the deployment group.`));let o=l({name:p(n.name,`name`,`text`),policy_ids:n[`policy-ids`]});u(await f(`Creating`,async()=>r.zeroTrust.devices.deployment.groups.create({...o,account_id:i})),{successLabel:`Created`})}};function sa(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ca={command:`delete <group-id>`,describe:`Deletes a deployment group. Associated policies no longer apply and devices stop receiving version targets. This endpoint is in Beta.`,builder:sa,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices deployment groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/deployment-groups/${t[`group-id`]==null?`<group-id>`:encodeURIComponent(String(t[`group-id`]))}`,pathParams:{"group-id":String(t[`group-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.deployment.groups.delete({account_id:r,group_id:t[`group-id`]})),{successLabel:`Deleted`})}};function la(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ua={command:`get <group-id>`,describe:`Fetches a single deployment group by its ID. This endpoint is in Beta.`,builder:la,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices deployment groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/deployment-groups/${t[`group-id`]==null?`<group-id>`:encodeURIComponent(String(t[`group-id`]))}`,pathParams:{"group-id":String(t[`group-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.deployment.groups.get({account_id:r,group_id:t[`group-id`]})),{successLabel:`Loaded`})}};function da(e){return e.option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The maximum number of deployment groups to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fa={command:`list`,describe:`Lists all deployment groups for an account. Use deployment groups to assign target WARP client versions to specific devices. This endpoint is in Beta.`,builder:da,handler:async t=>{let n={page:t.page,per_page:t[`per-page`]};if(t.dryRun){d({command:`cf zero-trust devices deployment groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/deployment-groups`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.devices.deployment.groups.list({account_id:i,...n})),{successLabel:`Loaded`})}};function pa(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for the deployment group.`}).option(`policy-ids`,{type:`string`,array:!0,description:`Replaces the entire list of policy IDs.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ma={command:`update <group-id>`,describe:`Updates a deployment group. Returns 409 if any newly added policy IDs already belong to another deployment group. This endpoint is in Beta.`,builder:pa,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices deployment groups update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/deployment-groups/${t[`group-id`]==null?`<group-id>`:encodeURIComponent(String(t[`group-id`]))}`,pathParams:{"group-id":String(t[`group-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({name:p(t.name,`name`,`text`),policy_ids:t[`policy-ids`]}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.deployment.groups.update({...e,account_id:r,group_id:t[`group-id`]})),{successLabel:`Updated`});return}let i=l({name:p(t.name,`name`,`text`),policy_ids:t[`policy-ids`]});u(await f(`Updating`,async()=>n.zeroTrust.devices.deployment.groups.update({...i,account_id:r,group_id:t[`group-id`]})),{successLabel:`Updated`})}},ha={command:`groups`,describe:`Operations for devices.deployment.groups`,builder:e=>e.command(oa).command(ca).command(ua).command(fa).command(ma).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ga={command:`deployment`,describe:`Operations for devices.deployment`,builder:e=>e.command(ha).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function _a(e){return e.positional(`device-id`,{type:`string`,description:`Registration ID. Equal to Device ID except for accounts which enabled [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/).`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const va={command:`get <device-id>`,describe:`Fetches a single WARP device. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices/{device_id} - GET /accounts/{account_id}/devices/registrations/{registration_id}`,builder:_a,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/${t[`device-id`]==null?`<device-id>`:encodeURIComponent(String(t[`device-id`]))}`,pathParams:{"device-id":String(t[`device-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.get({account_id:r,device_id:t[`device-id`]})),{successLabel:`Loaded`})}};function ya(e){return e.option(`description`,{type:`string`,description:`An optional description of the Device IP profile.`}).option(`enabled`,{type:`boolean`,description:`Whether the Device IP profile will be applied to matching devices.`,default:!0}).option(`match`,{type:`string`,description:`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`}).option(`name`,{type:`string`,description:`A user-friendly name for the Device IP profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.`}).option(`subnet-id`,{type:`string`,description:`The ID of the Subnet.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ba={command:`create`,describe:`Creates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.`,builder:ya,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust devices ip-profiles create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/ip-profiles`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({description:p(n.description,`description`,`text`),enabled:n.enabled,match:p(n.match,`match`,`text`),name:p(n.name,`name`,`text`),precedence:n.precedence,subnet_id:p(n[`subnet-id`],`subnet-id`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.devices.ipProfiles.create({...e,account_id:i})),{successLabel:`Created`});return}if(n.match===void 0&&(n.match=await t(`match`,`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`)),n.name===void 0&&(n.name=await t(`name`,`A user-friendly name for the Device IP profile.`)),n.precedence===void 0)throw Error(`--precedence is required (or pass --body with this field set).`);n[`subnet-id`]===void 0&&(n[`subnet-id`]=await t(`subnet-id`,`The ID of the Subnet.`));let o=l({description:p(n.description,`description`,`text`),enabled:n.enabled,match:p(n.match,`match`,`text`),name:p(n.name,`name`,`text`),precedence:n.precedence,subnet_id:p(n[`subnet-id`],`subnet-id`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.devices.ipProfiles.create({...o,account_id:i})),{successLabel:`Created`})}};function xa(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Sa={command:`delete <profile-id>`,describe:`Delete a WARP Device IP profile.`,builder:xa,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices ip-profiles delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/ip-profiles/${t[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(t[`profile-id`]))}`,pathParams:{"profile-id":String(t[`profile-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.ipProfiles.delete({account_id:r,profile_id:t[`profile-id`]})),{successLabel:`Deleted`})}};function Ca(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wa={command:`get <profile-id>`,describe:`Fetches a single WARP Device IP profile.`,builder:Ca,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices ip-profiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/ip-profiles/${t[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(t[`profile-id`]))}`,pathParams:{"profile-id":String(t[`profile-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.ipProfiles.get({account_id:r,profile_id:t[`profile-id`]})),{successLabel:`Loaded`})}};function Ta(e){return e.option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The number of IP profiles to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ea={command:`list`,describe:`Lists WARP Device IP profiles.`,builder:Ta,handler:async t=>{let n={page:t.page,per_page:t[`per-page`]};if(t.dryRun){d({command:`cf zero-trust devices ip-profiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/ip-profiles`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.devices.ipProfiles.list({account_id:i,...n})),{successLabel:`Loaded`})}};function Da(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`description`,{type:`string`,description:`An optional description of the Device IP profile.`}).option(`enabled`,{type:`boolean`,description:`Whether the Device IP profile is enabled.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`}).option(`name`,{type:`string`,description:`A user-friendly name for the Device IP profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.`}).option(`subnet-id`,{type:`string`,description:`The ID of the Subnet.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Oa={command:`update <profile-id>`,describe:`Updates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.`,builder:Da,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices ip-profiles update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/ip-profiles/${t[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(t[`profile-id`]))}`,pathParams:{"profile-id":String(t[`profile-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({description:p(t.description,`description`,`text`),enabled:t.enabled,match:p(t.match,`match`,`text`),name:p(t.name,`name`,`text`),precedence:t.precedence,subnet_id:p(t[`subnet-id`],`subnet-id`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.ipProfiles.update({...e,account_id:r,profile_id:t[`profile-id`]})),{successLabel:`Updated`});return}let i=l({description:p(t.description,`description`,`text`),enabled:t.enabled,match:p(t.match,`match`,`text`),name:p(t.name,`name`,`text`),precedence:t.precedence,subnet_id:p(t[`subnet-id`],`subnet-id`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.devices.ipProfiles.update({...i,account_id:r,profile_id:t[`profile-id`]})),{successLabel:`Updated`})}},ka={command:`ip-profiles`,describe:`Operations for devices.ip-profiles`,builder:e=>e.command(ba).command(Sa).command(wa).command(Ea).command(Oa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Aa(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ja={command:`list`,describe:`List WARP devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices - GET /accounts/{account_id}/devices/registrations`,builder:Aa,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.list({account_id:r})),{successLabel:`Loaded`})}};function Ma(e){return e.option(`config-sha256`,{type:`string`,description:`The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.`}).option(`config-tls-sockaddr`,{type:`string`,description:`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`}).option(`name`,{type:`string`,description:`The name of the device managed network. This name must be unique.`}).option(`type`,{type:`string`,description:`The type of device managed network.`,choices:[`tls`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Na={command:`create`,describe:`Creates a new device managed network.`,builder:Ma,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust devices networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/networks`,pathParams:{},bodyKind:`json`,body:r.body===void 0?l({config:{sha256:p(r[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:p(r[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`)}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Creating`,async()=>i.zeroTrust.devices.networks.create({...e,account_id:o})),{successLabel:`Created`});return}r[`config-tls-sockaddr`]===void 0&&(r[`config-tls-sockaddr`]=await t(`config-tls-sockaddr`,`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`)),r.name===void 0&&(r.name=await t(`name`,`The name of the device managed network. This name must be unique.`)),r.type===void 0&&(r.type=await n(`type`,`The type of device managed network.`,[`tls`]));let m=l({config:{sha256:p(r[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:p(r[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.devices.networks.create({...m,account_id:o})),{successLabel:`Created`})}};function Pa(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Fa={command:`delete <network-id>`,describe:`Deletes a device managed network and fetches a list of the remaining device managed networks for an account.`,builder:Pa,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/networks/${t[`network-id`]==null?`<network-id>`:encodeURIComponent(String(t[`network-id`]))}`,pathParams:{"network-id":String(t[`network-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.networks.delete({account_id:r,network_id:t[`network-id`]})),{successLabel:`Deleted`})}};function Ia(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const La={command:`get <network-id>`,describe:`Fetches details for a single managed network.`,builder:Ia,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices networks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/networks/${t[`network-id`]==null?`<network-id>`:encodeURIComponent(String(t[`network-id`]))}`,pathParams:{"network-id":String(t[`network-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.networks.get({account_id:r,network_id:t[`network-id`]})),{successLabel:`Loaded`})}};function Ra(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const za={command:`list`,describe:`Fetches a list of managed networks for an account.`,builder:Ra,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices networks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/networks`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.networks.list({account_id:r})),{successLabel:`Loaded`})}};function Ba(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`config-sha256`,{type:`string`,description:`The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.`}).option(`config-tls-sockaddr`,{type:`string`,description:`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`}).option(`name`,{type:`string`,description:`The name of the device managed network. This name must be unique.`}).option(`type`,{type:`string`,description:`The type of device managed network.`,choices:[`tls`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`config-sha256`,`config-tls-sockaddr`].some(t=>e[t]!==void 0)){let t=[`config-tls-sockaddr`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --config-* flag is set`)}return!0})}const Va={command:`update <network-id>`,describe:`Updates a configured device managed network.`,builder:Ba,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices networks update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/networks/${t[`network-id`]==null?`<network-id>`:encodeURIComponent(String(t[`network-id`]))}`,pathParams:{"network-id":String(t[`network-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({config:{sha256:p(t[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:p(t[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:p(t.name,`name`,`text`),type:p(t.type,`type`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.networks.update({...e,account_id:r,network_id:t[`network-id`]})),{successLabel:`Updated`});return}let i=l({config:{sha256:p(t[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:p(t[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:p(t.name,`name`,`text`),type:p(t.type,`type`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.devices.networks.update({...i,account_id:r,network_id:t[`network-id`]})),{successLabel:`Updated`})}},Ha={command:`networks`,describe:`Operations for devices.networks`,builder:e=>e.command(Na).command(Fa).command(La).command(za).command(Va).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ua(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Wa={command:`get <registration-id>`,describe:`Fetches one-time use admin override codes for a registration. This relies on the **Admin Override** setting being enabled in your device configuration.`,builder:Ua,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices override-codes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/registrations/${t[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(t[`registration-id`]))}/override_codes`,pathParams:{"registration-id":String(t[`registration-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.overrideCodes.get({account_id:r,registration_id:t[`registration-id`]})),{successLabel:`Loaded`})}};function Ga(e){return e.option(`device-id`,{type:`string`,description:`Registration ID. Equal to Device ID except for accounts which enabled [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/).`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ka={command:`list`,describe:`Fetches a one-time use admin override code for a device. This relies on the **Admin Override** setting being enabled in your device configuration. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated:** please use GET /accounts/{account_id}/devices/registrations/{registration_id}/override_codes instead.`,builder:Ga,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices override-codes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/${t[`device-id`]==null?`<device-id>`:encodeURIComponent(String(t[`device-id`]))}/override_codes`,pathParams:{"device-id":String(t[`device-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.overrideCodes.list({account_id:r,device_id:t[`device-id`]})),{successLabel:`Loaded`})}},qa={command:`override-codes`,describe:`Operations for devices.override-codes`,builder:e=>e.command(Wa).command(Ka).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ja(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ya={command:`delete <device-id>`,describe:`Deletes a WARP device.`,builder:Ja,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices physical-devices delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/physical-devices/${t[`device-id`]==null?`<device-id>`:encodeURIComponent(String(t[`device-id`]))}`,pathParams:{"device-id":String(t[`device-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.physicalDevices.delete({account_id:r,device_id:t[`device-id`]})),{successLabel:`Deleted`})}};function Xa(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the device response. Supported values are: "last_seen_registration.policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Za={command:`get <device-id>`,describe:`Fetches a single WARP device.`,builder:Xa,handler:async t=>{let n={include:t.include};if(t.dryRun){d({command:`cf zero-trust devices physical-devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/physical-devices/${t[`device-id`]==null?`<device-id>`:encodeURIComponent(String(t[`device-id`]))}`,pathParams:{"device-id":String(t[`device-id`]??``)},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.devices.physicalDevices.get({account_id:i,device_id:t[`device-id`],...n})),{successLabel:`Loaded`})}};function Qa(e){return e.option(`cursor`,{type:`string`,description:`Opaque token indicating the starting position when requesting the next set of records. A cursor value can be obtained from the result_info.cursor field in the response.`}).option(`sort-by`,{type:`string`,description:`The device field to order results by.`,choices:[`name`,`id`,`client_version`,`last_seen_user.email`,`last_seen_at`,`active_registrations`,`created_at`]}).option(`sort-order`,{type:`string`,description:`Sort direction.`,choices:[`asc`,`desc`]}).option(`last-seen-user-email`,{type:`string`,description:`Filter by the last seen user's email.`}).option(`seen-after`,{type:`string`,description:`Filter by the last_seen timestamp - returns only devices last seen after this timestamp.`}).option(`seen-before`,{type:`string`,description:`Filter by the last_seen timestamp - returns only devices last seen before this timestamp.`}).option(`per-page`,{type:`number`,description:`The maximum number of devices to return in a single response.`}).option(`search`,{type:`string`,description:`Search by device details.`}).option(`active-registrations`,{type:`string`,description:`Include or exclude devices with active registrations. The default is "only" - return only devices with active registrations.`,choices:[`include`,`only`,`exclude`]}).option(`id`,{type:`string`,description:`Filter by a one or more device IDs.`}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the device response. Supported values are: "last_seen_registration.policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $a={command:`list`,describe:`Lists WARP devices.`,builder:g(Qa),handler:async t=>{let n={cursor:t.cursor,sort_by:t[`sort-by`],sort_order:t[`sort-order`],"last_seen_user.email":t[`last-seen-user-email`],seen_after:t[`seen-after`],seen_before:t[`seen-before`],per_page:t[`per-page`],search:t.search,active_registrations:t[`active-registrations`],id:t.id,include:t.include};if(t.dryRun){d({command:`cf zero-trust devices physical-devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/physical-devices`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.devices.physicalDevices.list({account_id:i,...n})),{successLabel:`Loaded`})}};function eo(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const to={command:`revoke <device-id>`,describe:`Revokes all WARP registrations associated with the specified device.`,builder:eo,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices physical-devices revoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/physical-devices/${t[`device-id`]==null?`<device-id>`:encodeURIComponent(String(t[`device-id`]))}/revoke`,pathParams:{"device-id":String(t[`device-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force,message:`This operation revokes a device's session destructively.`})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.physicalDevices.revoke({account_id:r,device_id:t[`device-id`]})),{successLabel:`Deleted`})}},no={command:`physical-devices`,describe:`Enrolled physical WARP devices`,builder:e=>e.command(Ya).command(Za).command($a).command(to).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ro(e){return e.option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`,default:!1}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`,default:!1}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`,default:!0}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`,default:0}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`,default:180}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`.",default:!1}).option(`enabled`,{type:`boolean`,description:`Whether the policy will be applied to matching devices.`,default:!0}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`,default:!1}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`}).option(`name`,{type:`string`,description:`The name of the device settings profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`,default:!0}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`,default:!1}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`,default:``}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`,default:!1}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`,default:``}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const io={command:`create`,describe:`Creates a device settings profile to be applied to certain devices matching the criteria.`,builder:ro,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust devices policies custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({allow_mode_switch:n[`allow-mode-switch`],allow_updates:n[`allow-updates`],allowed_to_leave:n[`allowed-to-leave`],auto_connect:n[`auto-connect`],captive_portal:n[`captive-portal`],disable_auto_fallback:n[`disable-auto-fallback`],enabled:n.enabled,exclude_office_ips:n[`exclude-office-ips`],global_acceleration:{api_endpoints:n[`global-acceleration-api-endpoints`],enabled:n[`global-acceleration-enabled`],masque_endpoints:n[`global-acceleration-masque-endpoints`],wireguard_endpoints:n[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:n[`lan-allow-minutes`],lan_allow_subnet_size:n[`lan-allow-subnet-size`],match:p(n.match,`match`,`text`),name:p(n.name,`name`,`text`),precedence:n.precedence,register_interface_ip_with_dns:n[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:n[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(n[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:n[`service-mode-v2-port`]},support_url:p(n[`support-url`],`support-url`,`text`),switch_locked:n[`switch-locked`],tunnel_protocol:p(n[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:n[`virtual-networks-allowed`],default:p(n[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.devices.policies.custom.create({...e,account_id:i})),{successLabel:`Created`});return}if(n.match===void 0&&(n.match=await t(`match`,`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`)),n.name===void 0&&(n.name=await t(`name`,`The name of the device settings profile.`)),n.precedence===void 0)throw Error(`--precedence is required (or pass --body with this field set).`);let o=l({allow_mode_switch:n[`allow-mode-switch`],allow_updates:n[`allow-updates`],allowed_to_leave:n[`allowed-to-leave`],auto_connect:n[`auto-connect`],captive_portal:n[`captive-portal`],disable_auto_fallback:n[`disable-auto-fallback`],enabled:n.enabled,exclude_office_ips:n[`exclude-office-ips`],global_acceleration:{api_endpoints:n[`global-acceleration-api-endpoints`],enabled:n[`global-acceleration-enabled`],masque_endpoints:n[`global-acceleration-masque-endpoints`],wireguard_endpoints:n[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:n[`lan-allow-minutes`],lan_allow_subnet_size:n[`lan-allow-subnet-size`],match:p(n.match,`match`,`text`),name:p(n.name,`name`,`text`),precedence:n.precedence,register_interface_ip_with_dns:n[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:n[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(n[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:n[`service-mode-v2-port`]},support_url:p(n[`support-url`],`support-url`,`text`),switch_locked:n[`switch-locked`],tunnel_protocol:p(n[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:n[`virtual-networks-allowed`],default:p(n[`virtual-networks-default`],`virtual-networks-default`,`text`)}});u(await f(`Creating`,async()=>r.zeroTrust.devices.policies.custom.create({...o,account_id:i})),{successLabel:`Created`})}};function ao(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const oo={command:`delete <policy-id>`,describe:`Deletes a device settings profile and fetches a list of the remaining profiles for an account.`,builder:ao,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}`,pathParams:{"policy-id":String(t[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.policies.custom.delete({account_id:r,policy_id:t[`policy-id`]})),{successLabel:`Deleted`})}};function so(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`}).option(`description`,{type:`string`,description:`A description of the policy.`}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`."}).option(`enabled`,{type:`boolean`,description:`Whether the policy will be applied to matching devices.`}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`}).option(`name`,{type:`string`,description:`The name of the device settings profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const co={command:`edit <policy-id>`,describe:`Updates a configured device settings profile.`,builder:so,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies custom edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}`,pathParams:{"policy-id":String(t[`policy-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({allow_mode_switch:t[`allow-mode-switch`],allow_updates:t[`allow-updates`],allowed_to_leave:t[`allowed-to-leave`],auto_connect:t[`auto-connect`],captive_portal:t[`captive-portal`],description:p(t.description,`description`,`text`),disable_auto_fallback:t[`disable-auto-fallback`],enabled:t.enabled,exclude_office_ips:t[`exclude-office-ips`],global_acceleration:{api_endpoints:t[`global-acceleration-api-endpoints`],enabled:t[`global-acceleration-enabled`],masque_endpoints:t[`global-acceleration-masque-endpoints`],wireguard_endpoints:t[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:t[`lan-allow-minutes`],lan_allow_subnet_size:t[`lan-allow-subnet-size`],match:p(t.match,`match`,`text`),name:p(t.name,`name`,`text`),precedence:t.precedence,register_interface_ip_with_dns:t[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:t[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(t[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:t[`service-mode-v2-port`]},support_url:p(t[`support-url`],`support-url`,`text`),switch_locked:t[`switch-locked`],tunnel_protocol:p(t[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:t[`virtual-networks-allowed`],default:p(t[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.custom.edit({...e,account_id:r,policy_id:t[`policy-id`]})),{successLabel:`Updated`});return}let i=l({allow_mode_switch:t[`allow-mode-switch`],allow_updates:t[`allow-updates`],allowed_to_leave:t[`allowed-to-leave`],auto_connect:t[`auto-connect`],captive_portal:t[`captive-portal`],description:p(t.description,`description`,`text`),disable_auto_fallback:t[`disable-auto-fallback`],enabled:t.enabled,exclude_office_ips:t[`exclude-office-ips`],global_acceleration:{api_endpoints:t[`global-acceleration-api-endpoints`],enabled:t[`global-acceleration-enabled`],masque_endpoints:t[`global-acceleration-masque-endpoints`],wireguard_endpoints:t[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:t[`lan-allow-minutes`],lan_allow_subnet_size:t[`lan-allow-subnet-size`],match:p(t.match,`match`,`text`),name:p(t.name,`name`,`text`),precedence:t.precedence,register_interface_ip_with_dns:t[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:t[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(t[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:t[`service-mode-v2-port`]},support_url:p(t[`support-url`],`support-url`,`text`),switch_locked:t[`switch-locked`],tunnel_protocol:p(t[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:t[`virtual-networks-allowed`],default:p(t[`virtual-networks-default`],`virtual-networks-default`,`text`)}});u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.custom.edit({...i,account_id:r,policy_id:t[`policy-id`]})),{successLabel:`Updated`})}};function lo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const uo={command:`get <policy-id>`,describe:`Fetches the list of routes excluded from the WARP client's tunnel for a specific device settings profile.`,builder:lo,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies custom excludes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}/exclude`,pathParams:{"policy-id":String(t[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.custom.excludes.get({account_id:r,policy_id:t[`policy-id`]})),{successLabel:`Loaded`})}};function fo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const po={command:`update <policy-id>`,describe:`Sets the list of routes excluded from the WARP client's tunnel for a specific device settings profile.`,builder:fo,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies custom excludes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}/exclude`,pathParams:{"policy-id":String(t[`policy-id`]??``)},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.custom.excludes.update({body:e,account_id:r,policy_id:t[`policy-id`]})),{successLabel:`Updated`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},mo={command:`excludes`,describe:`Operations for devices.policies.custom.excludes`,builder:e=>e.command(uo).command(po).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ho(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const go={command:`get <policy-id>`,describe:`Fetches the list of domains to bypass Gateway DNS resolution from a specified device settings profile. These domains will use the specified local DNS resolver instead.`,builder:ho,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies custom fallback-domains get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}/fallback_domains`,pathParams:{"policy-id":String(t[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.custom.fallbackDomains.get({account_id:r,policy_id:t[`policy-id`]})),{successLabel:`Loaded`})}};function _o(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const vo={command:`update <policy-id>`,describe:`Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. This will only apply to the specified device settings profile.`,builder:_o,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies custom fallback-domains update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}/fallback_domains`,pathParams:{"policy-id":String(t[`policy-id`]??``)},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.custom.fallbackDomains.update({body:e,account_id:r,policy_id:t[`policy-id`]})),{successLabel:`Updated`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},yo={command:`fallback-domains`,describe:`Operations for devices.policies.custom.fallback-domains`,builder:e=>e.command(go).command(vo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xo={command:`get <policy-id>`,describe:`Fetches a device settings profile by ID.`,builder:bo,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies custom get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}`,pathParams:{"policy-id":String(t[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.custom.get({account_id:r,policy_id:t[`policy-id`]})),{successLabel:`Loaded`})}};function So(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Co={command:`get <policy-id>`,describe:`Fetches the list of routes included in the WARP client's tunnel for a specific device settings profile.`,builder:So,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies custom includes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}/include`,pathParams:{"policy-id":String(t[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.custom.includes.get({account_id:r,policy_id:t[`policy-id`]})),{successLabel:`Loaded`})}};function wo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const To={command:`update <policy-id>`,describe:`Sets the list of routes included in the WARP client's tunnel for a specific device settings profile.`,builder:wo,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies custom includes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}/include`,pathParams:{"policy-id":String(t[`policy-id`]??``)},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.custom.includes.update({body:e,account_id:r,policy_id:t[`policy-id`]})),{successLabel:`Updated`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Eo={command:`includes`,describe:`Operations for devices.policies.custom.includes`,builder:e=>e.command(Co).command(To).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Do(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Oo={command:`list`,describe:`Fetches a list of the device settings profiles for an account.`,builder:Do,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies custom list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policies`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.custom.list({account_id:r})),{successLabel:`Loaded`})}},ko={command:`custom`,describe:`Operations for devices.policies.custom`,builder:e=>e.command(io).command(oo).command(co).command(xo).command(Oo).command(mo).command(yo).command(Eo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ao(e){return e.option(`enabled`,{type:`boolean`,description:`The current status of the device policy certificate provisioning feature for WARP clients.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const jo={command:`edit`,describe:`Enable Zero Trust Clients to provision a certificate, containing a x509 subject, and referenced by Access device posture policies when the client visits MTLS protected domains. This facilitates device posture without a WARP session.`,builder:Ao,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies default certificates edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/devices/policy/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({enabled:e.enabled}):c(e.body)});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.devices.policies.default.certificates.edit({body:r,zone_id:n})),{successLabel:`Updated`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let i=l({enabled:e.enabled});u(await f(`Updating`,async()=>t.zeroTrust.devices.policies.default.certificates.edit({body:i,zone_id:n})),{successLabel:`Updated`})}};function Mo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const No={command:`get`,describe:`Fetches device certificate provisioning.`,builder:Mo,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies default certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/devices/policy/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.devices.policies.default.certificates.get({zone_id:n})),{successLabel:`Loaded`})}},Po={command:`certificates`,describe:`Operations for devices.policies.default.certificates`,builder:e=>e.command(jo).command(No).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Fo(e){return e.option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`."}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const Io={command:`edit`,describe:`Updates the default device settings profile for an account.`,builder:Fo,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies default edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({allow_mode_switch:t[`allow-mode-switch`],allow_updates:t[`allow-updates`],allowed_to_leave:t[`allowed-to-leave`],auto_connect:t[`auto-connect`],captive_portal:t[`captive-portal`],disable_auto_fallback:t[`disable-auto-fallback`],exclude_office_ips:t[`exclude-office-ips`],global_acceleration:{api_endpoints:t[`global-acceleration-api-endpoints`],enabled:t[`global-acceleration-enabled`],masque_endpoints:t[`global-acceleration-masque-endpoints`],wireguard_endpoints:t[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:t[`lan-allow-minutes`],lan_allow_subnet_size:t[`lan-allow-subnet-size`],register_interface_ip_with_dns:t[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:t[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(t[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:t[`service-mode-v2-port`]},support_url:p(t[`support-url`],`support-url`,`text`),switch_locked:t[`switch-locked`],tunnel_protocol:p(t[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:t[`virtual-networks-allowed`],default:p(t[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.default.edit({...e,account_id:r})),{successLabel:`Updated`});return}let i=l({allow_mode_switch:t[`allow-mode-switch`],allow_updates:t[`allow-updates`],allowed_to_leave:t[`allowed-to-leave`],auto_connect:t[`auto-connect`],captive_portal:t[`captive-portal`],disable_auto_fallback:t[`disable-auto-fallback`],exclude_office_ips:t[`exclude-office-ips`],global_acceleration:{api_endpoints:t[`global-acceleration-api-endpoints`],enabled:t[`global-acceleration-enabled`],masque_endpoints:t[`global-acceleration-masque-endpoints`],wireguard_endpoints:t[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:t[`lan-allow-minutes`],lan_allow_subnet_size:t[`lan-allow-subnet-size`],register_interface_ip_with_dns:t[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:t[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(t[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:t[`service-mode-v2-port`]},support_url:p(t[`support-url`],`support-url`,`text`),switch_locked:t[`switch-locked`],tunnel_protocol:p(t[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:t[`virtual-networks-allowed`],default:p(t[`virtual-networks-default`],`virtual-networks-default`,`text`)}});u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.default.edit({...i,account_id:r})),{successLabel:`Updated`})}};function Lo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ro={command:`get`,describe:`Fetches the list of routes excluded from the WARP client's tunnel.`,builder:Lo,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies default excludes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy/exclude`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.default.excludes.get({account_id:r})),{successLabel:`Loaded`})}};function zo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Bo={command:`update`,describe:`Sets the list of routes excluded from the WARP client's tunnel.`,builder:zo,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies default excludes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy/exclude`,pathParams:{},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.default.excludes.update({body:e,account_id:r})),{successLabel:`Updated`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Vo={command:`excludes`,describe:`Operations for devices.policies.default.excludes`,builder:e=>e.command(Ro).command(Bo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ho(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Uo={command:`get`,describe:`Fetches a list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.`,builder:Ho,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies default fallback-domains get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy/fallback_domains`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.default.fallbackDomains.get({account_id:r})),{successLabel:`Loaded`})}};function Wo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Go={command:`update`,describe:`Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.`,builder:Wo,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies default fallback-domains update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy/fallback_domains`,pathParams:{},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.default.fallbackDomains.update({body:e,account_id:r})),{successLabel:`Updated`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ko={command:`fallback-domains`,describe:`Operations for devices.policies.default.fallback-domains`,builder:e=>e.command(Uo).command(Go).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function qo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jo={command:`get`,describe:`Fetches the default device settings profile for an account.`,builder:qo,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies default get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.default.get({account_id:r})),{successLabel:`Loaded`})}};function Yo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xo={command:`get`,describe:`Fetches the list of routes included in the WARP client's tunnel.`,builder:Yo,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies default includes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy/include`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.default.includes.get({account_id:r})),{successLabel:`Loaded`})}};function Zo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Qo={command:`update`,describe:`Sets the list of routes included in the WARP client's tunnel.`,builder:Zo,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices policies default includes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/policy/include`,pathParams:{},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.default.includes.update({body:e,account_id:r})),{successLabel:`Updated`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},$o={command:`includes`,describe:`Operations for devices.policies.default.includes`,builder:e=>e.command(Xo).command(Qo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},es={command:`default`,describe:`Operations for devices.policies.default`,builder:e=>e.command(Io).command(Jo).command(Po).command(Vo).command(Ko).command($o).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ts={command:`policies`,describe:`Operations for devices.policies`,builder:e=>e.command(ko).command(es).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ns(e){return e.option(`description`,{type:`string`,description:`The description of the device posture rule.`}).option(`expiration`,{type:`string`,description:`Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.`}).option(`input-exists`,{type:`boolean`,description:`Whether or not file exists.`}).option(`input-operating-system`,{type:`string`,description:`Operating system.`,choices:[`windows`,`linux`,`mac`,`android`,`ios`,`chromeos`]}).option(`input-path`,{type:`string`,description:`File path.`}).option(`input-sha256`,{type:`string`,description:`SHA-256.`}).option(`input-thumbprint`,{type:`string`,description:`Signing certificate thumbprint.`}).option(`input-id`,{type:`string`,description:`List ID.`}).option(`input-domain`,{type:`string`,description:`Domain.`}).option(`input-operator`,{type:`string`,description:`Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-os-distro-name`,{type:`string`,description:`Operating System Distribution Name (linux only).`}).option(`input-os-distro-revision`,{type:`string`,description:`Version of OS Distribution (linux only).`}).option(`input-os-version-extra`,{type:`string`,description:`Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.`}).option(`input-version`,{type:`string`,description:`Version of OS.`}).option(`input-enabled`,{type:`boolean`,description:`Enabled.`}).option(`input-check-disks`,{type:`string`,array:!0,description:`List of volume names to be checked for encryption.`}).option(`input-require-all`,{type:`boolean`,description:`Whether to check all disks for encryption.`}).option(`input-certificate-id`,{type:`string`,description:`UUID of Cloudflare managed certificate.`}).option(`input-cn`,{type:`string`,description:`Common Name that is protected by the certificate.`}).option(`input-check-private-key`,{type:`boolean`,description:`Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.`}).option(`input-extended-key-usage`,{type:`string`,array:!0,description:`List of values indicating purposes for which the certificate public key can be used.`}).option(`input-locations-paths`,{type:`string`,array:!0,description:`List of paths to check for client certificate on linux.`}).option(`input-locations-trust-stores`,{type:`string`,array:!0,description:`List of trust stores to check for client certificate.`}).option(`input-subject-alternative-names`,{type:`string`,array:!0,description:`List of certificate Subject Alternative Names.`}).option(`input-update-window-days`,{type:`number`,description:`Number of days that the antivirus should be updated within.`}).option(`input-compliance-status`,{type:`string`,description:`Compliance Status.`,choices:[`compliant`,`noncompliant`,`unknown`,`notapplicable`,`ingraceperiod`,`error`]}).option(`input-connection-id`,{type:`string`,description:`Posture Integration ID.`}).option(`input-last-seen`,{type:`string`,description:`For more details on last seen, please refer to the Crowdstrike documentation.`}).option(`input-os`,{type:`string`,description:`Os Version.`}).option(`input-overall`,{type:`string`,description:`Overall.`}).option(`input-sensor-config`,{type:`string`,description:`SensorConfig.`}).option(`input-state`,{type:`string`,description:`For more details on state, please refer to the Crowdstrike documentation.`,choices:[`online`,`offline`,`unknown`]}).option(`input-version-operator`,{type:`string`,description:`Version Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-auth-state`,{type:`string`,array:!0,description:`The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.`}).option(`input-count-operator`,{type:`string`,description:`Count Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-issue-count`,{type:`string`,description:`The Number of Issues.`}).option(`input-eid-last-seen`,{type:`string`,description:`For more details on eid last seen, refer to the Tanium documentation.`}).option(`input-risk-level`,{type:`string`,description:`For more details on risk level, refer to the Tanium documentation.`,choices:[`low`,`medium`,`high`,`critical`]}).option(`input-score-operator`,{type:`string`,description:`Score Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-total-score`,{type:`number`,description:`For more details on total score, refer to the Tanium documentation.`}).option(`input-active-threats`,{type:`number`,description:`The Number of active threats.`}).option(`input-infected`,{type:`boolean`,description:`Whether device is infected.`}).option(`input-is-active`,{type:`boolean`,description:`Whether device is active.`}).option(`input-network-status`,{type:`string`,description:`Network status of device.`,choices:[`connected`,`disconnected`,`disconnecting`,`connecting`]}).option(`input-operational-state`,{type:`string`,description:`Agent operational state.`,choices:[`na`,`partially_disabled`,`auto_fully_disabled`,`fully_disabled`,`auto_partially_disabled`,`disabled_error`,`db_corruption`]}).option(`input-score`,{type:`number`,description:`A value between 0-100 assigned to devices set by the 3rd party posture provider.`}).option(`name`,{type:`string`,description:`The name of the device posture rule.`}).option(`schedule`,{type:`string`,description:"Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`."}).option(`type`,{type:`string`,description:`The type of device posture rule.`,choices:[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`input-exists`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operating-system`,`input-id.input-check-disks.input-require-all.input-certificate-id.input-cn.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-operator.input-os.input-overall.input-sensor-config.input-state.input-version.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-path`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sha256`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-thumbprint`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-id`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-domain`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operator`,[`input-exists`,`input-path`,`input-sha256`,`input-thumbprint`,`input-operating-system`,`input-id`,`input-domain`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`,`input-compliance-status`,`input-connection-id`,`input-auth-state`,`input-count-operator`,`input-issue-count`]).conflicts(`input-os-distro-name`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-distro-revision`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-version-extra`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-version`,[`input-operating-system`,`input-operator`]).conflicts(`input-enabled`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-enabled`,[`input-operating-system`]).conflicts(`input-check-disks`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-require-all`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-certificate-id`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-cn`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-cn`,[`input-certificate-id`]).conflicts(`input-check-private-key`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-check-private-key`,[`input-certificate-id`,`input-operating-system`]).conflicts(`input-extended-key-usage`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-paths`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-trust-stores`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-subject-alternative-names`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-update-window-days`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-compliance-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-connection-id`,[`input-exists`,`input-operating-system`,`input-path`,`input-sha256`,`input-thumbprint`,`input-id`,`input-domain`,`input-operator`,`input-os-distro-name`,`input-os-distro-revision`,`input-os-version-extra`,`input-version`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`]).conflicts(`input-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-overall`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sensor-config`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-auth-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-count-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-issue-count`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-eid-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-risk-level`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-score-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-total-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-active-threats`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-infected`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-is-active`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-network-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-operational-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state`.split(`.`)).implies(`input-score`,[`input-connection-id`,`input-operator`])}const rs={command:`create`,describe:`Creates a new device posture rule.`,builder:ns,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust devices posture create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/posture`,pathParams:{},bodyKind:`json`,body:r.body===void 0?l({description:p(r.description,`description`,`text`),expiration:p(r.expiration,`expiration`,`text`),input:{exists:r[`input-exists`],operating_system:p(r[`input-operating-system`],`input-operating-system`,`text`),path:p(r[`input-path`],`input-path`,`text`),sha256:p(r[`input-sha256`],`input-sha256`,`text`),thumbprint:p(r[`input-thumbprint`],`input-thumbprint`,`text`),id:p(r[`input-id`],`input-id`,`text`),domain:p(r[`input-domain`],`input-domain`,`text`),operator:p(r[`input-operator`],`input-operator`,`text`),os_distro_name:p(r[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:p(r[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:p(r[`input-os-version-extra`],`input-os-version-extra`,`text`),version:p(r[`input-version`],`input-version`,`text`),enabled:r[`input-enabled`],checkDisks:r[`input-check-disks`],requireAll:r[`input-require-all`],certificate_id:p(r[`input-certificate-id`],`input-certificate-id`,`text`),cn:p(r[`input-cn`],`input-cn`,`text`),check_private_key:r[`input-check-private-key`],extended_key_usage:r[`input-extended-key-usage`],locations:{paths:r[`input-locations-paths`],trust_stores:r[`input-locations-trust-stores`]},subject_alternative_names:r[`input-subject-alternative-names`],update_window_days:r[`input-update-window-days`],compliance_status:p(r[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:p(r[`input-connection-id`],`input-connection-id`,`text`),last_seen:p(r[`input-last-seen`],`input-last-seen`,`text`),os:p(r[`input-os`],`input-os`,`text`),overall:p(r[`input-overall`],`input-overall`,`text`),sensor_config:p(r[`input-sensor-config`],`input-sensor-config`,`text`),state:p(r[`input-state`],`input-state`,`text`),versionOperator:p(r[`input-version-operator`],`input-version-operator`,`text`),auth_state:r[`input-auth-state`],countOperator:p(r[`input-count-operator`],`input-count-operator`,`text`),issue_count:p(r[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:p(r[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:p(r[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:p(r[`input-score-operator`],`input-score-operator`,`text`),total_score:r[`input-total-score`],active_threats:r[`input-active-threats`],infected:r[`input-infected`],is_active:r[`input-is-active`],network_status:p(r[`input-network-status`],`input-network-status`,`text`),operational_state:p(r[`input-operational-state`],`input-operational-state`,`text`),score:r[`input-score`]},name:p(r.name,`name`,`text`),schedule:p(r.schedule,`schedule`,`text`),type:p(r.type,`type`,`text`)}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Creating`,async()=>i.zeroTrust.devices.posture.create({...e,account_id:o})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await t(`name`,`The name of the device posture rule.`)),r.type===void 0&&(r.type=await n(`type`,`The type of device posture rule.`,[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]));let m=l({description:p(r.description,`description`,`text`),expiration:p(r.expiration,`expiration`,`text`),input:{exists:r[`input-exists`],operating_system:p(r[`input-operating-system`],`input-operating-system`,`text`),path:p(r[`input-path`],`input-path`,`text`),sha256:p(r[`input-sha256`],`input-sha256`,`text`),thumbprint:p(r[`input-thumbprint`],`input-thumbprint`,`text`),id:p(r[`input-id`],`input-id`,`text`),domain:p(r[`input-domain`],`input-domain`,`text`),operator:p(r[`input-operator`],`input-operator`,`text`),os_distro_name:p(r[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:p(r[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:p(r[`input-os-version-extra`],`input-os-version-extra`,`text`),version:p(r[`input-version`],`input-version`,`text`),enabled:r[`input-enabled`],checkDisks:r[`input-check-disks`],requireAll:r[`input-require-all`],certificate_id:p(r[`input-certificate-id`],`input-certificate-id`,`text`),cn:p(r[`input-cn`],`input-cn`,`text`),check_private_key:r[`input-check-private-key`],extended_key_usage:r[`input-extended-key-usage`],locations:{paths:r[`input-locations-paths`],trust_stores:r[`input-locations-trust-stores`]},subject_alternative_names:r[`input-subject-alternative-names`],update_window_days:r[`input-update-window-days`],compliance_status:p(r[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:p(r[`input-connection-id`],`input-connection-id`,`text`),last_seen:p(r[`input-last-seen`],`input-last-seen`,`text`),os:p(r[`input-os`],`input-os`,`text`),overall:p(r[`input-overall`],`input-overall`,`text`),sensor_config:p(r[`input-sensor-config`],`input-sensor-config`,`text`),state:p(r[`input-state`],`input-state`,`text`),versionOperator:p(r[`input-version-operator`],`input-version-operator`,`text`),auth_state:r[`input-auth-state`],countOperator:p(r[`input-count-operator`],`input-count-operator`,`text`),issue_count:p(r[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:p(r[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:p(r[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:p(r[`input-score-operator`],`input-score-operator`,`text`),total_score:r[`input-total-score`],active_threats:r[`input-active-threats`],infected:r[`input-infected`],is_active:r[`input-is-active`],network_status:p(r[`input-network-status`],`input-network-status`,`text`),operational_state:p(r[`input-operational-state`],`input-operational-state`,`text`),score:r[`input-score`]},name:p(r.name,`name`,`text`),schedule:p(r.schedule,`schedule`,`text`),type:p(r.type,`type`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.devices.posture.create({...m,account_id:o})),{successLabel:`Created`})}};function is(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const as={command:`delete <rule-id>`,describe:`Deletes a device posture rule.`,builder:is,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices posture delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/posture/${t[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(t[`rule-id`]))}`,pathParams:{"rule-id":String(t[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.posture.delete({account_id:r,rule_id:t[`rule-id`]})),{successLabel:`Deleted`})}};function os(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ss={command:`get <rule-id>`,describe:`Fetches a single device posture rule.`,builder:os,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices posture get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/posture/${t[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(t[`rule-id`]))}`,pathParams:{"rule-id":String(t[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.posture.get({account_id:r,rule_id:t[`rule-id`]})),{successLabel:`Loaded`})}};function cs(e){return e.option(`config-api-url`,{type:`string`,description:`The Workspace One API URL provided in the Workspace One Admin Dashboard.`}).option(`config-auth-url`,{type:`string`,description:`The Workspace One Authorization URL depending on your region.`}).option(`config-client-id`,{type:`string`,description:`The Workspace One client ID provided in the Workspace One Admin Dashboard.`}).option(`config-client-secret`,{type:`string`,description:`The Workspace One client secret provided in the Workspace One Admin Dashboard.`}).option(`config-customer-id`,{type:`string`,description:`The Crowdstrike customer ID.`}).option(`config-client-key`,{type:`string`,description:`The Uptycs client secret.`}).option(`config-access-client-id`,{type:`string`,description:"If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`."}).option(`config-access-client-secret`,{type:`string`,description:"If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`."}).option(`interval`,{type:`string`,description:"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`)."}).option(`name`,{type:`string`,description:`The name of the device posture integration.`}).option(`type`,{type:`string`,description:`The type of device posture integration.`,choices:[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`config-api-url`,[`config-customer-id`,`config-client-id`,`config-client-secret`]).conflicts(`config-auth-url`,[`config-customer-id`,`config-client-key`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-auth-url`,[`config-api-url`,`config-client-id`,`config-client-secret`]).conflicts(`config-client-id`,[`config-client-key`,`config-customer-id`,`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-client-secret`,[`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-customer-id`,[`config-auth-url`,`config-client-id`,`config-api-url`,`config-access-client-id`,`config-access-client-secret`]).conflicts(`config-client-key`,[`config-auth-url`,`config-client-id`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-client-key`,[`config-api-url`,`config-customer-id`,`config-client-secret`]).conflicts(`config-access-client-id`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-id`,[`config-api-url`,`config-access-client-secret`]).conflicts(`config-access-client-secret`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-secret`,[`config-api-url`,`config-access-client-id`])}const ls={command:`create`,describe:`Create a new device posture integration.`,builder:cs,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust devices posture integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/posture/integration`,pathParams:{},bodyKind:`json`,body:r.body===void 0?l({config:{api_url:p(r[`config-api-url`],`config-api-url`,`text`),auth_url:p(r[`config-auth-url`],`config-auth-url`,`text`),client_id:p(r[`config-client-id`],`config-client-id`,`text`),client_secret:p(r[`config-client-secret`],`config-client-secret`,`text`),customer_id:p(r[`config-customer-id`],`config-customer-id`,`text`),client_key:p(r[`config-client-key`],`config-client-key`,`text`),access_client_id:p(r[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:p(r[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:p(r.interval,`interval`,`text`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`)}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Creating`,async()=>i.zeroTrust.devices.posture.integrations.create({...e,account_id:o})),{successLabel:`Created`});return}r.interval===void 0&&(r.interval=await t(`interval`,"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`).")),r.name===void 0&&(r.name=await t(`name`,`The name of the device posture integration.`)),r.type===void 0&&(r.type=await n(`type`,`The type of device posture integration.`,[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]));let m=l({config:{api_url:p(r[`config-api-url`],`config-api-url`,`text`),auth_url:p(r[`config-auth-url`],`config-auth-url`,`text`),client_id:p(r[`config-client-id`],`config-client-id`,`text`),client_secret:p(r[`config-client-secret`],`config-client-secret`,`text`),customer_id:p(r[`config-customer-id`],`config-customer-id`,`text`),client_key:p(r[`config-client-key`],`config-client-key`,`text`),access_client_id:p(r[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:p(r[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:p(r.interval,`interval`,`text`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.devices.posture.integrations.create({...m,account_id:o})),{successLabel:`Created`})}};function us(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ds={command:`delete <integration-id>`,describe:`Delete a configured device posture integration.`,builder:us,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices posture integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/posture/integration/${t[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(t[`integration-id`]))}`,pathParams:{"integration-id":String(t[`integration-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.posture.integrations.delete({account_id:r,integration_id:t[`integration-id`]})),{successLabel:`Deleted`})}};function fs(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`config-api-url`,{type:`string`,description:`The Workspace One API URL provided in the Workspace One Admin Dashboard.`}).option(`config-auth-url`,{type:`string`,description:`The Workspace One Authorization URL depending on your region.`}).option(`config-client-id`,{type:`string`,description:`The Workspace One client ID provided in the Workspace One Admin Dashboard.`}).option(`config-client-secret`,{type:`string`,description:`The Workspace One client secret provided in the Workspace One Admin Dashboard.`}).option(`config-customer-id`,{type:`string`,description:`The Crowdstrike customer ID.`}).option(`config-client-key`,{type:`string`,description:`The Uptycs client secret.`}).option(`config-access-client-id`,{type:`string`,description:"If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`."}).option(`config-access-client-secret`,{type:`string`,description:"If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`."}).option(`interval`,{type:`string`,description:"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`)."}).option(`name`,{type:`string`,description:`The name of the device posture integration.`}).option(`type`,{type:`string`,description:`The type of device posture integration.`,choices:[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`config-api-url`,[`config-customer-id`,`config-client-id`,`config-client-secret`]).conflicts(`config-auth-url`,[`config-customer-id`,`config-client-key`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-auth-url`,[`config-api-url`,`config-client-id`,`config-client-secret`]).conflicts(`config-client-id`,[`config-client-key`,`config-customer-id`,`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-client-secret`,[`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-customer-id`,[`config-auth-url`,`config-client-id`,`config-api-url`,`config-access-client-id`,`config-access-client-secret`]).conflicts(`config-client-key`,[`config-auth-url`,`config-client-id`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-client-key`,[`config-api-url`,`config-customer-id`,`config-client-secret`]).conflicts(`config-access-client-id`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-id`,[`config-api-url`,`config-access-client-secret`]).conflicts(`config-access-client-secret`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-secret`,[`config-api-url`,`config-access-client-id`])}const ps={command:`edit <integration-id>`,describe:`Updates a configured device posture integration.`,builder:fs,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices posture integrations edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/posture/integration/${t[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(t[`integration-id`]))}`,pathParams:{"integration-id":String(t[`integration-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({config:{api_url:p(t[`config-api-url`],`config-api-url`,`text`),auth_url:p(t[`config-auth-url`],`config-auth-url`,`text`),client_id:p(t[`config-client-id`],`config-client-id`,`text`),client_secret:p(t[`config-client-secret`],`config-client-secret`,`text`),customer_id:p(t[`config-customer-id`],`config-customer-id`,`text`),client_key:p(t[`config-client-key`],`config-client-key`,`text`),access_client_id:p(t[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:p(t[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:p(t.interval,`interval`,`text`),name:p(t.name,`name`,`text`),type:p(t.type,`type`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.posture.integrations.edit({...e,account_id:r,integration_id:t[`integration-id`]})),{successLabel:`Updated`});return}let i=l({config:{api_url:p(t[`config-api-url`],`config-api-url`,`text`),auth_url:p(t[`config-auth-url`],`config-auth-url`,`text`),client_id:p(t[`config-client-id`],`config-client-id`,`text`),client_secret:p(t[`config-client-secret`],`config-client-secret`,`text`),customer_id:p(t[`config-customer-id`],`config-customer-id`,`text`),client_key:p(t[`config-client-key`],`config-client-key`,`text`),access_client_id:p(t[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:p(t[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:p(t.interval,`interval`,`text`),name:p(t.name,`name`,`text`),type:p(t.type,`type`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.devices.posture.integrations.edit({...i,account_id:r,integration_id:t[`integration-id`]})),{successLabel:`Updated`})}};function ms(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const hs={command:`get <integration-id>`,describe:`Fetches details for a single device posture integration.`,builder:ms,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices posture integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/posture/integration/${t[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(t[`integration-id`]))}`,pathParams:{"integration-id":String(t[`integration-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.posture.integrations.get({account_id:r,integration_id:t[`integration-id`]})),{successLabel:`Loaded`})}};function gs(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _s={command:`list`,describe:`Fetches the list of device posture integrations for an account.`,builder:gs,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices posture integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/posture/integration`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.posture.integrations.list({account_id:r})),{successLabel:`Loaded`})}},vs={command:`integrations`,describe:`Operations for devices.posture.integrations`,builder:e=>e.command(ls).command(ds).command(ps).command(hs).command(_s).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ys(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const bs={command:`list`,describe:`Fetches device posture rules for a Zero Trust account.`,builder:ys,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices posture list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/posture`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.posture.list({account_id:r})),{successLabel:`Loaded`})}};function xs(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`The description of the device posture rule.`}).option(`expiration`,{type:`string`,description:`Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.`}).option(`input-exists`,{type:`boolean`,description:`Whether or not file exists.`}).option(`input-operating-system`,{type:`string`,description:`Operating system.`,choices:[`windows`,`linux`,`mac`,`android`,`ios`,`chromeos`]}).option(`input-path`,{type:`string`,description:`File path.`}).option(`input-sha256`,{type:`string`,description:`SHA-256.`}).option(`input-thumbprint`,{type:`string`,description:`Signing certificate thumbprint.`}).option(`input-id`,{type:`string`,description:`List ID.`}).option(`input-domain`,{type:`string`,description:`Domain.`}).option(`input-operator`,{type:`string`,description:`Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-os-distro-name`,{type:`string`,description:`Operating System Distribution Name (linux only).`}).option(`input-os-distro-revision`,{type:`string`,description:`Version of OS Distribution (linux only).`}).option(`input-os-version-extra`,{type:`string`,description:`Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.`}).option(`input-version`,{type:`string`,description:`Version of OS.`}).option(`input-enabled`,{type:`boolean`,description:`Enabled.`}).option(`input-check-disks`,{type:`string`,array:!0,description:`List of volume names to be checked for encryption.`}).option(`input-require-all`,{type:`boolean`,description:`Whether to check all disks for encryption.`}).option(`input-certificate-id`,{type:`string`,description:`UUID of Cloudflare managed certificate.`}).option(`input-cn`,{type:`string`,description:`Common Name that is protected by the certificate.`}).option(`input-check-private-key`,{type:`boolean`,description:`Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.`}).option(`input-extended-key-usage`,{type:`string`,array:!0,description:`List of values indicating purposes for which the certificate public key can be used.`}).option(`input-locations-paths`,{type:`string`,array:!0,description:`List of paths to check for client certificate on linux.`}).option(`input-locations-trust-stores`,{type:`string`,array:!0,description:`List of trust stores to check for client certificate.`}).option(`input-subject-alternative-names`,{type:`string`,array:!0,description:`List of certificate Subject Alternative Names.`}).option(`input-update-window-days`,{type:`number`,description:`Number of days that the antivirus should be updated within.`}).option(`input-compliance-status`,{type:`string`,description:`Compliance Status.`,choices:[`compliant`,`noncompliant`,`unknown`,`notapplicable`,`ingraceperiod`,`error`]}).option(`input-connection-id`,{type:`string`,description:`Posture Integration ID.`}).option(`input-last-seen`,{type:`string`,description:`For more details on last seen, please refer to the Crowdstrike documentation.`}).option(`input-os`,{type:`string`,description:`Os Version.`}).option(`input-overall`,{type:`string`,description:`Overall.`}).option(`input-sensor-config`,{type:`string`,description:`SensorConfig.`}).option(`input-state`,{type:`string`,description:`For more details on state, please refer to the Crowdstrike documentation.`,choices:[`online`,`offline`,`unknown`]}).option(`input-version-operator`,{type:`string`,description:`Version Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-auth-state`,{type:`string`,array:!0,description:`The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.`}).option(`input-count-operator`,{type:`string`,description:`Count Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-issue-count`,{type:`string`,description:`The Number of Issues.`}).option(`input-eid-last-seen`,{type:`string`,description:`For more details on eid last seen, refer to the Tanium documentation.`}).option(`input-risk-level`,{type:`string`,description:`For more details on risk level, refer to the Tanium documentation.`,choices:[`low`,`medium`,`high`,`critical`]}).option(`input-score-operator`,{type:`string`,description:`Score Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-total-score`,{type:`number`,description:`For more details on total score, refer to the Tanium documentation.`}).option(`input-active-threats`,{type:`number`,description:`The Number of active threats.`}).option(`input-infected`,{type:`boolean`,description:`Whether device is infected.`}).option(`input-is-active`,{type:`boolean`,description:`Whether device is active.`}).option(`input-network-status`,{type:`string`,description:`Network status of device.`,choices:[`connected`,`disconnected`,`disconnecting`,`connecting`]}).option(`input-operational-state`,{type:`string`,description:`Agent operational state.`,choices:[`na`,`partially_disabled`,`auto_fully_disabled`,`fully_disabled`,`auto_partially_disabled`,`disabled_error`,`db_corruption`]}).option(`input-score`,{type:`number`,description:`A value between 0-100 assigned to devices set by the 3rd party posture provider.`}).option(`name`,{type:`string`,description:`The name of the device posture rule.`}).option(`schedule`,{type:`string`,description:"Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`."}).option(`type`,{type:`string`,description:`The type of device posture rule.`,choices:[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`input-exists`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operating-system`,`input-id.input-check-disks.input-require-all.input-certificate-id.input-cn.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-operator.input-os.input-overall.input-sensor-config.input-state.input-version.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-path`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sha256`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-thumbprint`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-id`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-domain`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operator`,[`input-exists`,`input-path`,`input-sha256`,`input-thumbprint`,`input-operating-system`,`input-id`,`input-domain`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`,`input-compliance-status`,`input-connection-id`,`input-auth-state`,`input-count-operator`,`input-issue-count`]).conflicts(`input-os-distro-name`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-distro-revision`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-version-extra`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-version`,[`input-operating-system`,`input-operator`]).conflicts(`input-enabled`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-enabled`,[`input-operating-system`]).conflicts(`input-check-disks`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-require-all`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-certificate-id`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-cn`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-cn`,[`input-certificate-id`]).conflicts(`input-check-private-key`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-check-private-key`,[`input-certificate-id`,`input-operating-system`]).conflicts(`input-extended-key-usage`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-paths`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-trust-stores`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-subject-alternative-names`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-update-window-days`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-compliance-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-connection-id`,[`input-exists`,`input-operating-system`,`input-path`,`input-sha256`,`input-thumbprint`,`input-id`,`input-domain`,`input-operator`,`input-os-distro-name`,`input-os-distro-revision`,`input-os-version-extra`,`input-version`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`]).conflicts(`input-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-overall`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sensor-config`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-auth-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-count-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-issue-count`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-eid-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-risk-level`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-score-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-total-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-active-threats`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-infected`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-is-active`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-network-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-operational-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state`.split(`.`)).implies(`input-score`,[`input-connection-id`,`input-operator`])}const Ss={command:`update <rule-id>`,describe:`Updates a device posture rule.`,builder:xs,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust devices posture update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/posture/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?l({description:p(r.description,`description`,`text`),expiration:p(r.expiration,`expiration`,`text`),input:{exists:r[`input-exists`],operating_system:p(r[`input-operating-system`],`input-operating-system`,`text`),path:p(r[`input-path`],`input-path`,`text`),sha256:p(r[`input-sha256`],`input-sha256`,`text`),thumbprint:p(r[`input-thumbprint`],`input-thumbprint`,`text`),id:p(r[`input-id`],`input-id`,`text`),domain:p(r[`input-domain`],`input-domain`,`text`),operator:p(r[`input-operator`],`input-operator`,`text`),os_distro_name:p(r[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:p(r[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:p(r[`input-os-version-extra`],`input-os-version-extra`,`text`),version:p(r[`input-version`],`input-version`,`text`),enabled:r[`input-enabled`],checkDisks:r[`input-check-disks`],requireAll:r[`input-require-all`],certificate_id:p(r[`input-certificate-id`],`input-certificate-id`,`text`),cn:p(r[`input-cn`],`input-cn`,`text`),check_private_key:r[`input-check-private-key`],extended_key_usage:r[`input-extended-key-usage`],locations:{paths:r[`input-locations-paths`],trust_stores:r[`input-locations-trust-stores`]},subject_alternative_names:r[`input-subject-alternative-names`],update_window_days:r[`input-update-window-days`],compliance_status:p(r[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:p(r[`input-connection-id`],`input-connection-id`,`text`),last_seen:p(r[`input-last-seen`],`input-last-seen`,`text`),os:p(r[`input-os`],`input-os`,`text`),overall:p(r[`input-overall`],`input-overall`,`text`),sensor_config:p(r[`input-sensor-config`],`input-sensor-config`,`text`),state:p(r[`input-state`],`input-state`,`text`),versionOperator:p(r[`input-version-operator`],`input-version-operator`,`text`),auth_state:r[`input-auth-state`],countOperator:p(r[`input-count-operator`],`input-count-operator`,`text`),issue_count:p(r[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:p(r[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:p(r[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:p(r[`input-score-operator`],`input-score-operator`,`text`),total_score:r[`input-total-score`],active_threats:r[`input-active-threats`],infected:r[`input-infected`],is_active:r[`input-is-active`],network_status:p(r[`input-network-status`],`input-network-status`,`text`),operational_state:p(r[`input-operational-state`],`input-operational-state`,`text`),score:r[`input-score`]},name:p(r.name,`name`,`text`),schedule:p(r.schedule,`schedule`,`text`),type:p(r.type,`type`,`text`)}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Updating`,async()=>i.zeroTrust.devices.posture.update({...e,account_id:o,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await t(`name`,`The name of the device posture rule.`)),r.type===void 0&&(r.type=await n(`type`,`The type of device posture rule.`,[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]));let m=l({description:p(r.description,`description`,`text`),expiration:p(r.expiration,`expiration`,`text`),input:{exists:r[`input-exists`],operating_system:p(r[`input-operating-system`],`input-operating-system`,`text`),path:p(r[`input-path`],`input-path`,`text`),sha256:p(r[`input-sha256`],`input-sha256`,`text`),thumbprint:p(r[`input-thumbprint`],`input-thumbprint`,`text`),id:p(r[`input-id`],`input-id`,`text`),domain:p(r[`input-domain`],`input-domain`,`text`),operator:p(r[`input-operator`],`input-operator`,`text`),os_distro_name:p(r[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:p(r[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:p(r[`input-os-version-extra`],`input-os-version-extra`,`text`),version:p(r[`input-version`],`input-version`,`text`),enabled:r[`input-enabled`],checkDisks:r[`input-check-disks`],requireAll:r[`input-require-all`],certificate_id:p(r[`input-certificate-id`],`input-certificate-id`,`text`),cn:p(r[`input-cn`],`input-cn`,`text`),check_private_key:r[`input-check-private-key`],extended_key_usage:r[`input-extended-key-usage`],locations:{paths:r[`input-locations-paths`],trust_stores:r[`input-locations-trust-stores`]},subject_alternative_names:r[`input-subject-alternative-names`],update_window_days:r[`input-update-window-days`],compliance_status:p(r[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:p(r[`input-connection-id`],`input-connection-id`,`text`),last_seen:p(r[`input-last-seen`],`input-last-seen`,`text`),os:p(r[`input-os`],`input-os`,`text`),overall:p(r[`input-overall`],`input-overall`,`text`),sensor_config:p(r[`input-sensor-config`],`input-sensor-config`,`text`),state:p(r[`input-state`],`input-state`,`text`),versionOperator:p(r[`input-version-operator`],`input-version-operator`,`text`),auth_state:r[`input-auth-state`],countOperator:p(r[`input-count-operator`],`input-count-operator`,`text`),issue_count:p(r[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:p(r[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:p(r[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:p(r[`input-score-operator`],`input-score-operator`,`text`),total_score:r[`input-total-score`],active_threats:r[`input-active-threats`],infected:r[`input-infected`],is_active:r[`input-is-active`],network_status:p(r[`input-network-status`],`input-network-status`,`text`),operational_state:p(r[`input-operational-state`],`input-operational-state`,`text`),score:r[`input-score`]},name:p(r.name,`name`,`text`),schedule:p(r.schedule,`schedule`,`text`),type:p(r.type,`type`,`text`)});u(await f(`Updating`,async()=>i.zeroTrust.devices.posture.update({...m,account_id:o,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},Cs={command:`posture`,describe:`Operations for devices.posture`,builder:e=>e.command(rs).command(as).command(ss).command(bs).command(Ss).command(vs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ws(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ts={command:`bulk-delete`,describe:`Deletes a list of WARP registrations.`,builder:ws,handler:async t=>{let n={id:t.id};if(t.dryRun){d({command:`cf zero-trust devices registrations bulk-delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/registrations`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),o=t.local?h:await a(r);if(t.accountId=o,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>r.zeroTrust.devices.registrations.bulkDelete({account_id:o,...n})),{successLabel:`Deleted`})}};function Es(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ds={command:`delete <registration-id>`,describe:`Deletes a WARP registration.`,builder:Es,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices registrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/registrations/${t[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(t[`registration-id`]))}`,pathParams:{"registration-id":String(t[`registration-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.registrations.delete({account_id:r,registration_id:t[`registration-id`]})),{successLabel:`Deleted`})}};function Os(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the registration response. Supported values are: "policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ks={command:`get <registration-id>`,describe:`Fetches a single WARP registration.`,builder:Os,handler:async t=>{let n={include:t.include};if(t.dryRun){d({command:`cf zero-trust devices registrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/registrations/${t[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(t[`registration-id`]))}`,pathParams:{"registration-id":String(t[`registration-id`]??``)},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.devices.registrations.get({account_id:i,registration_id:t[`registration-id`],...n})),{successLabel:`Loaded`})}};function As(e){return e.option(`user-id`,{type:`string`,description:`Filter by user ID.`}).option(`seen-after`,{type:`string`,description:`Filter by the last_seen timestamp - returns only registrations last seen after this timestamp.`}).option(`seen-before`,{type:`string`,description:`Filter by the last_seen timestamp - returns only registrations last seen before this timestamp.`}).option(`status`,{type:`string`,description:`Filter by registration status. Defaults to 'active'.`,choices:[`active`,`all`,`revoked`]}).option(`per-page`,{type:`number`,description:`The maximum number of devices to return in a single response.`}).option(`search`,{type:`string`,description:`Filter by registration details.`}).option(`sort-by`,{type:`string`,description:`The registration field to order results by.`,choices:[`id`,`user.name`,`user.email`,`last_seen_at`,`created_at`]}).option(`sort-order`,{type:`string`,description:`Sort direction.`,choices:[`asc`,`desc`]}).option(`cursor`,{type:`string`,description:`Opaque token indicating the starting position when requesting the next set of records. A cursor value can be obtained from the result_info.cursor field in the response.`}).option(`id`,{type:`string`,description:`Filter by registration ID.`}).option(`device-id`,{type:`string`,description:`Filter by WARP device ID.`}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the registration response. Supported values are: "policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const js={command:`list`,describe:`Lists WARP registrations.`,builder:g(As),handler:async t=>{let n={"user.id":t[`user-id`],seen_after:t[`seen-after`],seen_before:t[`seen-before`],status:t.status,per_page:t[`per-page`],search:t.search,sort_by:t[`sort-by`],sort_order:t[`sort-order`],cursor:t.cursor,id:t.id,"device.id":t[`device-id`],include:t.include};if(t.dryRun){d({command:`cf zero-trust devices registrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/registrations`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.devices.registrations.list({account_id:i,...n})),{successLabel:`Loaded`})}};function Ms(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to revoke.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ns={command:`revoke`,describe:`Revokes a list of WARP registrations.`,builder:Ms,handler:async t=>{let n={id:t.id};if(t.dryRun){d({command:`cf zero-trust devices registrations revoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/registrations/revoke`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),o=t.local?h:await a(r);if(t.accountId=o,!await i({force:!!t.force,message:`This operation revokes device registrations destructively.`})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>r.zeroTrust.devices.registrations.revoke({account_id:o,...n})),{successLabel:`Deleted`})}};function Ps(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to unrevoke.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fs={command:`unrevoke`,describe:`Unrevokes a list of WARP registrations.`,builder:Ps,handler:async t=>{let n={id:t.id};if(t.dryRun){d({command:`cf zero-trust devices registrations unrevoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/registrations/unrevoke`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Creating`,async()=>r.zeroTrust.devices.registrations.unrevoke({account_id:i,...n})),{successLabel:`Created`})}},Is={command:`registrations`,describe:`Operations for devices.registrations`,builder:e=>e.command(Ts).command(Ds).command(ks).command(js).command(Ns).command(Fs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ls(e){return e.option(`disconnect`,{type:`boolean`,description:`Disconnects all devices on the account using Global WARP override.`}).option(`justification`,{type:`string`,description:`Reasoning for setting the Global WARP override state. This will be surfaced in the audit log.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Rs={command:`create`,describe:`Sets the Global WARP override state.`,builder:Ls,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices resilience global-warp-override create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/resilience/disconnect`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({disconnect:t.disconnect,justification:p(t.justification,`justification`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.devices.resilience.globalWarpOverride.create({...e,account_id:r})),{successLabel:`Created`});return}if(t.disconnect===void 0)throw Error(`--disconnect is required (or pass --body with this field set).`);let i=l({disconnect:t.disconnect,justification:p(t.justification,`justification`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.devices.resilience.globalWarpOverride.create({...i,account_id:r})),{successLabel:`Created`})}};function zs(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bs={command:`get`,describe:`Fetch the Global WARP override state.`,builder:zs,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices resilience global-warp-override get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/resilience/disconnect`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.resilience.globalWarpOverride.get({account_id:r})),{successLabel:`Loaded`})}},Vs={command:`global-warp-override`,describe:`Operations for devices.resilience.global-warp-override`,builder:e=>e.command(Rs).command(Bs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Hs={command:`resilience`,describe:`Operations for devices.resilience`,builder:e=>e.command(Vs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Us(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`A list of Registration IDs to revoke.`})}const Ws={command:`create`,describe:`Revokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/revoke instead.`,builder:Us,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices revoke create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/revoke`,pathParams:{},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force,message:`This operation revokes sessions for a batch of devices destructively.`})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=c(t.body);u(await f(`Deleting`,async()=>n.zeroTrust.devices.revoke.create({body:e,account_id:r})),{successLabel:`Deleted`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Gs={command:`revoke`,describe:`Operations for devices.revoke`,builder:e=>e.command(Ws).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ks(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const qs={command:`delete`,describe:`Resets the current device settings for a Zero Trust account.`,builder:Ks,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices settings delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.settings.delete({account_id:r})),{successLabel:`Deleted`})}};function Js(e){return e.option(`disable-for-time`,{type:`number`,description:`Sets the time limit, in seconds, that a user can use an override code to bypass WARP.`}).option(`external-emergency-signal-enabled`,{type:`boolean`,description:`Controls whether the external emergency disconnect feature is enabled.`}).option(`external-emergency-signal-fingerprint`,{type:`string`,description:`The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.`}).option(`external-emergency-signal-interval`,{type:`string`,description:`The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.`}).option(`external-emergency-signal-url`,{type:`string`,description:`The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.`}).option(`gateway-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on TCP.`}).option(`gateway-udp-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on UDP.`}).option(`root-certificate-installation-enabled`,{type:`boolean`,description:`Enable installation of cloudflare managed root certificate.`}).option(`use-zt-virtual-ip`,{type:`boolean`,description:`Enable using CGNAT virtual IPv4.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ys={command:`edit`,describe:`Patches the current device settings for a Zero Trust account.`,builder:Js,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({disable_for_time:t[`disable-for-time`],external_emergency_signal_enabled:t[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:p(t[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:p(t[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:p(t[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:t[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:t[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:t[`root-certificate-installation-enabled`],use_zt_virtual_ip:t[`use-zt-virtual-ip`]}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.settings.edit({body:e,account_id:r})),{successLabel:`Updated`});return}let i=l({disable_for_time:t[`disable-for-time`],external_emergency_signal_enabled:t[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:p(t[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:p(t[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:p(t[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:t[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:t[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:t[`root-certificate-installation-enabled`],use_zt_virtual_ip:t[`use-zt-virtual-ip`]});u(await f(`Updating`,async()=>n.zeroTrust.devices.settings.edit({body:i,account_id:r})),{successLabel:`Updated`})}};function Xs(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zs={command:`get`,describe:`Describes the current device settings for a Zero Trust account.`,builder:Xs,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.devices.settings.get({account_id:r})),{successLabel:`Loaded`})}};function Qs(e){return e.option(`disable-for-time`,{type:`number`,description:`Sets the time limit, in seconds, that a user can use an override code to bypass WARP.`}).option(`external-emergency-signal-enabled`,{type:`boolean`,description:`Controls whether the external emergency disconnect feature is enabled.`}).option(`external-emergency-signal-fingerprint`,{type:`string`,description:`The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.`}).option(`external-emergency-signal-interval`,{type:`string`,description:`The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.`}).option(`external-emergency-signal-url`,{type:`string`,description:`The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.`}).option(`gateway-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on TCP.`}).option(`gateway-udp-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on UDP.`}).option(`root-certificate-installation-enabled`,{type:`boolean`,description:`Enable installation of cloudflare managed root certificate.`}).option(`use-zt-virtual-ip`,{type:`boolean`,description:`Enable using CGNAT virtual IPv4.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const $s={command:`update`,describe:`Updates the current device settings for a Zero Trust account.`,builder:Qs,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({disable_for_time:t[`disable-for-time`],external_emergency_signal_enabled:t[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:p(t[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:p(t[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:p(t[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:t[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:t[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:t[`root-certificate-installation-enabled`],use_zt_virtual_ip:t[`use-zt-virtual-ip`]}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.settings.update({body:e,account_id:r})),{successLabel:`Updated`});return}let i=l({disable_for_time:t[`disable-for-time`],external_emergency_signal_enabled:t[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:p(t[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:p(t[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:p(t[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:t[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:t[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:t[`root-certificate-installation-enabled`],use_zt_virtual_ip:t[`use-zt-virtual-ip`]});u(await f(`Updating`,async()=>n.zeroTrust.devices.settings.update({body:i,account_id:r})),{successLabel:`Updated`})}},ec={command:`settings`,describe:`Operations for devices.settings`,builder:e=>e.command(qs).command(Ys).command(Zs).command($s).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function tc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A list of Registration IDs to unrevoke.`})}const nc={command:`create`,describe:`Unrevokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/unrevoke instead.`,builder:tc,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust devices unrevoke create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/devices/unrevoke`,pathParams:{},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.devices.unrevoke.create({body:e,account_id:r})),{successLabel:`Created`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},rc={command:`unrevoke`,describe:`Operations for devices.unrevoke`,builder:e=>e.command(nc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ic={command:`devices`,describe:`Operations for devices`,builder:e=>e.command(va).command(ja).command(ia).command(ga).command(ka).command(Ha).command(qa).command(no).command(ts).command(Cs).command(Is).command(Hs).command(Gs).command(ec).command(rc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ac(e){return e.option(`from`,{type:`string`,description:`Start time for connection period in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for connection period in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`sort-by`,{type:`string`,description:`Type of usage that colos should be sorted by. If unspecified, returns all Cloudflare colos sorted alphabetically.`,choices:[`fleet-status-usage`,`application-tests-usage`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const oc={command:`list`,describe:`List Cloudflare colos that account's devices were connected to during a time period, sorted by usage starting from the most used colo. Colos without traffic are also returned and sorted alphabetically.`,builder:g(ac),handler:async t=>{let n={from:t.from,to:t.to,sortBy:t[`sort-by`]};if(t.dryRun){d({command:`cf zero-trust dex colos list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/colos`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.colos.list({account_id:i,...n})),{successLabel:`Loaded`})}},sc={command:`colos`,describe:`Operations for dex.colos`,builder:e=>e.command(oc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const lc={command:`create`,describe:`Initiate commands for up to 10 devices per account.`,builder:cc,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dex commands create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/commands`,pathParams:{},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.dex.commands.create({...e,account_id:r})),{successLabel:`Created`});return}u(await f(`Creating`,async()=>o(n,`POST`,`/accounts/${r}/dex/commands`)),{successLabel:`Created`})}};function uc(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`search`,{type:`string`,description:`Filter devices by name or email.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dc={command:`list`,describe:`List devices with WARP client support for remote captures which have been connected in the last 1 hour.`,builder:uc,handler:async t=>{let n={page:t.page,per_page:t[`per-page`],search:t.search};if(t.dryRun){d({command:`cf zero-trust dex commands eligible-devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/commands/devices`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.commands.eligibleDevices.list({account_id:i,...n})),{successLabel:`Loaded`})}},fc={command:`eligible-devices`,describe:`Operations for dex.commands.eligible-devices`,builder:e=>e.command(dc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pc(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`}).option(`device-id`,{type:`string`,description:`Unique identifier for a device.`}).option(`user-email`,{type:`string`,description:`Email tied to the device.`}).option(`command-type`,{type:`string`,description:`Optionally filter executed commands by command type.`,choices:[`pcap`,`speed-test`,`warp-diag`]}).option(`status`,{type:`string`,description:`Optionally filter executed commands by status.`,choices:[`PENDING_EXEC`,`PENDING_UPLOAD`,`SUCCESS`,`FAILED`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const mc={command:`list`,describe:`Retrieves a paginated list of commands issued to devices under the specified account, optionally filtered by time range, device, or other parameters`,builder:g(pc),handler:async t=>{let n={page:t.page,per_page:t[`per-page`],from:t.from,to:t.to,device_id:t[`device-id`],user_email:t[`user-email`],command_type:t[`command-type`],status:t.status};if(t.dryRun){d({command:`cf zero-trust dex commands list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/commands`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.commands.list({account_id:i,...n})),{successLabel:`Loaded`})}};function hc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gc={command:`get`,describe:`Retrieves the current quota usage and limits for device commands within a specific account, including the time when the quota will reset`,builder:hc,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dex commands quota get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/commands/quota`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.dex.commands.quota.get({account_id:r})),{successLabel:`Loaded`})}},_c={command:`quota`,describe:`Operations for dex.commands.quota`,builder:e=>e.command(gc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function vc(e){return e.positional(`filename`,{type:`string`,description:"The name of the file to be downloaded, including the `.zip` extension.",demandOption:!0}).option(`command-id`,{type:`string`,description:`Unique identifier for command.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`text`,{type:`boolean`,description:`Decode the response body as UTF-8 text instead of writing raw bytes`,default:!1})}const yc={command:`get <filename>`,describe:`Downloads artifacts for an executed command. Bulk downloads are not supported`,builder:vc,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dex commands results get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/commands/${t[`command-id`]==null?`<command-id>`:encodeURIComponent(String(t[`command-id`]))}/downloads/${t.filename==null?`<filename>`:encodeURIComponent(String(t.filename))}`,pathParams:{"command-id":String(t[`command-id`]??``),filename:String(t.filename??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r;let i=await f(`Loading`,async()=>te(`/accounts/${r}/dex/commands/${encodeURIComponent(String(t[`command-id`]))}/downloads/${encodeURIComponent(String(t.filename))}`,{method:`GET`,localEndpoint:t.local?t.localEndpoint:void 0}));ee(t.text===!0?i.toString(`utf-8`):i)}},bc={command:`results`,describe:`Operations for dex.commands.results`,builder:e=>e.command(yc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},xc={command:`commands`,describe:`Operations for dex.commands`,builder:e=>e.command(lc).command(mc).command(fc).command(_c).command(bc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Sc(e){return e.option(`since-minutes`,{type:`number`,description:`Number of minutes before current time.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cc={command:`get`,describe:`Get details for live (up to 60 minutes) devices using WARP.`,builder:Sc,handler:async t=>{let n={since_minutes:t[`since-minutes`]};if(t.dryRun){d({command:`cf zero-trust dex devices aggregates live get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/fleet-status/live`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.devices.aggregates.live.get({account_id:i,...n})),{successLabel:`Loaded`})}},wc={command:`live`,describe:`Operations for dex.devices.aggregates.live`,builder:e=>e.command(Cc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Tc(e){return e.option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Cloudflare colo airport code.`}).option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ec={command:`get`,describe:`Get aggregate details for devices using WARP, up to 7 days.`,builder:Tc,handler:async t=>{let n={to:t.to,from:t.from,colo:t.colo,device_id:t[`device-id`]};if(t.dryRun){d({command:`cf zero-trust dex devices aggregates over-time get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/fleet-status/over-time`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.devices.aggregates.overTime.get({account_id:i,...n})),{successLabel:`Loaded`})}},Dc={command:`over-time`,describe:`Operations for dex.devices.aggregates.over-time`,builder:e=>e.command(Ec).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Oc={command:`aggregates`,describe:`Operations for dex.devices.aggregates`,builder:e=>e.command(wc).command(Dc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function kc(e){return e.positional(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`since-minutes`,{type:`number`,description:`Number of minutes before current time.`,demandOption:!0}).option(`time-now`,{type:`string`,description:`Current time in ISO format.`}).option(`colo`,{type:`string`,description:`List of data centers to filter results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ac={command:`get <device-id>`,describe:`Get the latest status of a device given device_id from the device_state table.`,builder:kc,handler:async t=>{let n={since_minutes:t[`since-minutes`],time_now:t[`time-now`],colo:t.colo};if(t.dryRun){d({command:`cf zero-trust dex devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/devices/${t[`device-id`]==null?`<device-id>`:encodeURIComponent(String(t[`device-id`]))}/fleet-status/live`,pathParams:{"device-id":String(t[`device-id`]??``)},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.devices.get({account_id:i,device_id:t[`device-id`],...n})),{successLabel:`Loaded`})}};function jc(e){return e.option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`sort-by`,{type:`string`,description:`Dimension to sort results by.`,choices:[`colo`,`device_id`,`mode`,`platform`,`status`,`timestamp`,`version`]}).option(`colo`,{type:`string`,description:`Cloudflare colo airport code.`}).option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`}).option(`mode`,{type:`string`,description:`The mode under which the WARP client is run.`}).option(`status`,{type:`string`,description:`Network status.`}).option(`platform`,{type:`string`,description:`Operating system.`}).option(`version`,{type:`string`,description:`WARP client version.`}).option(`source`,{type:`string`,description:"Source:\n  * `hourly` - device details aggregated hourly, up to 7 days prior\n  * `last_seen` - device details, up to 60 minutes prior. Time windows exceeding 60 minutes will be rejected from June 1st, 2026. Please use 'hourly' or 'raw' instead for longer time ranges.\n  * `raw` - device details, up to 7 days prior",choices:[`last_seen`,`hourly`,`raw`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Mc={command:`list`,describe:`List details of devices using WARP.`,builder:g(jc),handler:async t=>{let n={to:t.to,from:t.from,page:t.page,per_page:t[`per-page`],sort_by:t[`sort-by`],colo:t.colo,device_id:t[`device-id`],mode:t.mode,status:t.status,platform:t.platform,version:t.version,source:t.source};if(t.dryRun){d({command:`cf zero-trust dex devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/fleet-status/devices`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.devices.list({account_id:i,...n})),{successLabel:`Loaded`})}};function Nc(e){return e.positional(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`List of data centers to filter results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pc={command:`get <device-id>`,describe:`Get time-bucketed status metrics for a specific device.`,builder:g(Nc),handler:async t=>{let n={from:t.from,to:t.to,interval:t.interval,colo:t.colo};if(t.dryRun){d({command:`cf zero-trust dex devices over-time get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/devices/${t[`device-id`]==null?`<device-id>`:encodeURIComponent(String(t[`device-id`]))}/fleet-status/over-time`,pathParams:{"device-id":String(t[`device-id`]??``)},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.devices.overTime.get({account_id:i,device_id:t[`device-id`],...n})),{successLabel:`Loaded`})}},Fc={command:`over-time`,describe:`Operations for dex.devices.over-time`,builder:e=>e.command(Pc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ic={command:`devices`,describe:`Operations for dex.devices`,builder:e=>e.command(Ac).command(Mc).command(Oc).command(Fc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Lc(e){return e.option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of paginated results. Mutually exclusive with cursor.`}).option(`per-page`,{type:`number`,description:`Number of items per page`,demandOption:!0}).option(`cursor`,{type:`string`,description:`Cursor for cursor-based pagination. Mutually exclusive with page.`}).option(`sort-by`,{type:`string`,description:`The field to sort results by.`,choices:[`time_start`]}).option(`sort-order`,{type:`string`,description:`The order to sort results.`,choices:[`ASC`,`DESC`]}).option(`from`,{type:`string`,description:`Start time for the query in ISO 8601 format.`}).option(`to`,{type:`string`,description:`End time for the query in ISO 8601 format.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Rc={command:`list`,describe:`List ISP information observed for a specific device during traceroute tests.`,builder:g(Lc),handler:async t=>{let n={page:t.page,per_page:t[`per-page`],cursor:t.cursor,sort_by:t[`sort-by`],sort_order:t[`sort-order`],from:t.from,to:t.to};if(t.dryRun){d({command:`cf zero-trust dex isps list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/devices/${t[`device-id`]==null?`<device-id>`:encodeURIComponent(String(t[`device-id`]))}/isps`,pathParams:{"device-id":String(t[`device-id`]??``)},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.isps.list({account_id:i,device_id:t[`device-id`],...n})),{successLabel:`Loaded`})}},zc={command:`isps`,describe:`Operations for dex.isps`,builder:e=>e.command(Rc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bc(e){return e.option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`test-name`,{type:`string`,description:`Optionally filter results by test name.`}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`registration-id`,{type:`string`,description:`Optionally filter results to a specific device registration. Must be used in combination with a single deviceId.`}).option(`page`,{type:`number`,description:`Page number of paginated results`}).option(`per-page`,{type:`number`,description:`Number of items per page`}).option(`kind`,{type:`string`,description:`Filter by test type.`,choices:[`http`,`traceroute`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vc={command:`list`,describe:`List DEX tests with overview metrics.`,builder:g(Bc),handler:async t=>{let n={colo:t.colo,testName:t[`test-name`],deviceId:t[`device-id`],registration_id:t[`registration-id`],page:t.page,per_page:t[`per-page`],kind:t.kind};if(t.dryRun){d({command:`cf zero-trust dex overview tests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/tests/overview`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.overview.tests.list({account_id:i,...n})),{successLabel:`Loaded`})}};function Hc(e){return e.option(`test-name`,{type:`string`,description:`Optionally filter results by test name.`}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Uc={command:`get`,describe:`Returns unique count of devices that have run synthetic application monitoring tests in the past 7 days.`,builder:Hc,handler:async t=>{let n={testName:t[`test-name`],deviceId:t[`device-id`]};if(t.dryRun){d({command:`cf zero-trust dex overview tests unique-devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/tests/unique-devices`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.overview.tests.uniqueDevices.get({account_id:i,...n})),{successLabel:`Loaded`})}},Wc={command:`unique-devices`,describe:`Operations for dex.overview.tests.unique-devices`,builder:e=>e.command(Uc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Gc={command:`tests`,describe:`Operations for dex.overview.tests`,builder:e=>e.command(Vc).command(Wc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Kc={command:`overview`,describe:`Operations for dex.overview`,builder:e=>e.command(Gc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function qc(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`match`,{type:`string`,description:`The wirefilter expression to match.`}).option(`name`,{type:`string`,description:`The name of the Rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Jc={command:`create`,describe:`Create a DEX Rule.`,builder:qc,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dex rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/rules`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({description:p(n.description,`description`,`text`),match:p(n.match,`match`,`text`),name:p(n.name,`name`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.dex.rules.create({...e,account_id:i})),{successLabel:`Created`});return}n.match===void 0&&(n.match=await t(`match`,`The wirefilter expression to match.`)),n.name===void 0&&(n.name=await t(`name`,`The name of the Rule.`));let o=l({description:p(n.description,`description`,`text`),match:p(n.match,`match`,`text`),name:p(n.name,`name`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.dex.rules.create({...o,account_id:i})),{successLabel:`Created`})}};function Yc(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Xc={command:`delete <rule-id>`,describe:`Delete a DEX Rule.`,builder:Yc,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dex rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/rules/${t[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(t[`rule-id`]))}`,pathParams:{"rule-id":String(t[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dex.rules.delete({account_id:r,rule_id:t[`rule-id`]})),{successLabel:`Deleted`})}};function Zc(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qc={command:`get <rule-id>`,describe:`Get details for a DEX Rule.`,builder:Zc,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dex rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/rules/${t[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(t[`rule-id`]))}`,pathParams:{"rule-id":String(t[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.dex.rules.get({account_id:r,rule_id:t[`rule-id`]})),{successLabel:`Loaded`})}};function $c(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`sort-order`,{type:`string`,description:`Sort direction for sort_by property.`,choices:[`ASC`,`DESC`]}).option(`sort-by`,{type:`string`,description:`Which property to sort results by.`,choices:[`name`,`created_at`,`updated_at`]}).option(`name`,{type:`string`,description:`Filter results by rule name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const el={command:`list`,describe:`List DEX Rules.`,builder:g($c),handler:async t=>{let n={page:t.page,per_page:t[`per-page`],sort_order:t[`sort-order`],sort_by:t[`sort-by`],name:t.name};if(t.dryRun){d({command:`cf zero-trust dex rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/rules`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.rules.list({account_id:i,...n})),{successLabel:`Loaded`})}};function tl(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`match`,{type:`string`,description:`The wirefilter expression to match.`}).option(`name`,{type:`string`,description:`The name of the Rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const nl={command:`update <rule-id>`,describe:`Update a DEX Rule.`,builder:tl,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dex rules update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/rules/${t[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(t[`rule-id`]))}`,pathParams:{"rule-id":String(t[`rule-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({description:p(t.description,`description`,`text`),match:p(t.match,`match`,`text`),name:p(t.name,`name`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.dex.rules.update({...e,account_id:r,rule_id:t[`rule-id`]})),{successLabel:`Updated`});return}let i=l({description:p(t.description,`description`,`text`),match:p(t.match,`match`,`text`),name:p(t.name,`name`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.dex.rules.update({...i,account_id:r,rule_id:t[`rule-id`]})),{successLabel:`Updated`})}},rl={command:`rules`,describe:`Operations for dex.rules`,builder:e=>e.command(Jc).command(Xc).command(Qc).command(el).command(nl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function il(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const al={command:`get <test-id>`,describe:`Get test details and aggregate performance metrics for an http test for a given time period between 1 hour and 7 days.`,builder:g(il),handler:async t=>{let n={deviceId:t[`device-id`],from:t.from,to:t.to,interval:t.interval,colo:t.colo};if(t.dryRun){d({command:`cf zero-trust dex test-results http get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/http-tests/${t[`test-id`]==null?`<test-id>`:encodeURIComponent(String(t[`test-id`]))}`,pathParams:{"test-id":String(t[`test-id`]??``)},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.testResults.http.get({account_id:i,test_id:t[`test-id`],...n})),{successLabel:`Loaded`})}};function ol(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sl={command:`get <test-id>`,describe:`Get percentiles for an http test for a given time period between 1 hour and 7 days.`,builder:ol,handler:async t=>{let n={deviceId:t[`device-id`],from:t.from,to:t.to,colo:t.colo};if(t.dryRun){d({command:`cf zero-trust dex test-results http percentiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/http-tests/${t[`test-id`]==null?`<test-id>`:encodeURIComponent(String(t[`test-id`]))}/percentiles`,pathParams:{"test-id":String(t[`test-id`]??``)},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.testResults.http.percentiles.get({account_id:i,test_id:t[`test-id`],...n})),{successLabel:`Loaded`})}},cl={command:`percentiles`,describe:`Operations for dex.test-results.http.percentiles`,builder:e=>e.command(sl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ll={command:`http`,describe:`Operations for dex.test-results.http`,builder:e=>e.command(al).command(cl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ul(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dl={command:`get <test-id>`,describe:`Get test details and aggregate performance metrics for a traceroute test for a given time period between 1 hour and 7 days.`,builder:g(ul),handler:async t=>{let n={deviceId:t[`device-id`],from:t.from,to:t.to,interval:t.interval,colo:t.colo};if(t.dryRun){d({command:`cf zero-trust dex test-results traceroute get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/traceroute-tests/${t[`test-id`]==null?`<test-id>`:encodeURIComponent(String(t[`test-id`]))}`,pathParams:{"test-id":String(t[`test-id`]??``)},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.testResults.traceroute.get({account_id:i,test_id:t[`test-id`],...n})),{successLabel:`Loaded`})}};function fl(e){return e.positional(`test-result-id`,{type:`string`,description:`Unique identifier for a specific traceroute test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pl={command:`get <test-result-id>`,describe:`Get a breakdown of hops and performance metrics for a specific traceroute test run`,builder:fl,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dex test-results traceroute network-path get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/traceroute-test-results/${t[`test-result-id`]==null?`<test-result-id>`:encodeURIComponent(String(t[`test-result-id`]))}/network-path`,pathParams:{"test-result-id":String(t[`test-result-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.dex.testResults.traceroute.networkPath.get({account_id:r,test_result_id:t[`test-result-id`]})),{successLabel:`Loaded`})}},ml={command:`network-path`,describe:`Operations for dex.test-results.traceroute.network-path`,builder:e=>e.command(pl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function hl(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gl={command:`get <test-id>`,describe:`Get percentiles for a traceroute test for a given time period between 1 hour and 7 days.`,builder:hl,handler:async t=>{let n={deviceId:t[`device-id`],from:t.from,to:t.to,colo:t.colo};if(t.dryRun){d({command:`cf zero-trust dex test-results traceroute percentiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/traceroute-tests/${t[`test-id`]==null?`<test-id>`:encodeURIComponent(String(t[`test-id`]))}/percentiles`,pathParams:{"test-id":String(t[`test-id`]??``)},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.testResults.traceroute.percentiles.get({account_id:i,test_id:t[`test-id`],...n})),{successLabel:`Loaded`})}},_l={command:`percentiles`,describe:`Operations for dex.test-results.traceroute.percentiles`,builder:e=>e.command(gl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},vl={command:`traceroute`,describe:`Operations for dex.test-results.traceroute`,builder:e=>e.command(dl).command(ml).command(_l).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},yl={command:`test-results`,describe:`Operations for dex.test-results`,builder:e=>e.command(ll).command(vl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bl(e){return e.option(`data-host`,{type:`string`,description:`The desired endpoint to test.`}).option(`data-kind`,{type:`string`,description:`The type of test.`,choices:[`http`,`traceroute`]}).option(`data-method`,{type:`string`,description:`The HTTP request method type.`,choices:[`GET`]}).option(`description`,{type:`string`,description:`Additional details about the test.`}).option(`enabled`,{type:`boolean`,description:`Determines whether or not the test is active.`}).option(`interval`,{type:`string`,description:`How often the test will run.`}).option(`name`,{type:`string`,description:`The name of the DEX test. Must be unique.`}).option(`targeted`,{type:`boolean`,description:`The targeted field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xl={command:`create`,describe:`Create a DEX test.`,builder:bl,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust dex tests create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/devices/dex_tests`,pathParams:{},bodyKind:`json`,body:r.body===void 0?l({data:{host:p(r[`data-host`],`data-host`,`text`),kind:p(r[`data-kind`],`data-kind`,`text`),method:p(r[`data-method`],`data-method`,`text`)},description:p(r.description,`description`,`text`),enabled:r.enabled,interval:p(r.interval,`interval`,`text`),name:p(r.name,`name`,`text`),targeted:r.targeted}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Creating`,async()=>i.zeroTrust.dex.tests.create({body:e,account_id:o})),{successLabel:`Created`});return}if(r[`data-host`]===void 0&&(r[`data-host`]=await t(`data-host`,`The desired endpoint to test.`)),r[`data-kind`]===void 0&&(r[`data-kind`]=await n(`data-kind`,`The type of test.`,[`http`,`traceroute`])),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.interval===void 0&&(r.interval=await t(`interval`,`How often the test will run.`)),r.name===void 0&&(r.name=await t(`name`,`The name of the DEX test. Must be unique.`));let m=l({data:{host:p(r[`data-host`],`data-host`,`text`),kind:p(r[`data-kind`],`data-kind`,`text`),method:p(r[`data-method`],`data-method`,`text`)},description:p(r.description,`description`,`text`),enabled:r.enabled,interval:p(r.interval,`interval`,`text`),name:p(r.name,`name`,`text`),targeted:r.targeted});u(await f(`Creating`,async()=>i.zeroTrust.dex.tests.create({body:m,account_id:o})),{successLabel:`Created`})}};function Sl(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Cl={command:`delete <dex-test-id>`,describe:`Delete a Device DEX test. Returns the remaining device dex tests for the account.`,builder:Sl,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dex tests delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/devices/dex_tests/${t[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(t[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(t[`dex-test-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dex.tests.delete({account_id:r,dex_test_id:t[`dex-test-id`]})),{successLabel:`Deleted`})}};function wl(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Tl={command:`get <dex-test-id>`,describe:`Fetch a single DEX test.`,builder:wl,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dex tests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/devices/dex_tests/${t[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(t[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(t[`dex-test-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.dex.tests.get({account_id:r,dex_test_id:t[`dex-test-id`]})),{successLabel:`Loaded`})}};function El(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`test-name`,{type:`string`,description:`Filter by test name.`}).option(`kind`,{type:`string`,description:`Filter by test type.`,choices:[`http`,`traceroute`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dl={command:`list`,describe:`Fetch all DEX tests.`,builder:g(El),handler:async t=>{let n={page:t.page,per_page:t[`per-page`],testName:t[`test-name`],kind:t.kind};if(t.dryRun){d({command:`cf zero-trust dex tests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/devices/dex_tests`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.tests.list({account_id:i,...n})),{successLabel:`Loaded`})}};function Ol(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Device to filter traceroute result runs to.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const kl={command:`get <test-id>`,describe:`Get a breakdown of metrics by hop for individual traceroute test runs.`,builder:g(Ol),handler:async t=>{let n={deviceId:t[`device-id`],from:t.from,to:t.to,interval:t.interval};if(t.dryRun){d({command:`cf zero-trust dex tests network-path get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/traceroute-tests/${t[`test-id`]==null?`<test-id>`:encodeURIComponent(String(t[`test-id`]))}/network-path`,pathParams:{"test-id":String(t[`test-id`]??``)},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.tests.networkPath.get({account_id:i,test_id:t[`test-id`],...n})),{successLabel:`Loaded`})}},Al={command:`network-path`,describe:`Operations for dex.tests.network-path`,builder:e=>e.command(kl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function jl(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`data-host`,{type:`string`,description:`The desired endpoint to test.`}).option(`data-kind`,{type:`string`,description:`The type of test.`,choices:[`http`,`traceroute`]}).option(`data-method`,{type:`string`,description:`The HTTP request method type.`,choices:[`GET`]}).option(`description`,{type:`string`,description:`Additional details about the test.`}).option(`enabled`,{type:`boolean`,description:`Determines whether or not the test is active.`}).option(`interval`,{type:`string`,description:`How often the test will run.`}).option(`name`,{type:`string`,description:`The name of the DEX test. Must be unique.`}).option(`targeted`,{type:`boolean`,description:`The targeted field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ml={command:`update <dex-test-id>`,describe:`Update a DEX test.`,builder:jl,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust dex tests update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/devices/dex_tests/${r[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(r[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(r[`dex-test-id`]??``)},bodyKind:`json`,body:r.body===void 0?l({data:{host:p(r[`data-host`],`data-host`,`text`),kind:p(r[`data-kind`],`data-kind`,`text`),method:p(r[`data-method`],`data-method`,`text`)},description:p(r.description,`description`,`text`),enabled:r.enabled,interval:p(r.interval,`interval`,`text`),name:p(r.name,`name`,`text`),targeted:r.targeted}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Updating`,async()=>i.zeroTrust.dex.tests.update({body:e,account_id:o,dex_test_id:r[`dex-test-id`]})),{successLabel:`Updated`});return}if(r[`data-host`]===void 0&&(r[`data-host`]=await t(`data-host`,`The desired endpoint to test.`)),r[`data-kind`]===void 0&&(r[`data-kind`]=await n(`data-kind`,`The type of test.`,[`http`,`traceroute`])),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.interval===void 0&&(r.interval=await t(`interval`,`How often the test will run.`)),r.name===void 0&&(r.name=await t(`name`,`The name of the DEX test. Must be unique.`));let m=l({data:{host:p(r[`data-host`],`data-host`,`text`),kind:p(r[`data-kind`],`data-kind`,`text`),method:p(r[`data-method`],`data-method`,`text`)},description:p(r.description,`description`,`text`),enabled:r.enabled,interval:p(r.interval,`interval`,`text`),name:p(r.name,`name`,`text`),targeted:r.targeted});u(await f(`Updating`,async()=>i.zeroTrust.dex.tests.update({body:m,account_id:o,dex_test_id:r[`dex-test-id`]})),{successLabel:`Updated`})}},Nl={command:`tests`,describe:`Operations for dex.tests`,builder:e=>e.command(xl).command(Cl).command(Tl).command(Dl).command(Ml).command(Al).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Pl(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`type`,{type:`string`,description:`Filter events by type 'config' or 'toggle'.`,choices:[`config`,`toggle`]}).option(`toggle`,{type:`string`,description:`Filter events by type toggle value. Applicable to type='toggle' events only.`,choices:[`on`,`off`]}).option(`config-name`,{type:`string`,description:`Filter events by WARP configuration name changed from or to. Applicable to type='config' events only.`}).option(`account-name`,{type:`string`,description:`Filter events by account name.`}).option(`sort-order`,{type:`string`,description:`Sort response by event timestamp.`,choices:[`ASC`,`DESC`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fl={command:`list`,describe:`List WARP configuration and enablement toggle change events by device.`,builder:g(Pl),handler:async t=>{let n={page:t.page,per_page:t[`per-page`],from:t.from,to:t.to,type:t.type,toggle:t.toggle,config_name:t[`config-name`],account_name:t[`account-name`],sort_order:t[`sort-order`]};if(t.dryRun){d({command:`cf zero-trust dex warp-change-events list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dex/warp-change-events`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dex.warpChangeEvents.list({account_id:i,...n})),{successLabel:`Loaded`})}},Il={command:`warp-change-events`,describe:`Operations for dex.warp-change-events`,builder:e=>e.command(Fl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ll={command:`dex`,describe:`Operations for dex`,builder:e=>e.command(sc).command(xc).command(Ic).command(zc).command(Kc).command(rl).command(yl).command(Nl).command(Il).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Rl(e){return e.option(`case-sensitive`,{type:`boolean`,description:`Only applies to custom word lists.
+alphanumeric character.`}).option(`ip-ipv4-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv4-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`ip-ipv6-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv6-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const an={command:`update <target-id>`,describe:`Update target`,builder:rn,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access infrastructure targets update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/infrastructure/targets/${n[`target-id`]==null?`<target-id>`:encodeURIComponent(String(n[`target-id`]))}`,pathParams:{"target-id":String(n[`target-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({hostname:p(n.hostname,`hostname`,`text`),ip:{ipv4:{ip_addr:p(n[`ip-ipv4-ip-addr`],`ip-ipv4-ip-addr`,`text`),virtual_network_id:p(n[`ip-ipv4-virtual-network-id`],`ip-ipv4-virtual-network-id`,`text`)},ipv6:{ip_addr:p(n[`ip-ipv6-ip-addr`],`ip-ipv6-ip-addr`,`text`),virtual_network_id:p(n[`ip-ipv6-virtual-network-id`],`ip-ipv6-virtual-network-id`,`text`)}}}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Updating`,async()=>i.zeroTrust.access.infrastructure.targets.update({...e,account_id:a,target_id:n[`target-id`]})),{successLabel:`Updated`});return}n.hostname===void 0&&(n.hostname=await e(`hostname`,`A non-unique field that refers to a target. Case insensitive, maximum length of 255 characters, supports the use of special characters dash and period, does not support spaces, and must start and end with an alphanumeric character.`));let o=l({hostname:p(n.hostname,`hostname`,`text`),ip:{ipv4:{ip_addr:p(n[`ip-ipv4-ip-addr`],`ip-ipv4-ip-addr`,`text`),virtual_network_id:p(n[`ip-ipv4-virtual-network-id`],`ip-ipv4-virtual-network-id`,`text`)},ipv6:{ip_addr:p(n[`ip-ipv6-ip-addr`],`ip-ipv6-ip-addr`,`text`),virtual_network_id:p(n[`ip-ipv6-virtual-network-id`],`ip-ipv6-virtual-network-id`,`text`)}}});u(await f(`Updating`,async()=>i.zeroTrust.access.infrastructure.targets.update({...o,account_id:a,target_id:n[`target-id`]})),{successLabel:`Updated`})}},on={command:`targets`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Kt).command(Wt).command(Jt).command(Xt).command(Qt).command(en).command(nn).command(an).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},sn={command:`infrastructure`,describe:`Operations for access.infrastructure`,builder:e=>e.command(on).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cn(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ln={command:`get`,describe:`Gets the Access key rotation settings for an account.`,builder:cn,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access keys get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/keys`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.keys.get({account_id:i})),{successLabel:`Loaded`})}};function un(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dn={command:`rotate`,describe:`Perfoms a key rotation for an account.`,builder:un,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access keys rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/keys/rotate`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Creating`,async()=>n.zeroTrust.access.keys.rotate({account_id:i})),{successLabel:`Created`})}};function fn(e){return e.option(`key-rotation-interval-days`,{type:`number`,description:`The number of days between key rotations.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pn={command:`update`,describe:`Updates the Access key rotation settings for an account.`,builder:fn,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access keys update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/keys`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({key_rotation_interval_days:e[`key-rotation-interval-days`]}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.access.keys.update({...t,account_id:i})),{successLabel:`Updated`});return}if(e[`key-rotation-interval-days`]===void 0)throw Error(`--key-rotation-interval-days is required (or pass --body with this field set).`);let a=l({key_rotation_interval_days:e[`key-rotation-interval-days`]});u(await f(`Updating`,async()=>n.zeroTrust.access.keys.update({...a,account_id:i})),{successLabel:`Updated`})}},mn={command:`keys`,describe:`Operations for access.keys`,builder:e=>e.command(ln).command(dn).command(pn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function hn(e){return e.option(`limit`,{type:`number`,description:`The maximum number of log entries to retrieve.`}).option(`direction`,{type:`string`,description:`The chronological sorting order for the logs.`,choices:[`desc`,`asc`]}).option(`since`,{type:`string`,description:`The earliest event timestamp to query.`}).option(`until`,{type:`string`,description:`The latest event timestamp to query.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`email`,{type:`string`,description:"Filter by user email. Match mode is controlled by `emailOp` (preferred) or the legacy `email_exact` flag.\n- Default (no `emailOp`, `email_exact=false` or unset): substring match — `email=@example.com` returns all events with that domain.\n- Exact match: set `emailOp=eq` (preferred) or `email_exact=true` — e.g. `email=user@example.com&email_exact=true` returns only that user.\n- Explicit substring match: set `emailOp=contains` (without `email_exact=true`). When both are set, `email_exact=true` takes precedence and the match is exact.\n- Exclusion: set `emailOp=neq`. With `email_exact=true` this is an exact-value exclusion; without it, a fuzzy substring exclusion."}).option(`email-exact`,{type:`boolean`,description:"When true, `email` is matched exactly instead of substring matching."}).option(`user-id`,{type:`string`,description:"Deprecated. Accepted for backward compatibility but no longer applied\nas a filter. Use `email` instead."}).option(`allowed-op`,{type:`string`,description:"Operator for the `allowed` filter.",choices:[`eq`,`neq`]}).option(`country-code-op`,{type:`string`,description:"Operator for the `country_code` filter.",choices:[`eq`,`neq`]}).option(`app-type-op`,{type:`string`,description:"Operator for the `app_type` filter.",choices:[`eq`,`neq`]}).option(`app-uid-op`,{type:`string`,description:"Operator for the `app_uid` filter.",choices:[`eq`,`neq`]}).option(`ray-id-op`,{type:`string`,description:"Operator for the `ray_id` filter.",choices:[`eq`,`neq`]}).option(`email-op`,{type:`string`,description:"Operator for the `email` filter.\n`contains` performs a substring (case-sensitive) match. When `email_exact=true`\nis also set, `email_exact` takes precedence and `contains` is ignored.",choices:[`eq`,`neq`,`contains`]}).option(`idp-op`,{type:`string`,description:"Operator for the `idp` filter.",choices:[`eq`,`neq`]}).option(`non-identity-op`,{type:`string`,description:"Operator for the `non_identity` filter.",choices:[`eq`,`neq`]}).option(`user-id-op`,{type:`string`,description:"Deprecated. Accepted for backward compatibility but no longer applied\nas a filter (the `user_id` parameter is itself deprecated).",choices:[`eq`,`neq`]}).option(`fields`,{type:`string`,description:`Comma-separated list of fields to include in the response.
+When omitted, all fields are returned.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gn={command:`list`,describe:`Gets a list of Access authentication audit logs for an account.`,builder:g(hn),handler:async e=>{let n={limit:e.limit,direction:e.direction,since:e.since,until:e.until,page:e.page,per_page:e[`per-page`],email:e.email,email_exact:e[`email-exact`],user_id:e[`user-id`],allowedOp:e[`allowed-op`],country_codeOp:e[`country-code-op`],app_typeOp:e[`app-type-op`],app_uidOp:e[`app-uid-op`],ray_idOp:e[`ray-id-op`],emailOp:e[`email-op`],idpOp:e[`idp-op`],non_identityOp:e[`non-identity-op`],user_idOp:e[`user-id-op`],fields:e.fields};if(e.dryRun){d({command:`cf zero-trust access logs access-requests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/logs/access_requests`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.access.logs.accessRequests.list({account_id:a,...n})),{successLabel:`Loaded`})}},_n={command:`access-requests`,describe:`Operations for access.logs.access-requests`,builder:e=>e.command(gn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function vn(e){return e.option(`limit`,{type:`number`,description:`The maximum number of update logs to retrieve.`}).option(`direction`,{type:`string`,description:`The chronological order used to sort the logs.`,choices:[`desc`,`asc`]}).option(`since`,{type:`string`,description:`the timestamp of the earliest update log.`}).option(`until`,{type:`string`,description:`the timestamp of the most-recent update log.`}).option(`idp-id`,{type:`string`,description:`The unique Id of the IdP that has SCIM enabled.`,demandOption:!0}).option(`status`,{type:`string`,description:`The status of the SCIM request.`}).option(`resource-type`,{type:`string`,description:`The resource type of the SCIM request.`}).option(`request-method`,{type:`string`,description:`The request method of the SCIM request.`}).option(`resource-user-email`,{type:`string`,description:"The email address of the SCIM User resource. Pass once for a single\nlookup (`?resource_user_email=A`) or repeat the parameter\n(`?resource_user_email=A&resource_user_email=B`) to filter by multiple\nemails in one request."}).option(`resource-group-name`,{type:`string`,description:"The display name of the SCIM Group resource. Pass once for a single\nlookup (`?resource_group_name=A`) or repeat the parameter\n(`?resource_group_name=A&resource_group_name=B`) to filter by multiple\ngroup names in one request."}).option(`cf-resource-id`,{type:`string`,description:"The unique Cloudflare-generated Id of the SCIM resource. Pass once for\na single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to filter by multiple resources\nin one request."}).option(`idp-resource-id`,{type:`string`,description:"The IdP-generated Id of the SCIM resource. Pass once for a single\nlookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to filter by multiple\nresources in one request."}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yn={command:`list`,describe:`Lists Access SCIM update logs that maintain a record of updates made to User and Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:g(vn),handler:async e=>{let n={limit:e.limit,direction:e.direction,since:e.since,until:e.until,idp_id:e[`idp-id`],status:e.status,resource_type:e[`resource-type`],request_method:e[`request-method`],resource_user_email:e[`resource-user-email`],resource_group_name:e[`resource-group-name`],cf_resource_id:e[`cf-resource-id`],idp_resource_id:e[`idp-resource-id`],page:e.page,per_page:e[`per-page`]};if(e.dryRun){d({command:`cf zero-trust access logs scim updates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/logs/scim/updates`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.access.logs.scim.updates.list({account_id:a,...n})),{successLabel:`Loaded`})}},bn={command:`updates`,describe:`Operations for access.logs.scim.updates`,builder:e=>e.command(yn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},xn={command:`scim`,describe:`Operations for access.logs.scim`,builder:e=>e.command(bn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Sn={command:`logs`,describe:`Operations for access.logs`,builder:e=>e.command(_n).command(xn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Cn(e){return e.option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const wn={command:`create`,describe:`Creates a new Access reusable policy.`,builder:Cn,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust access policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/policies`,pathParams:{},bodyKind:`json`,body:i.body===void 0?l({decision:p(i.decision,`decision`,`text`),name:p(i.name,`name`,`text`)}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Creating`,async()=>a.zeroTrust.access.policies.create({body:e,account_id:o})),{successLabel:`Created`});return}i.decision===void 0&&(i.decision=await n(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),i.name===void 0&&(i.name=await e(`name`,`The name of the Access policy.`));let m=l({decision:p(i.decision,`decision`,`text`),name:p(i.name,`name`,`text`)});u(await f(`Creating`,async()=>a.zeroTrust.access.policies.create({body:m,account_id:o})),{successLabel:`Created`})}};function Tn(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const En={command:`delete <policy-id>`,describe:`Deletes an Access reusable policy.`,builder:Tn,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.policies.delete({account_id:a,policy_id:e[`policy-id`]})),{successLabel:`Deleted`})}};function Dn(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const On={command:`get <policy-id>`,describe:`Fetches a single Access reusable policy.`,builder:Dn,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.policies.get({account_id:i,policy_id:e[`policy-id`]})),{successLabel:`Loaded`})}};function kn(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const An={command:`list`,describe:`Lists Access reusable policies.`,builder:kn,handler:async e=>{let n={page:e.page,per_page:e[`per-page`]};if(e.dryRun){d({command:`cf zero-trust access policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/policies`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.access.policies.list({account_id:a,...n})),{successLabel:`Loaded`})}};function jn(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Mn={command:`update <policy-id>`,describe:`Updates a Access reusable policy.`,builder:jn,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust access policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/policies/${i[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(i[`policy-id`]))}`,pathParams:{"policy-id":String(i[`policy-id`]??``)},bodyKind:`json`,body:i.body===void 0?l({decision:p(i.decision,`decision`,`text`),name:p(i.name,`name`,`text`)}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Updating`,async()=>a.zeroTrust.access.policies.update({body:e,account_id:o,policy_id:i[`policy-id`]})),{successLabel:`Updated`});return}i.decision===void 0&&(i.decision=await n(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),i.name===void 0&&(i.name=await e(`name`,`The name of the Access policy.`));let m=l({decision:p(i.decision,`decision`,`text`),name:p(i.name,`name`,`text`)});u(await f(`Updating`,async()=>a.zeroTrust.access.policies.update({body:m,account_id:o,policy_id:i[`policy-id`]})),{successLabel:`Updated`})}},Nn={command:`policies`,describe:`Operations for access.policies`,builder:e=>e.command(wn).command(En).command(On).command(An).command(Mn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Pn(e){return e.option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.",default:1}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).",default:`8760h`}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Fn={command:`create`,describe:`Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token.`,builder:Pn,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access service-tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/service_tokens`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({client_secret_version:n[`client-secret-version`],duration:p(n.duration,`duration`,`text`),name:p(n.name,`name`,`text`),previous_client_secret_expires_at:p(n[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.access.serviceTokens.create({...e,account_id:a})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await e(`name`,`The name of the service token.`));let o=l({client_secret_version:n[`client-secret-version`],duration:p(n.duration,`duration`,`text`),name:p(n.name,`name`,`text`),previous_client_secret_expires_at:p(n[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.access.serviceTokens.create({...o,account_id:a})),{successLabel:`Created`})}};function In(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ln={command:`delete <service-token-id>`,describe:`Deletes a service token.`,builder:In,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access service-tokens delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.serviceTokens.delete({account_id:a,service_token_id:e[`service-token-id`]})),{successLabel:`Deleted`})}};function Rn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zn={command:`get <service-token-id>`,describe:`Fetches a single service token.`,builder:Rn,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access service-tokens get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.serviceTokens.get({account_id:i,service_token_id:e[`service-token-id`]})),{successLabel:`Loaded`})}};function Bn(e){return e.option(`name`,{type:`string`,description:`The name of the service token.`}).option(`search`,{type:`string`,description:`Search for service tokens by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vn={command:`list`,describe:`Lists all service tokens.`,builder:Bn,handler:async e=>{let n={name:e.name,search:e.search,page:e.page,per_page:e[`per-page`]};if(e.dryRun){d({command:`cf zero-trust access service-tokens list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/service_tokens`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.access.serviceTokens.list({account_id:a,...n})),{successLabel:`Loaded`})}};function Hn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Un={command:`refresh <service-token-id>`,describe:`Refreshes the expiration of a service token.`,builder:Hn,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access service-tokens refresh`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}/refresh`,pathParams:{"service-token-id":String(e[`service-token-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Creating`,async()=>n.zeroTrust.access.serviceTokens.refresh({account_id:i,service_token_id:e[`service-token-id`]})),{successLabel:`Created`})}};function Wn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. If not provided, it defaults to the current timestamp in order to immediately expire the previous secret."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Gn={command:`rotate <service-token-id>`,describe:`Generates a new Client Secret for a service token and revokes the old one.`,builder:Wn,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access service-tokens rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}/rotate`,pathParams:{"service-token-id":String(e[`service-token-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({previous_client_secret_expires_at:p(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.access.serviceTokens.rotate({...t,account_id:i,service_token_id:e[`service-token-id`]})),{successLabel:`Created`});return}let a=l({previous_client_secret_expires_at:p(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.access.serviceTokens.rotate({...a,account_id:i,service_token_id:e[`service-token-id`]})),{successLabel:`Created`})}};function Kn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`."}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h)."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const qn={command:`update <service-token-id>`,describe:`Updates a configured service token.`,builder:Kn,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access service-tokens update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({client_secret_version:e[`client-secret-version`],duration:p(e.duration,`duration`,`text`),name:p(e.name,`name`,`text`),previous_client_secret_expires_at:p(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.access.serviceTokens.update({...t,account_id:i,service_token_id:e[`service-token-id`]})),{successLabel:`Updated`});return}let a=l({client_secret_version:e[`client-secret-version`],duration:p(e.duration,`duration`,`text`),name:p(e.name,`name`,`text`),previous_client_secret_expires_at:p(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.access.serviceTokens.update({...a,account_id:i,service_token_id:e[`service-token-id`]})),{successLabel:`Updated`})}},Jn={command:`service-tokens`,describe:`Operations for access.service-tokens`,builder:e=>e.command(Fn).command(Ln).command(zn).command(Vn).command(Un).command(Gn).command(qn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Yn(e){return e.option(`name`,{type:`string`,description:`The name of the tag`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Xn={command:`create`,describe:`Create a tag`,builder:Yn,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access tags create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/tags`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({name:p(e.name,`name`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.access.tags.create({...t,account_id:i})),{successLabel:`Created`});return}let a=l({name:p(e.name,`name`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.access.tags.create({...a,account_id:i})),{successLabel:`Created`})}};function Zn(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Qn={command:`delete <tag-name>`,describe:`Delete a tag`,builder:Zn,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access tags delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/tags/${e[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(e[`tag-name`]))}`,pathParams:{"tag-name":String(e[`tag-name`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.tags.delete({account_id:a,tag_name:e[`tag-name`]})),{successLabel:`Deleted`})}};function $n(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const er={command:`get <tag-name>`,describe:`Get a tag`,builder:$n,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access tags get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/tags/${e[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(e[`tag-name`]))}`,pathParams:{"tag-name":String(e[`tag-name`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.tags.get({account_id:i,tag_name:e[`tag-name`]})),{successLabel:`Loaded`})}};function tr(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const nr={command:`list`,describe:`List tags`,builder:tr,handler:async e=>{let n={page:e.page,per_page:e[`per-page`]};if(e.dryRun){d({command:`cf zero-trust access tags list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/tags`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.access.tags.list({account_id:a,...n})),{successLabel:`Loaded`})}};function rr(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`name`,{type:`string`,description:`The name of the tag`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A tag`})}const ir={command:`update <tag-name>`,describe:`Update a tag`,builder:rr,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access tags update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/tags/${n[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(n[`tag-name`]))}`,pathParams:{"tag-name":String(n[`tag-name`]??``)},bodyKind:`json`,body:n.body===void 0?l({name:p(n.name,`name`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Updating`,async()=>i.zeroTrust.access.tags.update({...e,account_id:a,tag_name:n[`tag-name`]})),{successLabel:`Updated`});return}n.name===void 0&&(n.name=await e(`name`,`The name of the tag`));let o=l({name:p(n.name,`name`,`text`)});u(await f(`Updating`,async()=>i.zeroTrust.access.tags.update({...o,account_id:a,tag_name:n[`tag-name`]})),{successLabel:`Updated`})}},ar={command:`tags`,describe:`Operations for access.tags`,builder:e=>e.command(Xn).command(Qn).command(er).command(nr).command(ir).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function or(e){return e.positional(`nonce`,{type:`string`,description:`Nonce`,demandOption:!0}).option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sr={command:`get <nonce>`,describe:`Get an active session for a single user.`,builder:or,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access users active-sessions get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}/active_sessions/${e.nonce==null?`<nonce>`:encodeURIComponent(String(e.nonce))}`,pathParams:{"user-id":String(e[`user-id`]??``),nonce:String(e.nonce??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.users.activeSessions.get({account_id:i,user_id:e[`user-id`],nonce:e.nonce})),{successLabel:`Loaded`})}};function cr(e){return e.option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lr={command:`list`,describe:`Get active sessions for a single user.`,builder:cr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access users active-sessions list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}/active_sessions`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.users.activeSessions.list({account_id:i,user_id:e[`user-id`]})),{successLabel:`Loaded`})}},ur={command:`active-sessions`,describe:`Operations for access.users.active-sessions`,builder:e=>e.command(sr).command(lr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function dr(e){return e.option(`email`,{type:`string`,description:`The email of the user.`}).option(`name`,{type:`string`,description:`The name of the user.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const fr={command:`create`,describe:`Creates a new user.`,builder:dr,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access users create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/users`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({email:p(n.email,`email`,`text`),name:p(n.name,`name`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.access.users.create({...e,account_id:a})),{successLabel:`Created`});return}n.email===void 0&&(n.email=await e(`email`,`The email of the user.`));let o=l({email:p(n.email,`email`,`text`),name:p(n.name,`name`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.access.users.create({...o,account_id:a})),{successLabel:`Created`})}};function pr(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const mr={command:`delete <user-id>`,describe:`Deletes a specific user for an account. This will also revoke any active seats and tokens for the user.`,builder:pr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access users delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.access.users.delete({account_id:a,user_id:e[`user-id`]})),{successLabel:`Deleted`})}};function hr(e){return e.option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gr={command:`list`,describe:`Get all failed login attempts for a single user.`,builder:hr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access users failed-logins list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}/failed_logins`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.users.failedLogins.list({account_id:i,user_id:e[`user-id`]})),{successLabel:`Loaded`})}},_r={command:`failed-logins`,describe:`Operations for access.users.failed-logins`,builder:e=>e.command(gr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function vr(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yr={command:`get <user-id>`,describe:`Gets a specific user for an account.`,builder:vr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access users get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.users.get({account_id:i,user_id:e[`user-id`]})),{successLabel:`Loaded`})}};function br(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xr={command:`get <user-id>`,describe:`Get last seen identity for a single user.`,builder:br,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust access users last-seen-identity get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}/last_seen_identity`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.access.users.lastSeenIdentity.get({account_id:i,user_id:e[`user-id`]})),{successLabel:`Loaded`})}},Sr={command:`last-seen-identity`,describe:`Operations for access.users.last-seen-identity`,builder:e=>e.command(xr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Cr(e){return e.option(`name`,{type:`string`,description:`The name of the user.`}).option(`email`,{type:`string`,description:`The email of the user.`}).option(`search`,{type:`string`,description:`Search for users by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wr={command:`list`,describe:`Gets a list of users for an account.`,builder:Cr,handler:async e=>{let n={name:e.name,email:e.email,search:e.search,page:e.page,per_page:e[`per-page`]};if(e.dryRun){d({command:`cf zero-trust access users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/users`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.access.users.list({account_id:a,...n})),{successLabel:`Loaded`})}};function Tr(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`email`,{type:`string`,description:`The email of the user.`}).option(`name`,{type:`string`,description:`The name of the user.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Er={command:`update <user-id>`,describe:`Updates a specific user's name for an account. Requires the user's current email as confirmation (email cannot be changed).`,builder:Tr,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust access users update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/users/${n[`user-id`]==null?`<user-id>`:encodeURIComponent(String(n[`user-id`]))}`,pathParams:{"user-id":String(n[`user-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({email:p(n.email,`email`,`text`),name:p(n.name,`name`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Updating`,async()=>i.zeroTrust.access.users.update({...e,account_id:a,user_id:n[`user-id`]})),{successLabel:`Updated`});return}n.email===void 0&&(n.email=await e(`email`,`The email of the user.`)),n.name===void 0&&(n.name=await e(`name`,`The name of the user.`));let o=l({email:p(n.email,`email`,`text`),name:p(n.name,`name`,`text`)});u(await f(`Updating`,async()=>i.zeroTrust.access.users.update({...o,account_id:a,user_id:n[`user-id`]})),{successLabel:`Updated`})}},Dr={command:`users`,describe:`Operations for access.users`,builder:e=>e.command(fr).command(mr).command(yr).command(wr).command(Er).command(ur).command(_r).command(Sr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Or={command:`access`,describe:`Operations for access`,builder:e=>e.command(H).command(Be).command(Ze).command(pt).command(wt).command(jt).command(Ht).command(sn).command(mn).command(Sn).command(Nn).command(Jn).command(ar).command(Dr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function kr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ar={command:`create <app-id>`,describe:`Generates a new short-lived certificate CA and public key.`,builder:kr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps ca create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Creating`,async()=>t.zeroTrust.apps.ca.create({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Created`})}};function jr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Mr={command:`delete <app-id>`,describe:`Deletes a short-lived certificate CA.`,builder:jr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps ca delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>t.zeroTrust.apps.ca.delete({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Deleted`})}};function Nr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pr={command:`get <app-id>`,describe:`Fetches a short-lived certificate CA and its public key.`,builder:Nr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps ca get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.apps.ca.get({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Loaded`})}};function Fr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ir={command:`list`,describe:`Lists short-lived certificate CAs and their public keys.`,builder:Fr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps ca list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/ca`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.apps.ca.list({zone_id:n})),{successLabel:`Loaded`})}},Lr={command:`ca`,describe:`Operations for apps.ca`,builder:e=>e.command(Ar).command(Mr).command(Pr).command(Ir).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Rr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const zr={command:`create`,describe:`Adds a new application to Access.`,builder:Rr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Creating`,async()=>t.zeroTrust.apps.create({body:r,zone_id:n})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Br(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Vr={command:`delete <app-id>`,describe:`Deletes an application from Access.`,builder:Br,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>t.zeroTrust.apps.delete({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Deleted`})}};function Hr(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ur={command:`get <app-id>`,describe:`Fetches information about an Access application.`,builder:Hr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.apps.get({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Loaded`})}};function Wr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gr={command:`list`,describe:`List all Access Applications in a zone.`,builder:Wr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.apps.list({zone_id:n})),{successLabel:`Loaded`})}};function Kr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`,default:!1}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy.`,default:!1}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy.`}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const qr={command:`create <app-id>`,describe:`Create a new Access policy for an application.`,builder:Kr,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust apps policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/policies`,pathParams:{"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({approval_required:t[`approval-required`],decision:p(t.decision,`decision`,`text`),isolation_required:t[`isolation-required`],name:p(t.name,`name`,`text`),precedence:t.precedence,purpose_justification_prompt:p(t[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:t[`purpose-justification-required`]}):c(t.body)});return}let r=await s(t),i=await a({zone:t.zone},r,{quiet:t.quiet});if(t.zoneId=i,t.body){let e=c(t.body);u(await f(`Creating`,async()=>r.zeroTrust.apps.policies.create({...e,zone_id:i,app_id:t[`app-id`]})),{successLabel:`Created`});return}t.decision===void 0&&(t.decision=await n(`decision`,`The action Access will take if a user matches this policy.`,[`allow`,`deny`,`non_identity`,`bypass`])),t.name===void 0&&(t.name=await e(`name`,`The name of the Access policy.`));let o=l({approval_required:t[`approval-required`],decision:p(t.decision,`decision`,`text`),isolation_required:t[`isolation-required`],name:p(t.name,`name`,`text`),precedence:t.precedence,purpose_justification_prompt:p(t[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:t[`purpose-justification-required`]});u(await f(`Creating`,async()=>r.zeroTrust.apps.policies.create({...o,zone_id:i,app_id:t[`app-id`]})),{successLabel:`Created`})}};function Jr(e){return e.positional(`policy-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Yr={command:`delete <policy-id>`,describe:`Delete an Access policy.`,builder:Jr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``),"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>t.zeroTrust.apps.policies.delete({zone_id:n,app_id:e[`app-id`],policy_id:e[`policy-id`]})),{successLabel:`Deleted`})}};function Xr(e){return e.positional(`policy-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zr={command:`get <policy-id>`,describe:`Fetches a single Access policy.`,builder:Xr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``),"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.apps.policies.get({zone_id:n,app_id:e[`app-id`],policy_id:e[`policy-id`]})),{successLabel:`Loaded`})}};function Qr(e){return e.option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $r={command:`list`,describe:`Lists Access policies configured for an application.`,builder:Qr,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.apps.policies.list({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Loaded`})}};function ei(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ti={command:`update <policy-id>`,describe:`Converts an application-scoped policy to a reusable policy. The policy will no longer be exclusively scoped to the application. Further updates to the policy should go through the /accounts/{account_id}/policies/{uid} endpoint.`,builder:ei,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps policies make reusable update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/make_reusable`,pathParams:{"app-id":String(e[`app-id`]??``),"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Updating`,async()=>n.zeroTrust.apps.policies.make.reusable.update({account_id:i,app_id:e[`app-id`],policy_id:e[`policy-id`]})),{successLabel:`Updated`})}},ni={command:`reusable`,describe:`Operations for apps.policies.make.reusable`,builder:e=>e.command(ti).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ri={command:`make`,describe:`Operations for apps.policies.make`,builder:e=>e.command(ni).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ii(e){return e.positional(`policy-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy.`}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy.`}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ai={command:`update <policy-id>`,describe:`Update a configured Access policy.`,builder:ii,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust apps policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/policies/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}`,pathParams:{"policy-id":String(t[`policy-id`]??``),"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({approval_required:t[`approval-required`],decision:p(t.decision,`decision`,`text`),isolation_required:t[`isolation-required`],name:p(t.name,`name`,`text`),precedence:t.precedence,purpose_justification_prompt:p(t[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:t[`purpose-justification-required`]}):c(t.body)});return}let r=await s(t),i=await a({zone:t.zone},r,{quiet:t.quiet});if(t.zoneId=i,t.body){let e=c(t.body);u(await f(`Updating`,async()=>r.zeroTrust.apps.policies.update({...e,zone_id:i,app_id:t[`app-id`],policy_id:t[`policy-id`]})),{successLabel:`Updated`});return}t.decision===void 0&&(t.decision=await n(`decision`,`The action Access will take if a user matches this policy.`,[`allow`,`deny`,`non_identity`,`bypass`])),t.name===void 0&&(t.name=await e(`name`,`The name of the Access policy.`));let o=l({approval_required:t[`approval-required`],decision:p(t.decision,`decision`,`text`),isolation_required:t[`isolation-required`],name:p(t.name,`name`,`text`),precedence:t.precedence,purpose_justification_prompt:p(t[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:t[`purpose-justification-required`]});u(await f(`Updating`,async()=>r.zeroTrust.apps.policies.update({...o,zone_id:i,app_id:t[`app-id`],policy_id:t[`policy-id`]})),{successLabel:`Updated`})}},oi={command:`policies`,describe:`Operations for apps.policies`,builder:e=>e.command(qr).command(Yr).command(Zr).command($r).command(ai).command(ri).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function si(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ci={command:`list`,describe:`Retrieve the statuses of your applications.`,builder:si,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps review status list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/apps/review_status`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.apps.review.status.list({account_id:i})),{successLabel:`Loaded`})}};function li(e){return e.option(`approved-apps`,{type:`string`,array:!0,description:`Contains the ids of the approved applications.`}).option(`in-review-apps`,{type:`string`,array:!0,description:`Contains the ids of the applications in review.`}).option(`unapproved-apps`,{type:`string`,array:!0,description:`Contains the ids of the unapproved applications.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ui={command:`update`,describe:`Update the statuses of your applications.`,builder:li,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps review status update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/apps/review_status`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({approved_apps:e[`approved-apps`],in_review_apps:e[`in-review-apps`],unapproved_apps:e[`unapproved-apps`]}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.apps.review.status.update({...t,account_id:i})),{successLabel:`Updated`});return}if(e[`approved-apps`]===void 0)throw Error(`--approved-apps is required (or pass --body with this field set).`);if(e[`in-review-apps`]===void 0)throw Error(`--in-review-apps is required (or pass --body with this field set).`);if(e[`unapproved-apps`]===void 0)throw Error(`--unapproved-apps is required (or pass --body with this field set).`);let a=l({approved_apps:e[`approved-apps`],in_review_apps:e[`in-review-apps`],unapproved_apps:e[`unapproved-apps`]});u(await f(`Updating`,async()=>n.zeroTrust.apps.review.status.update({...a,account_id:i})),{successLabel:`Updated`})}},di={command:`status`,describe:`Operations for apps.review.status`,builder:e=>e.command(ci).command(ui).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},fi={command:`review`,describe:`Operations for apps.review`,builder:e=>e.command(di).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pi(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const mi={command:`create <app-id>`,describe:`Revokes all tokens issued for an application.`,builder:pi,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps revoke tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/revoke_tokens`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i({force:!!e.force,message:`This operation revokes all service tokens for the application.`})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>t.zeroTrust.apps.revoke.tokens.create({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Deleted`})}},hi={command:`tokens`,describe:`Operations for apps.revoke.tokens`,builder:e=>e.command(mi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},gi={command:`revoke`,describe:`Operations for apps.revoke`,builder:e=>e.command(hi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function _i(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const vi={command:`edit <app-id>`,describe:`Updates application settings.`,builder:_i,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/settings`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]}):c(e.body)});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.apps.settings.edit({body:r,zone_id:n,app_id:e[`app-id`]})),{successLabel:`Updated`});return}let r=l({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]});u(await f(`Updating`,async()=>t.zeroTrust.apps.settings.edit({body:r,zone_id:n,app_id:e[`app-id`]})),{successLabel:`Updated`})}};function yi(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const bi={command:`update <app-id>`,describe:`Updates application settings.`,builder:yi,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/settings`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]}):c(e.body)});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.apps.settings.update({body:r,zone_id:n,app_id:e[`app-id`]})),{successLabel:`Updated`});return}let r=l({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]});u(await f(`Updating`,async()=>t.zeroTrust.apps.settings.update({body:r,zone_id:n,app_id:e[`app-id`]})),{successLabel:`Updated`})}},xi={command:`settings`,describe:`Operations for apps.settings`,builder:e=>e.command(vi).command(bi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Si(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ci={command:`update <app-id>`,describe:`Updates an Access application.`,builder:Si,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.apps.update({body:r,zone_id:n,app_id:e[`app-id`]})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function wi(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ti={command:`get <app-id>`,describe:`Tests if a specific user has permission to access an application.`,builder:wi,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust apps user policy checks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/user_policy_checks`,pathParams:{"app-id":String(e[`app-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.apps.user.policy.checks.get({zone_id:n,app_id:e[`app-id`]})),{successLabel:`Loaded`})}},Ei={command:`checks`,describe:`Operations for apps.user.policy.checks`,builder:e=>e.command(Ti).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Di={command:`policy`,describe:`Operations for apps.user.policy`,builder:e=>e.command(Ei).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Oi={command:`user`,describe:`Operations for apps.user`,builder:e=>e.command(Di).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ki={command:`apps`,describe:`Operations for apps`,builder:e=>e.command(zr).command(Vr).command(Ur).command(Gr).command(Ci).command(Lr).command(oi).command(fi).command(gi).command(xi).command(Oi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ai(e){return e.option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`certificate`,{type:`string`,description:`The certificate content.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ji={command:`create`,describe:`Adds a new mTLS root certificate to Access.`,builder:Ai,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/certificates`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({associated_hostnames:t[`associated-hostnames`],certificate:p(t.certificate,`certificate`,`text`),name:p(t.name,`name`,`text`)}):c(t.body)});return}let n=await s(t),r=await a({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.certificates.create({...e,zone_id:r})),{successLabel:`Created`});return}t.certificate===void 0&&(t.certificate=await e(`certificate`,`The certificate content.`)),t.name===void 0&&(t.name=await e(`name`,`The name of the certificate.`));let i=l({associated_hostnames:t[`associated-hostnames`],certificate:p(t.certificate,`certificate`,`text`),name:p(t.name,`name`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.certificates.create({...i,zone_id:r})),{successLabel:`Created`})}};function Mi(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ni={command:`delete <certificate-id>`,describe:`Deletes an mTLS certificate.`,builder:Mi,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>t.zeroTrust.certificates.delete({zone_id:n,certificate_id:e[`certificate-id`]})),{successLabel:`Deleted`})}};function Pi(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fi={command:`get <certificate-id>`,describe:`Fetches a single mTLS certificate.`,builder:Pi,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.certificates.get({zone_id:n,certificate_id:e[`certificate-id`]})),{successLabel:`Loaded`})}};function Ii(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Li={command:`list`,describe:`Lists all mTLS certificates.`,builder:Ii,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.certificates.list({zone_id:n})),{successLabel:`Loaded`})}};function Ri(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zi={command:`list`,describe:`List all mTLS hostname settings for this zone.`,builder:Ri,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust certificates settings list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/settings`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.certificates.settings.list({zone_id:n})),{successLabel:`Loaded`})}};function Bi(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Vi={command:`update`,describe:`Updates an mTLS certificate's hostname settings.`,builder:Bi,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust certificates settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/settings`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.certificates.settings.update({...r,zone_id:n})),{successLabel:`Updated`});return}u(await f(`Updating`,async()=>o(t,`PUT`,`/zones/${e.zoneId}/access/certificates/settings`)),{successLabel:`Updated`})}},Hi={command:`settings`,describe:`Operations for certificates.settings`,builder:e=>e.command(zi).command(Vi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ui(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wi={command:`update <certificate-id>`,describe:`Updates a configured mTLS certificate.`,builder:Ui,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust certificates update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({associated_hostnames:e[`associated-hostnames`],name:p(e.name,`name`,`text`)}):c(e.body)});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.certificates.update({...r,zone_id:n,certificate_id:e[`certificate-id`]})),{successLabel:`Updated`});return}if(e[`associated-hostnames`]===void 0)throw Error(`--associated-hostnames is required (or pass --body with this field set).`);let r=l({associated_hostnames:e[`associated-hostnames`],name:p(e.name,`name`,`text`)});u(await f(`Updating`,async()=>t.zeroTrust.certificates.update({...r,zone_id:n,certificate_id:e[`certificate-id`]})),{successLabel:`Updated`})}},Gi={command:`certificates`,describe:`Operations for certificates`,builder:e=>e.command(ji).command(Ni).command(Fi).command(Li).command(Wi).command(Hi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ki(e){return e.option(`icmp-proxy-enabled`,{type:`boolean`,description:`A flag to enable the ICMP proxy for the account network.`}).option(`offramp-warp-enabled`,{type:`boolean`,description:`A flag to enable WARP to WARP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const qi={command:`edit`,describe:`Updates the Zero Trust Connectivity Settings for the given account.`,builder:Ki,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust connectivity-settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zerotrust/connectivity_settings`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({icmp_proxy_enabled:e[`icmp-proxy-enabled`],offramp_warp_enabled:e[`offramp-warp-enabled`]}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.connectivitySettings.edit({...t,account_id:i})),{successLabel:`Updated`});return}let a=l({icmp_proxy_enabled:e[`icmp-proxy-enabled`],offramp_warp_enabled:e[`offramp-warp-enabled`]});u(await f(`Updating`,async()=>n.zeroTrust.connectivitySettings.edit({...a,account_id:i})),{successLabel:`Updated`})}};function Ji(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yi={command:`get`,describe:`Gets the Zero Trust Connectivity Settings for the given account.`,builder:Ji,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust connectivity-settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zerotrust/connectivity_settings`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.connectivitySettings.get({account_id:i})),{successLabel:`Loaded`})}},Xi={command:`connectivity-settings`,describe:`Operations for connectivity-settings`,builder:e=>e.command(qi).command(Yi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Zi(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qi={command:`list`,describe:`Retrieves a list of all available target environments with their display names. This endpoint is in Beta.`,builder:Zi,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices client target environments list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/client-versions/target-environments`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.client.target.environments.list({account_id:i})),{successLabel:`Loaded`})}},$i={command:`environments`,describe:`Operations for devices.client.target.environments`,builder:e=>e.command(Qi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ea={command:`target`,describe:`Operations for devices.client.target`,builder:e=>e.command($i).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ta(e){return e.option(`target-environment`,{type:`string`,description:`The target environment for the client version (e.g., windows, macos).`,demandOption:!0}).option(`release-track`,{type:`string`,description:`The release track (ga for General Availability, beta for Beta releases).`,choices:[`ga`,`beta`],demandOption:!0}).option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The maximum number of versions to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const na={command:`list`,describe:`Lists available WARP client versions for a specific target environment and release track. This endpoint is in Beta.`,builder:g(ta),handler:async e=>{let n={target_environment:e[`target-environment`],release_track:e[`release-track`],page:e.page,per_page:e[`per-page`]};if(e.dryRun){d({command:`cf zero-trust devices client versions list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/client-versions`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.devices.client.versions.list({account_id:a,...n})),{successLabel:`Loaded`})}},ra={command:`versions`,describe:`Operations for devices.client.versions`,builder:e=>e.command(na).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ia={command:`client`,describe:`Operations for devices.client`,builder:e=>e.command(ea).command(ra).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function aa(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for the deployment group.`}).option(`policy-ids`,{type:`string`,array:!0,description:`Contains an optional list of policy IDs assigned to a group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const oa={command:`create`,describe:`Creates a new deployment group. Policy IDs must be unique across all deployment groups. This endpoint is in Beta.`,builder:aa,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust devices deployment groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/deployment-groups`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({name:p(n.name,`name`,`text`),policy_ids:n[`policy-ids`]}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.devices.deployment.groups.create({...e,account_id:a})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await e(`name`,`A user-friendly name for the deployment group.`));let o=l({name:p(n.name,`name`,`text`),policy_ids:n[`policy-ids`]});u(await f(`Creating`,async()=>i.zeroTrust.devices.deployment.groups.create({...o,account_id:a})),{successLabel:`Created`})}};function sa(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ca={command:`delete <group-id>`,describe:`Deletes a deployment group. Associated policies no longer apply and devices stop receiving version targets. This endpoint is in Beta.`,builder:sa,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices deployment groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/deployment-groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.deployment.groups.delete({account_id:a,group_id:e[`group-id`]})),{successLabel:`Deleted`})}};function la(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ua={command:`get <group-id>`,describe:`Fetches a single deployment group by its ID. This endpoint is in Beta.`,builder:la,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices deployment groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/deployment-groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.deployment.groups.get({account_id:i,group_id:e[`group-id`]})),{successLabel:`Loaded`})}};function da(e){return e.option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The maximum number of deployment groups to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fa={command:`list`,describe:`Lists all deployment groups for an account. Use deployment groups to assign target WARP client versions to specific devices. This endpoint is in Beta.`,builder:da,handler:async e=>{let n={page:e.page,per_page:e[`per-page`]};if(e.dryRun){d({command:`cf zero-trust devices deployment groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/deployment-groups`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.devices.deployment.groups.list({account_id:a,...n})),{successLabel:`Loaded`})}};function pa(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for the deployment group.`}).option(`policy-ids`,{type:`string`,array:!0,description:`Replaces the entire list of policy IDs.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ma={command:`update <group-id>`,describe:`Updates a deployment group. Returns 409 if any newly added policy IDs already belong to another deployment group. This endpoint is in Beta.`,builder:pa,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices deployment groups update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/deployment-groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({name:p(e.name,`name`,`text`),policy_ids:e[`policy-ids`]}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.deployment.groups.update({...t,account_id:i,group_id:e[`group-id`]})),{successLabel:`Updated`});return}let a=l({name:p(e.name,`name`,`text`),policy_ids:e[`policy-ids`]});u(await f(`Updating`,async()=>n.zeroTrust.devices.deployment.groups.update({...a,account_id:i,group_id:e[`group-id`]})),{successLabel:`Updated`})}},ha={command:`groups`,describe:`Operations for devices.deployment.groups`,builder:e=>e.command(oa).command(ca).command(ua).command(fa).command(ma).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ga={command:`deployment`,describe:`Operations for devices.deployment`,builder:e=>e.command(ha).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function _a(e){return e.positional(`device-id`,{type:`string`,description:`Registration ID. Equal to Device ID except for accounts which enabled [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/).`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const va={command:`get <device-id>`,describe:`Fetches a single WARP device. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices/{device_id} - GET /accounts/{account_id}/devices/registrations/{registration_id}`,builder:_a,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}`,pathParams:{"device-id":String(e[`device-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.get({account_id:i,device_id:e[`device-id`]})),{successLabel:`Loaded`})}};function ya(e){return e.option(`description`,{type:`string`,description:`An optional description of the Device IP profile.`}).option(`enabled`,{type:`boolean`,description:`Whether the Device IP profile will be applied to matching devices.`,default:!0}).option(`match`,{type:`string`,description:`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`}).option(`name`,{type:`string`,description:`A user-friendly name for the Device IP profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.`}).option(`subnet-id`,{type:`string`,description:`The ID of the Subnet.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ba={command:`create`,describe:`Creates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.`,builder:ya,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust devices ip-profiles create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/ip-profiles`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({description:p(n.description,`description`,`text`),enabled:n.enabled,match:p(n.match,`match`,`text`),name:p(n.name,`name`,`text`),precedence:n.precedence,subnet_id:p(n[`subnet-id`],`subnet-id`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.devices.ipProfiles.create({...e,account_id:a})),{successLabel:`Created`});return}if(n.match===void 0&&(n.match=await e(`match`,`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`)),n.name===void 0&&(n.name=await e(`name`,`A user-friendly name for the Device IP profile.`)),n.precedence===void 0)throw Error(`--precedence is required (or pass --body with this field set).`);n[`subnet-id`]===void 0&&(n[`subnet-id`]=await e(`subnet-id`,`The ID of the Subnet.`));let o=l({description:p(n.description,`description`,`text`),enabled:n.enabled,match:p(n.match,`match`,`text`),name:p(n.name,`name`,`text`),precedence:n.precedence,subnet_id:p(n[`subnet-id`],`subnet-id`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.devices.ipProfiles.create({...o,account_id:a})),{successLabel:`Created`})}};function xa(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Sa={command:`delete <profile-id>`,describe:`Delete a WARP Device IP profile.`,builder:xa,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices ip-profiles delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/ip-profiles/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.ipProfiles.delete({account_id:a,profile_id:e[`profile-id`]})),{successLabel:`Deleted`})}};function Ca(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wa={command:`get <profile-id>`,describe:`Fetches a single WARP Device IP profile.`,builder:Ca,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices ip-profiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/ip-profiles/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.ipProfiles.get({account_id:i,profile_id:e[`profile-id`]})),{successLabel:`Loaded`})}};function Ta(e){return e.option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The number of IP profiles to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ea={command:`list`,describe:`Lists WARP Device IP profiles.`,builder:Ta,handler:async e=>{let n={page:e.page,per_page:e[`per-page`]};if(e.dryRun){d({command:`cf zero-trust devices ip-profiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/ip-profiles`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.devices.ipProfiles.list({account_id:a,...n})),{successLabel:`Loaded`})}};function Da(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`description`,{type:`string`,description:`An optional description of the Device IP profile.`}).option(`enabled`,{type:`boolean`,description:`Whether the Device IP profile is enabled.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`}).option(`name`,{type:`string`,description:`A user-friendly name for the Device IP profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.`}).option(`subnet-id`,{type:`string`,description:`The ID of the Subnet.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Oa={command:`update <profile-id>`,describe:`Updates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.`,builder:Da,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices ip-profiles update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/ip-profiles/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({description:p(e.description,`description`,`text`),enabled:e.enabled,match:p(e.match,`match`,`text`),name:p(e.name,`name`,`text`),precedence:e.precedence,subnet_id:p(e[`subnet-id`],`subnet-id`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.ipProfiles.update({...t,account_id:i,profile_id:e[`profile-id`]})),{successLabel:`Updated`});return}let a=l({description:p(e.description,`description`,`text`),enabled:e.enabled,match:p(e.match,`match`,`text`),name:p(e.name,`name`,`text`),precedence:e.precedence,subnet_id:p(e[`subnet-id`],`subnet-id`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.devices.ipProfiles.update({...a,account_id:i,profile_id:e[`profile-id`]})),{successLabel:`Updated`})}},ka={command:`ip-profiles`,describe:`Operations for devices.ip-profiles`,builder:e=>e.command(ba).command(Sa).command(wa).command(Ea).command(Oa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Aa(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ja={command:`list`,describe:`List WARP devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices - GET /accounts/{account_id}/devices/registrations`,builder:Aa,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.list({account_id:i})),{successLabel:`Loaded`})}};function Ma(e){return e.option(`config-sha256`,{type:`string`,description:`The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.`}).option(`config-tls-sockaddr`,{type:`string`,description:`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`}).option(`name`,{type:`string`,description:`The name of the device managed network. This name must be unique.`}).option(`type`,{type:`string`,description:`The type of device managed network.`,choices:[`tls`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Na={command:`create`,describe:`Creates a new device managed network.`,builder:Ma,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust devices networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/networks`,pathParams:{},bodyKind:`json`,body:i.body===void 0?l({config:{sha256:p(i[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:p(i[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:p(i.name,`name`,`text`),type:p(i.type,`type`,`text`)}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Creating`,async()=>a.zeroTrust.devices.networks.create({...e,account_id:o})),{successLabel:`Created`});return}i[`config-tls-sockaddr`]===void 0&&(i[`config-tls-sockaddr`]=await e(`config-tls-sockaddr`,`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`)),i.name===void 0&&(i.name=await e(`name`,`The name of the device managed network. This name must be unique.`)),i.type===void 0&&(i.type=await n(`type`,`The type of device managed network.`,[`tls`]));let m=l({config:{sha256:p(i[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:p(i[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:p(i.name,`name`,`text`),type:p(i.type,`type`,`text`)});u(await f(`Creating`,async()=>a.zeroTrust.devices.networks.create({...m,account_id:o})),{successLabel:`Created`})}};function Pa(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Fa={command:`delete <network-id>`,describe:`Deletes a device managed network and fetches a list of the remaining device managed networks for an account.`,builder:Pa,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/networks/${e[`network-id`]==null?`<network-id>`:encodeURIComponent(String(e[`network-id`]))}`,pathParams:{"network-id":String(e[`network-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.networks.delete({account_id:a,network_id:e[`network-id`]})),{successLabel:`Deleted`})}};function Ia(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const La={command:`get <network-id>`,describe:`Fetches details for a single managed network.`,builder:Ia,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices networks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/networks/${e[`network-id`]==null?`<network-id>`:encodeURIComponent(String(e[`network-id`]))}`,pathParams:{"network-id":String(e[`network-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.networks.get({account_id:i,network_id:e[`network-id`]})),{successLabel:`Loaded`})}};function Ra(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const za={command:`list`,describe:`Fetches a list of managed networks for an account.`,builder:Ra,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices networks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/networks`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.networks.list({account_id:i})),{successLabel:`Loaded`})}};function Ba(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`config-sha256`,{type:`string`,description:`The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.`}).option(`config-tls-sockaddr`,{type:`string`,description:`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`}).option(`name`,{type:`string`,description:`The name of the device managed network. This name must be unique.`}).option(`type`,{type:`string`,description:`The type of device managed network.`,choices:[`tls`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`config-sha256`,`config-tls-sockaddr`].some(t=>e[t]!==void 0)){let t=[`config-tls-sockaddr`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --config-* flag is set`)}return!0})}const Va={command:`update <network-id>`,describe:`Updates a configured device managed network.`,builder:Ba,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices networks update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/networks/${e[`network-id`]==null?`<network-id>`:encodeURIComponent(String(e[`network-id`]))}`,pathParams:{"network-id":String(e[`network-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({config:{sha256:p(e[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:p(e[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:p(e.name,`name`,`text`),type:p(e.type,`type`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.networks.update({...t,account_id:i,network_id:e[`network-id`]})),{successLabel:`Updated`});return}let a=l({config:{sha256:p(e[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:p(e[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:p(e.name,`name`,`text`),type:p(e.type,`type`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.devices.networks.update({...a,account_id:i,network_id:e[`network-id`]})),{successLabel:`Updated`})}},Ha={command:`networks`,describe:`Operations for devices.networks`,builder:e=>e.command(Na).command(Fa).command(La).command(za).command(Va).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ua(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Wa={command:`get <registration-id>`,describe:`Fetches one-time use admin override codes for a registration. This relies on the **Admin Override** setting being enabled in your device configuration.`,builder:Ua,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices override-codes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/registrations/${e[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(e[`registration-id`]))}/override_codes`,pathParams:{"registration-id":String(e[`registration-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.overrideCodes.get({account_id:i,registration_id:e[`registration-id`]})),{successLabel:`Loaded`})}};function Ga(e){return e.option(`device-id`,{type:`string`,description:`Registration ID. Equal to Device ID except for accounts which enabled [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/).`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ka={command:`list`,describe:`Fetches a one-time use admin override code for a device. This relies on the **Admin Override** setting being enabled in your device configuration. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated:** please use GET /accounts/{account_id}/devices/registrations/{registration_id}/override_codes instead.`,builder:Ga,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices override-codes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}/override_codes`,pathParams:{"device-id":String(e[`device-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.overrideCodes.list({account_id:i,device_id:e[`device-id`]})),{successLabel:`Loaded`})}},qa={command:`override-codes`,describe:`Operations for devices.override-codes`,builder:e=>e.command(Wa).command(Ka).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ja(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ya={command:`delete <device-id>`,describe:`Deletes a WARP device.`,builder:Ja,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices physical-devices delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/physical-devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}`,pathParams:{"device-id":String(e[`device-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.physicalDevices.delete({account_id:a,device_id:e[`device-id`]})),{successLabel:`Deleted`})}};function Xa(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the device response. Supported values are: "last_seen_registration.policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Za={command:`get <device-id>`,describe:`Fetches a single WARP device.`,builder:Xa,handler:async e=>{let n={include:e.include};if(e.dryRun){d({command:`cf zero-trust devices physical-devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/physical-devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}`,pathParams:{"device-id":String(e[`device-id`]??``)},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.devices.physicalDevices.get({account_id:a,device_id:e[`device-id`],...n})),{successLabel:`Loaded`})}};function Qa(e){return e.option(`cursor`,{type:`string`,description:`Opaque token indicating the starting position when requesting the next set of records. A cursor value can be obtained from the result_info.cursor field in the response.`}).option(`sort-by`,{type:`string`,description:`The device field to order results by.`,choices:[`name`,`id`,`client_version`,`last_seen_user.email`,`last_seen_at`,`active_registrations`,`created_at`]}).option(`sort-order`,{type:`string`,description:`Sort direction.`,choices:[`asc`,`desc`]}).option(`last-seen-user-email`,{type:`string`,description:`Filter by the last seen user's email.`}).option(`seen-after`,{type:`string`,description:`Filter by the last_seen timestamp - returns only devices last seen after this timestamp.`}).option(`seen-before`,{type:`string`,description:`Filter by the last_seen timestamp - returns only devices last seen before this timestamp.`}).option(`per-page`,{type:`number`,description:`The maximum number of devices to return in a single response.`}).option(`search`,{type:`string`,description:`Search by device details.`}).option(`active-registrations`,{type:`string`,description:`Include or exclude devices with active registrations. The default is "only" - return only devices with active registrations.`,choices:[`include`,`only`,`exclude`]}).option(`id`,{type:`string`,description:`Filter by a one or more device IDs.`}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the device response. Supported values are: "last_seen_registration.policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $a={command:`list`,describe:`Lists WARP devices.`,builder:g(Qa),handler:async e=>{let n={cursor:e.cursor,sort_by:e[`sort-by`],sort_order:e[`sort-order`],"last_seen_user.email":e[`last-seen-user-email`],seen_after:e[`seen-after`],seen_before:e[`seen-before`],per_page:e[`per-page`],search:e.search,active_registrations:e[`active-registrations`],id:e.id,include:e.include};if(e.dryRun){d({command:`cf zero-trust devices physical-devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/physical-devices`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.devices.physicalDevices.list({account_id:a,...n})),{successLabel:`Loaded`})}};function eo(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const to={command:`revoke <device-id>`,describe:`Revokes all WARP registrations associated with the specified device.`,builder:eo,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices physical-devices revoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/physical-devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}/revoke`,pathParams:{"device-id":String(e[`device-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force,message:`This operation revokes a device's session destructively.`})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.physicalDevices.revoke({account_id:a,device_id:e[`device-id`]})),{successLabel:`Deleted`})}},no={command:`physical-devices`,describe:`Enrolled physical WARP devices`,builder:e=>e.command(Ya).command(Za).command($a).command(to).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ro(e){return e.option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`,default:!1}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`,default:!1}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`,default:!0}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`,default:0}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`,default:180}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`.",default:!1}).option(`enabled`,{type:`boolean`,description:`Whether the policy will be applied to matching devices.`,default:!0}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`,default:!1}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`}).option(`name`,{type:`string`,description:`The name of the device settings profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`,default:!0}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`,default:!1}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`,default:``}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`,default:!1}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`,default:``}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const io={command:`create`,describe:`Creates a device settings profile to be applied to certain devices matching the criteria.`,builder:ro,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust devices policies custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({allow_mode_switch:n[`allow-mode-switch`],allow_updates:n[`allow-updates`],allowed_to_leave:n[`allowed-to-leave`],auto_connect:n[`auto-connect`],captive_portal:n[`captive-portal`],disable_auto_fallback:n[`disable-auto-fallback`],enabled:n.enabled,exclude_office_ips:n[`exclude-office-ips`],global_acceleration:{api_endpoints:n[`global-acceleration-api-endpoints`],enabled:n[`global-acceleration-enabled`],masque_endpoints:n[`global-acceleration-masque-endpoints`],wireguard_endpoints:n[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:n[`lan-allow-minutes`],lan_allow_subnet_size:n[`lan-allow-subnet-size`],match:p(n.match,`match`,`text`),name:p(n.name,`name`,`text`),precedence:n.precedence,register_interface_ip_with_dns:n[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:n[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(n[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:n[`service-mode-v2-port`]},support_url:p(n[`support-url`],`support-url`,`text`),switch_locked:n[`switch-locked`],tunnel_protocol:p(n[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:n[`virtual-networks-allowed`],default:p(n[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.devices.policies.custom.create({...e,account_id:a})),{successLabel:`Created`});return}if(n.match===void 0&&(n.match=await e(`match`,`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`)),n.name===void 0&&(n.name=await e(`name`,`The name of the device settings profile.`)),n.precedence===void 0)throw Error(`--precedence is required (or pass --body with this field set).`);let o=l({allow_mode_switch:n[`allow-mode-switch`],allow_updates:n[`allow-updates`],allowed_to_leave:n[`allowed-to-leave`],auto_connect:n[`auto-connect`],captive_portal:n[`captive-portal`],disable_auto_fallback:n[`disable-auto-fallback`],enabled:n.enabled,exclude_office_ips:n[`exclude-office-ips`],global_acceleration:{api_endpoints:n[`global-acceleration-api-endpoints`],enabled:n[`global-acceleration-enabled`],masque_endpoints:n[`global-acceleration-masque-endpoints`],wireguard_endpoints:n[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:n[`lan-allow-minutes`],lan_allow_subnet_size:n[`lan-allow-subnet-size`],match:p(n.match,`match`,`text`),name:p(n.name,`name`,`text`),precedence:n.precedence,register_interface_ip_with_dns:n[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:n[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(n[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:n[`service-mode-v2-port`]},support_url:p(n[`support-url`],`support-url`,`text`),switch_locked:n[`switch-locked`],tunnel_protocol:p(n[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:n[`virtual-networks-allowed`],default:p(n[`virtual-networks-default`],`virtual-networks-default`,`text`)}});u(await f(`Creating`,async()=>i.zeroTrust.devices.policies.custom.create({...o,account_id:a})),{successLabel:`Created`})}};function ao(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const oo={command:`delete <policy-id>`,describe:`Deletes a device settings profile and fetches a list of the remaining profiles for an account.`,builder:ao,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.policies.custom.delete({account_id:a,policy_id:e[`policy-id`]})),{successLabel:`Deleted`})}};function so(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`}).option(`description`,{type:`string`,description:`A description of the policy.`}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`."}).option(`enabled`,{type:`boolean`,description:`Whether the policy will be applied to matching devices.`}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`}).option(`name`,{type:`string`,description:`The name of the device settings profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const co={command:`edit <policy-id>`,describe:`Updates a configured device settings profile.`,builder:so,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies custom edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({allow_mode_switch:e[`allow-mode-switch`],allow_updates:e[`allow-updates`],allowed_to_leave:e[`allowed-to-leave`],auto_connect:e[`auto-connect`],captive_portal:e[`captive-portal`],description:p(e.description,`description`,`text`),disable_auto_fallback:e[`disable-auto-fallback`],enabled:e.enabled,exclude_office_ips:e[`exclude-office-ips`],global_acceleration:{api_endpoints:e[`global-acceleration-api-endpoints`],enabled:e[`global-acceleration-enabled`],masque_endpoints:e[`global-acceleration-masque-endpoints`],wireguard_endpoints:e[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:e[`lan-allow-minutes`],lan_allow_subnet_size:e[`lan-allow-subnet-size`],match:p(e.match,`match`,`text`),name:p(e.name,`name`,`text`),precedence:e.precedence,register_interface_ip_with_dns:e[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:e[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(e[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:e[`service-mode-v2-port`]},support_url:p(e[`support-url`],`support-url`,`text`),switch_locked:e[`switch-locked`],tunnel_protocol:p(e[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:e[`virtual-networks-allowed`],default:p(e[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.custom.edit({...t,account_id:i,policy_id:e[`policy-id`]})),{successLabel:`Updated`});return}let a=l({allow_mode_switch:e[`allow-mode-switch`],allow_updates:e[`allow-updates`],allowed_to_leave:e[`allowed-to-leave`],auto_connect:e[`auto-connect`],captive_portal:e[`captive-portal`],description:p(e.description,`description`,`text`),disable_auto_fallback:e[`disable-auto-fallback`],enabled:e.enabled,exclude_office_ips:e[`exclude-office-ips`],global_acceleration:{api_endpoints:e[`global-acceleration-api-endpoints`],enabled:e[`global-acceleration-enabled`],masque_endpoints:e[`global-acceleration-masque-endpoints`],wireguard_endpoints:e[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:e[`lan-allow-minutes`],lan_allow_subnet_size:e[`lan-allow-subnet-size`],match:p(e.match,`match`,`text`),name:p(e.name,`name`,`text`),precedence:e.precedence,register_interface_ip_with_dns:e[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:e[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(e[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:e[`service-mode-v2-port`]},support_url:p(e[`support-url`],`support-url`,`text`),switch_locked:e[`switch-locked`],tunnel_protocol:p(e[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:e[`virtual-networks-allowed`],default:p(e[`virtual-networks-default`],`virtual-networks-default`,`text`)}});u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.custom.edit({...a,account_id:i,policy_id:e[`policy-id`]})),{successLabel:`Updated`})}};function lo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const uo={command:`get <policy-id>`,describe:`Fetches the list of routes excluded from the WARP client's tunnel for a specific device settings profile.`,builder:lo,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies custom excludes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/exclude`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.custom.excludes.get({account_id:i,policy_id:e[`policy-id`]})),{successLabel:`Loaded`})}};function fo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const po={command:`update <policy-id>`,describe:`Sets the list of routes excluded from the WARP client's tunnel for a specific device settings profile.`,builder:fo,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies custom excludes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/exclude`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.custom.excludes.update({body:t,account_id:i,policy_id:e[`policy-id`]})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},mo={command:`excludes`,describe:`Operations for devices.policies.custom.excludes`,builder:e=>e.command(uo).command(po).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ho(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const go={command:`get <policy-id>`,describe:`Fetches the list of domains to bypass Gateway DNS resolution from a specified device settings profile. These domains will use the specified local DNS resolver instead.`,builder:ho,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies custom fallback-domains get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/fallback_domains`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.custom.fallbackDomains.get({account_id:i,policy_id:e[`policy-id`]})),{successLabel:`Loaded`})}};function _o(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const vo={command:`update <policy-id>`,describe:`Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. This will only apply to the specified device settings profile.`,builder:_o,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies custom fallback-domains update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/fallback_domains`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.custom.fallbackDomains.update({body:t,account_id:i,policy_id:e[`policy-id`]})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},yo={command:`fallback-domains`,describe:`Operations for devices.policies.custom.fallback-domains`,builder:e=>e.command(go).command(vo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xo={command:`get <policy-id>`,describe:`Fetches a device settings profile by ID.`,builder:bo,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies custom get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.custom.get({account_id:i,policy_id:e[`policy-id`]})),{successLabel:`Loaded`})}};function So(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Co={command:`get <policy-id>`,describe:`Fetches the list of routes included in the WARP client's tunnel for a specific device settings profile.`,builder:So,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies custom includes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/include`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.custom.includes.get({account_id:i,policy_id:e[`policy-id`]})),{successLabel:`Loaded`})}};function wo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const To={command:`update <policy-id>`,describe:`Sets the list of routes included in the WARP client's tunnel for a specific device settings profile.`,builder:wo,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies custom includes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/include`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.custom.includes.update({body:t,account_id:i,policy_id:e[`policy-id`]})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Eo={command:`includes`,describe:`Operations for devices.policies.custom.includes`,builder:e=>e.command(Co).command(To).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Do(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Oo={command:`list`,describe:`Fetches a list of the device settings profiles for an account.`,builder:Do,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies custom list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policies`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.custom.list({account_id:i})),{successLabel:`Loaded`})}},ko={command:`custom`,describe:`Operations for devices.policies.custom`,builder:e=>e.command(io).command(oo).command(co).command(xo).command(Oo).command(mo).command(yo).command(Eo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ao(e){return e.option(`enabled`,{type:`boolean`,description:`The current status of the device policy certificate provisioning feature for WARP clients.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const jo={command:`edit`,describe:`Enable Zero Trust Clients to provision a certificate, containing a x509 subject, and referenced by Access device posture policies when the client visits MTLS protected domains. This facilitates device posture without a WARP session.`,builder:Ao,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies default certificates edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/devices/policy/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({enabled:e.enabled}):c(e.body)});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.devices.policies.default.certificates.edit({body:r,zone_id:n})),{successLabel:`Updated`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let r=l({enabled:e.enabled});u(await f(`Updating`,async()=>t.zeroTrust.devices.policies.default.certificates.edit({body:r,zone_id:n})),{successLabel:`Updated`})}};function Mo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const No={command:`get`,describe:`Fetches device certificate provisioning.`,builder:Mo,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies default certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/devices/policy/certificates`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.devices.policies.default.certificates.get({zone_id:n})),{successLabel:`Loaded`})}},Po={command:`certificates`,describe:`Operations for devices.policies.default.certificates`,builder:e=>e.command(jo).command(No).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Fo(e){return e.option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`."}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const Io={command:`edit`,describe:`Updates the default device settings profile for an account.`,builder:Fo,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies default edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({allow_mode_switch:e[`allow-mode-switch`],allow_updates:e[`allow-updates`],allowed_to_leave:e[`allowed-to-leave`],auto_connect:e[`auto-connect`],captive_portal:e[`captive-portal`],disable_auto_fallback:e[`disable-auto-fallback`],exclude_office_ips:e[`exclude-office-ips`],global_acceleration:{api_endpoints:e[`global-acceleration-api-endpoints`],enabled:e[`global-acceleration-enabled`],masque_endpoints:e[`global-acceleration-masque-endpoints`],wireguard_endpoints:e[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:e[`lan-allow-minutes`],lan_allow_subnet_size:e[`lan-allow-subnet-size`],register_interface_ip_with_dns:e[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:e[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(e[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:e[`service-mode-v2-port`]},support_url:p(e[`support-url`],`support-url`,`text`),switch_locked:e[`switch-locked`],tunnel_protocol:p(e[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:e[`virtual-networks-allowed`],default:p(e[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.default.edit({...t,account_id:i})),{successLabel:`Updated`});return}let a=l({allow_mode_switch:e[`allow-mode-switch`],allow_updates:e[`allow-updates`],allowed_to_leave:e[`allowed-to-leave`],auto_connect:e[`auto-connect`],captive_portal:e[`captive-portal`],disable_auto_fallback:e[`disable-auto-fallback`],exclude_office_ips:e[`exclude-office-ips`],global_acceleration:{api_endpoints:e[`global-acceleration-api-endpoints`],enabled:e[`global-acceleration-enabled`],masque_endpoints:e[`global-acceleration-masque-endpoints`],wireguard_endpoints:e[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:e[`lan-allow-minutes`],lan_allow_subnet_size:e[`lan-allow-subnet-size`],register_interface_ip_with_dns:e[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:e[`sccm-vpn-boundary-support`],service_mode_v2:{mode:p(e[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:e[`service-mode-v2-port`]},support_url:p(e[`support-url`],`support-url`,`text`),switch_locked:e[`switch-locked`],tunnel_protocol:p(e[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:e[`virtual-networks-allowed`],default:p(e[`virtual-networks-default`],`virtual-networks-default`,`text`)}});u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.default.edit({...a,account_id:i})),{successLabel:`Updated`})}};function Lo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ro={command:`get`,describe:`Fetches the list of routes excluded from the WARP client's tunnel.`,builder:Lo,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies default excludes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy/exclude`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.default.excludes.get({account_id:i})),{successLabel:`Loaded`})}};function zo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Bo={command:`update`,describe:`Sets the list of routes excluded from the WARP client's tunnel.`,builder:zo,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies default excludes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy/exclude`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.default.excludes.update({body:t,account_id:i})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Vo={command:`excludes`,describe:`Operations for devices.policies.default.excludes`,builder:e=>e.command(Ro).command(Bo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ho(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Uo={command:`get`,describe:`Fetches a list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.`,builder:Ho,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies default fallback-domains get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy/fallback_domains`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.default.fallbackDomains.get({account_id:i})),{successLabel:`Loaded`})}};function Wo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Go={command:`update`,describe:`Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.`,builder:Wo,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies default fallback-domains update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy/fallback_domains`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.default.fallbackDomains.update({body:t,account_id:i})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ko={command:`fallback-domains`,describe:`Operations for devices.policies.default.fallback-domains`,builder:e=>e.command(Uo).command(Go).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function qo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jo={command:`get`,describe:`Fetches the default device settings profile for an account.`,builder:qo,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies default get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.default.get({account_id:i})),{successLabel:`Loaded`})}};function Yo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xo={command:`get`,describe:`Fetches the list of routes included in the WARP client's tunnel.`,builder:Yo,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies default includes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy/include`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.policies.default.includes.get({account_id:i})),{successLabel:`Loaded`})}};function Zo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Qo={command:`update`,describe:`Sets the list of routes included in the WARP client's tunnel.`,builder:Zo,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices policies default includes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/policy/include`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.policies.default.includes.update({body:t,account_id:i})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},$o={command:`includes`,describe:`Operations for devices.policies.default.includes`,builder:e=>e.command(Xo).command(Qo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},es={command:`default`,describe:`Operations for devices.policies.default`,builder:e=>e.command(Io).command(Jo).command(Po).command(Vo).command(Ko).command($o).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ts={command:`policies`,describe:`Operations for devices.policies`,builder:e=>e.command(ko).command(es).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ns(e){return e.option(`description`,{type:`string`,description:`The description of the device posture rule.`}).option(`expiration`,{type:`string`,description:`Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.`}).option(`input-exists`,{type:`boolean`,description:`Whether or not file exists.`}).option(`input-operating-system`,{type:`string`,description:`Operating system.`,choices:[`windows`,`linux`,`mac`,`android`,`ios`,`chromeos`]}).option(`input-path`,{type:`string`,description:`File path.`}).option(`input-sha256`,{type:`string`,description:`SHA-256.`}).option(`input-thumbprint`,{type:`string`,description:`Signing certificate thumbprint.`}).option(`input-id`,{type:`string`,description:`List ID.`}).option(`input-domain`,{type:`string`,description:`Domain.`}).option(`input-operator`,{type:`string`,description:`Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-os-distro-name`,{type:`string`,description:`Operating System Distribution Name (linux only).`}).option(`input-os-distro-revision`,{type:`string`,description:`Version of OS Distribution (linux only).`}).option(`input-os-version-extra`,{type:`string`,description:`Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.`}).option(`input-version`,{type:`string`,description:`Version of OS.`}).option(`input-enabled`,{type:`boolean`,description:`Enabled.`}).option(`input-check-disks`,{type:`string`,array:!0,description:`List of volume names to be checked for encryption.`}).option(`input-require-all`,{type:`boolean`,description:`Whether to check all disks for encryption.`}).option(`input-certificate-id`,{type:`string`,description:`UUID of Cloudflare managed certificate.`}).option(`input-cn`,{type:`string`,description:`Common Name that is protected by the certificate.`}).option(`input-check-private-key`,{type:`boolean`,description:`Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.`}).option(`input-extended-key-usage`,{type:`string`,array:!0,description:`List of values indicating purposes for which the certificate public key can be used.`}).option(`input-locations-paths`,{type:`string`,array:!0,description:`List of paths to check for client certificate on linux.`}).option(`input-locations-trust-stores`,{type:`string`,array:!0,description:`List of trust stores to check for client certificate.`}).option(`input-subject-alternative-names`,{type:`string`,array:!0,description:`List of certificate Subject Alternative Names.`}).option(`input-update-window-days`,{type:`number`,description:`Number of days that the antivirus should be updated within.`}).option(`input-compliance-status`,{type:`string`,description:`Compliance Status.`,choices:[`compliant`,`noncompliant`,`unknown`,`notapplicable`,`ingraceperiod`,`error`]}).option(`input-connection-id`,{type:`string`,description:`Posture Integration ID.`}).option(`input-last-seen`,{type:`string`,description:`For more details on last seen, please refer to the Crowdstrike documentation.`}).option(`input-os`,{type:`string`,description:`Os Version.`}).option(`input-overall`,{type:`string`,description:`Overall.`}).option(`input-sensor-config`,{type:`string`,description:`SensorConfig.`}).option(`input-state`,{type:`string`,description:`For more details on state, please refer to the Crowdstrike documentation.`,choices:[`online`,`offline`,`unknown`]}).option(`input-version-operator`,{type:`string`,description:`Version Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-auth-state`,{type:`string`,array:!0,description:`The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.`}).option(`input-count-operator`,{type:`string`,description:`Count Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-issue-count`,{type:`string`,description:`The Number of Issues.`}).option(`input-eid-last-seen`,{type:`string`,description:`For more details on eid last seen, refer to the Tanium documentation.`}).option(`input-risk-level`,{type:`string`,description:`For more details on risk level, refer to the Tanium documentation.`,choices:[`low`,`medium`,`high`,`critical`]}).option(`input-score-operator`,{type:`string`,description:`Score Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-total-score`,{type:`number`,description:`For more details on total score, refer to the Tanium documentation.`}).option(`input-active-threats`,{type:`number`,description:`The Number of active threats.`}).option(`input-infected`,{type:`boolean`,description:`Whether device is infected.`}).option(`input-is-active`,{type:`boolean`,description:`Whether device is active.`}).option(`input-network-status`,{type:`string`,description:`Network status of device.`,choices:[`connected`,`disconnected`,`disconnecting`,`connecting`]}).option(`input-operational-state`,{type:`string`,description:`Agent operational state.`,choices:[`na`,`partially_disabled`,`auto_fully_disabled`,`fully_disabled`,`auto_partially_disabled`,`disabled_error`,`db_corruption`]}).option(`input-score`,{type:`number`,description:`A value between 0-100 assigned to devices set by the 3rd party posture provider.`}).option(`name`,{type:`string`,description:`The name of the device posture rule.`}).option(`schedule`,{type:`string`,description:"Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`."}).option(`type`,{type:`string`,description:`The type of device posture rule.`,choices:[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`input-exists`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operating-system`,`input-id.input-check-disks.input-require-all.input-certificate-id.input-cn.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-operator.input-os.input-overall.input-sensor-config.input-state.input-version.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-path`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sha256`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-thumbprint`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-id`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-domain`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operator`,[`input-exists`,`input-path`,`input-sha256`,`input-thumbprint`,`input-operating-system`,`input-id`,`input-domain`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`,`input-compliance-status`,`input-connection-id`,`input-auth-state`,`input-count-operator`,`input-issue-count`]).conflicts(`input-os-distro-name`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-distro-revision`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-version-extra`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-version`,[`input-operating-system`,`input-operator`]).conflicts(`input-enabled`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-enabled`,[`input-operating-system`]).conflicts(`input-check-disks`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-require-all`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-certificate-id`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-cn`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-cn`,[`input-certificate-id`]).conflicts(`input-check-private-key`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-check-private-key`,[`input-certificate-id`,`input-operating-system`]).conflicts(`input-extended-key-usage`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-paths`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-trust-stores`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-subject-alternative-names`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-update-window-days`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-compliance-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-connection-id`,[`input-exists`,`input-operating-system`,`input-path`,`input-sha256`,`input-thumbprint`,`input-id`,`input-domain`,`input-operator`,`input-os-distro-name`,`input-os-distro-revision`,`input-os-version-extra`,`input-version`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`]).conflicts(`input-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-overall`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sensor-config`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-auth-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-count-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-issue-count`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-eid-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-risk-level`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-score-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-total-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-active-threats`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-infected`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-is-active`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-network-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-operational-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state`.split(`.`)).implies(`input-score`,[`input-connection-id`,`input-operator`])}const rs={command:`create`,describe:`Creates a new device posture rule.`,builder:ns,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust devices posture create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/posture`,pathParams:{},bodyKind:`json`,body:i.body===void 0?l({description:p(i.description,`description`,`text`),expiration:p(i.expiration,`expiration`,`text`),input:{exists:i[`input-exists`],operating_system:p(i[`input-operating-system`],`input-operating-system`,`text`),path:p(i[`input-path`],`input-path`,`text`),sha256:p(i[`input-sha256`],`input-sha256`,`text`),thumbprint:p(i[`input-thumbprint`],`input-thumbprint`,`text`),id:p(i[`input-id`],`input-id`,`text`),domain:p(i[`input-domain`],`input-domain`,`text`),operator:p(i[`input-operator`],`input-operator`,`text`),os_distro_name:p(i[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:p(i[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:p(i[`input-os-version-extra`],`input-os-version-extra`,`text`),version:p(i[`input-version`],`input-version`,`text`),enabled:i[`input-enabled`],checkDisks:i[`input-check-disks`],requireAll:i[`input-require-all`],certificate_id:p(i[`input-certificate-id`],`input-certificate-id`,`text`),cn:p(i[`input-cn`],`input-cn`,`text`),check_private_key:i[`input-check-private-key`],extended_key_usage:i[`input-extended-key-usage`],locations:{paths:i[`input-locations-paths`],trust_stores:i[`input-locations-trust-stores`]},subject_alternative_names:i[`input-subject-alternative-names`],update_window_days:i[`input-update-window-days`],compliance_status:p(i[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:p(i[`input-connection-id`],`input-connection-id`,`text`),last_seen:p(i[`input-last-seen`],`input-last-seen`,`text`),os:p(i[`input-os`],`input-os`,`text`),overall:p(i[`input-overall`],`input-overall`,`text`),sensor_config:p(i[`input-sensor-config`],`input-sensor-config`,`text`),state:p(i[`input-state`],`input-state`,`text`),versionOperator:p(i[`input-version-operator`],`input-version-operator`,`text`),auth_state:i[`input-auth-state`],countOperator:p(i[`input-count-operator`],`input-count-operator`,`text`),issue_count:p(i[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:p(i[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:p(i[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:p(i[`input-score-operator`],`input-score-operator`,`text`),total_score:i[`input-total-score`],active_threats:i[`input-active-threats`],infected:i[`input-infected`],is_active:i[`input-is-active`],network_status:p(i[`input-network-status`],`input-network-status`,`text`),operational_state:p(i[`input-operational-state`],`input-operational-state`,`text`),score:i[`input-score`]},name:p(i.name,`name`,`text`),schedule:p(i.schedule,`schedule`,`text`),type:p(i.type,`type`,`text`)}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Creating`,async()=>a.zeroTrust.devices.posture.create({...e,account_id:o})),{successLabel:`Created`});return}i.name===void 0&&(i.name=await e(`name`,`The name of the device posture rule.`)),i.type===void 0&&(i.type=await n(`type`,`The type of device posture rule.`,[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]));let m=l({description:p(i.description,`description`,`text`),expiration:p(i.expiration,`expiration`,`text`),input:{exists:i[`input-exists`],operating_system:p(i[`input-operating-system`],`input-operating-system`,`text`),path:p(i[`input-path`],`input-path`,`text`),sha256:p(i[`input-sha256`],`input-sha256`,`text`),thumbprint:p(i[`input-thumbprint`],`input-thumbprint`,`text`),id:p(i[`input-id`],`input-id`,`text`),domain:p(i[`input-domain`],`input-domain`,`text`),operator:p(i[`input-operator`],`input-operator`,`text`),os_distro_name:p(i[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:p(i[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:p(i[`input-os-version-extra`],`input-os-version-extra`,`text`),version:p(i[`input-version`],`input-version`,`text`),enabled:i[`input-enabled`],checkDisks:i[`input-check-disks`],requireAll:i[`input-require-all`],certificate_id:p(i[`input-certificate-id`],`input-certificate-id`,`text`),cn:p(i[`input-cn`],`input-cn`,`text`),check_private_key:i[`input-check-private-key`],extended_key_usage:i[`input-extended-key-usage`],locations:{paths:i[`input-locations-paths`],trust_stores:i[`input-locations-trust-stores`]},subject_alternative_names:i[`input-subject-alternative-names`],update_window_days:i[`input-update-window-days`],compliance_status:p(i[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:p(i[`input-connection-id`],`input-connection-id`,`text`),last_seen:p(i[`input-last-seen`],`input-last-seen`,`text`),os:p(i[`input-os`],`input-os`,`text`),overall:p(i[`input-overall`],`input-overall`,`text`),sensor_config:p(i[`input-sensor-config`],`input-sensor-config`,`text`),state:p(i[`input-state`],`input-state`,`text`),versionOperator:p(i[`input-version-operator`],`input-version-operator`,`text`),auth_state:i[`input-auth-state`],countOperator:p(i[`input-count-operator`],`input-count-operator`,`text`),issue_count:p(i[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:p(i[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:p(i[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:p(i[`input-score-operator`],`input-score-operator`,`text`),total_score:i[`input-total-score`],active_threats:i[`input-active-threats`],infected:i[`input-infected`],is_active:i[`input-is-active`],network_status:p(i[`input-network-status`],`input-network-status`,`text`),operational_state:p(i[`input-operational-state`],`input-operational-state`,`text`),score:i[`input-score`]},name:p(i.name,`name`,`text`),schedule:p(i.schedule,`schedule`,`text`),type:p(i.type,`type`,`text`)});u(await f(`Creating`,async()=>a.zeroTrust.devices.posture.create({...m,account_id:o})),{successLabel:`Created`})}};function is(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const as={command:`delete <rule-id>`,describe:`Deletes a device posture rule.`,builder:is,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices posture delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/posture/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.posture.delete({account_id:a,rule_id:e[`rule-id`]})),{successLabel:`Deleted`})}};function os(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ss={command:`get <rule-id>`,describe:`Fetches a single device posture rule.`,builder:os,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices posture get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/posture/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.posture.get({account_id:i,rule_id:e[`rule-id`]})),{successLabel:`Loaded`})}};function cs(e){return e.option(`config-api-url`,{type:`string`,description:`The Workspace One API URL provided in the Workspace One Admin Dashboard.`}).option(`config-auth-url`,{type:`string`,description:`The Workspace One Authorization URL depending on your region.`}).option(`config-client-id`,{type:`string`,description:`The Workspace One client ID provided in the Workspace One Admin Dashboard.`}).option(`config-client-secret`,{type:`string`,description:`The Workspace One client secret provided in the Workspace One Admin Dashboard.`}).option(`config-customer-id`,{type:`string`,description:`The Crowdstrike customer ID.`}).option(`config-client-key`,{type:`string`,description:`The Uptycs client secret.`}).option(`config-access-client-id`,{type:`string`,description:"If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`."}).option(`config-access-client-secret`,{type:`string`,description:"If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`."}).option(`interval`,{type:`string`,description:"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`)."}).option(`name`,{type:`string`,description:`The name of the device posture integration.`}).option(`type`,{type:`string`,description:`The type of device posture integration.`,choices:[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`config-api-url`,[`config-customer-id`,`config-client-id`,`config-client-secret`]).conflicts(`config-auth-url`,[`config-customer-id`,`config-client-key`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-auth-url`,[`config-api-url`,`config-client-id`,`config-client-secret`]).conflicts(`config-client-id`,[`config-client-key`,`config-customer-id`,`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-client-secret`,[`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-customer-id`,[`config-auth-url`,`config-client-id`,`config-api-url`,`config-access-client-id`,`config-access-client-secret`]).conflicts(`config-client-key`,[`config-auth-url`,`config-client-id`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-client-key`,[`config-api-url`,`config-customer-id`,`config-client-secret`]).conflicts(`config-access-client-id`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-id`,[`config-api-url`,`config-access-client-secret`]).conflicts(`config-access-client-secret`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-secret`,[`config-api-url`,`config-access-client-id`])}const ls={command:`create`,describe:`Create a new device posture integration.`,builder:cs,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust devices posture integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/posture/integration`,pathParams:{},bodyKind:`json`,body:i.body===void 0?l({config:{api_url:p(i[`config-api-url`],`config-api-url`,`text`),auth_url:p(i[`config-auth-url`],`config-auth-url`,`text`),client_id:p(i[`config-client-id`],`config-client-id`,`text`),client_secret:p(i[`config-client-secret`],`config-client-secret`,`text`),customer_id:p(i[`config-customer-id`],`config-customer-id`,`text`),client_key:p(i[`config-client-key`],`config-client-key`,`text`),access_client_id:p(i[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:p(i[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:p(i.interval,`interval`,`text`),name:p(i.name,`name`,`text`),type:p(i.type,`type`,`text`)}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Creating`,async()=>a.zeroTrust.devices.posture.integrations.create({...e,account_id:o})),{successLabel:`Created`});return}i.interval===void 0&&(i.interval=await e(`interval`,"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`).")),i.name===void 0&&(i.name=await e(`name`,`The name of the device posture integration.`)),i.type===void 0&&(i.type=await n(`type`,`The type of device posture integration.`,[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]));let m=l({config:{api_url:p(i[`config-api-url`],`config-api-url`,`text`),auth_url:p(i[`config-auth-url`],`config-auth-url`,`text`),client_id:p(i[`config-client-id`],`config-client-id`,`text`),client_secret:p(i[`config-client-secret`],`config-client-secret`,`text`),customer_id:p(i[`config-customer-id`],`config-customer-id`,`text`),client_key:p(i[`config-client-key`],`config-client-key`,`text`),access_client_id:p(i[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:p(i[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:p(i.interval,`interval`,`text`),name:p(i.name,`name`,`text`),type:p(i.type,`type`,`text`)});u(await f(`Creating`,async()=>a.zeroTrust.devices.posture.integrations.create({...m,account_id:o})),{successLabel:`Created`})}};function us(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ds={command:`delete <integration-id>`,describe:`Delete a configured device posture integration.`,builder:us,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices posture integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/posture/integration/${e[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(e[`integration-id`]))}`,pathParams:{"integration-id":String(e[`integration-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.posture.integrations.delete({account_id:a,integration_id:e[`integration-id`]})),{successLabel:`Deleted`})}};function fs(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`config-api-url`,{type:`string`,description:`The Workspace One API URL provided in the Workspace One Admin Dashboard.`}).option(`config-auth-url`,{type:`string`,description:`The Workspace One Authorization URL depending on your region.`}).option(`config-client-id`,{type:`string`,description:`The Workspace One client ID provided in the Workspace One Admin Dashboard.`}).option(`config-client-secret`,{type:`string`,description:`The Workspace One client secret provided in the Workspace One Admin Dashboard.`}).option(`config-customer-id`,{type:`string`,description:`The Crowdstrike customer ID.`}).option(`config-client-key`,{type:`string`,description:`The Uptycs client secret.`}).option(`config-access-client-id`,{type:`string`,description:"If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`."}).option(`config-access-client-secret`,{type:`string`,description:"If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`."}).option(`interval`,{type:`string`,description:"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`)."}).option(`name`,{type:`string`,description:`The name of the device posture integration.`}).option(`type`,{type:`string`,description:`The type of device posture integration.`,choices:[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`config-api-url`,[`config-customer-id`,`config-client-id`,`config-client-secret`]).conflicts(`config-auth-url`,[`config-customer-id`,`config-client-key`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-auth-url`,[`config-api-url`,`config-client-id`,`config-client-secret`]).conflicts(`config-client-id`,[`config-client-key`,`config-customer-id`,`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-client-secret`,[`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-customer-id`,[`config-auth-url`,`config-client-id`,`config-api-url`,`config-access-client-id`,`config-access-client-secret`]).conflicts(`config-client-key`,[`config-auth-url`,`config-client-id`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-client-key`,[`config-api-url`,`config-customer-id`,`config-client-secret`]).conflicts(`config-access-client-id`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-id`,[`config-api-url`,`config-access-client-secret`]).conflicts(`config-access-client-secret`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-secret`,[`config-api-url`,`config-access-client-id`])}const ps={command:`edit <integration-id>`,describe:`Updates a configured device posture integration.`,builder:fs,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices posture integrations edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/posture/integration/${e[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(e[`integration-id`]))}`,pathParams:{"integration-id":String(e[`integration-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({config:{api_url:p(e[`config-api-url`],`config-api-url`,`text`),auth_url:p(e[`config-auth-url`],`config-auth-url`,`text`),client_id:p(e[`config-client-id`],`config-client-id`,`text`),client_secret:p(e[`config-client-secret`],`config-client-secret`,`text`),customer_id:p(e[`config-customer-id`],`config-customer-id`,`text`),client_key:p(e[`config-client-key`],`config-client-key`,`text`),access_client_id:p(e[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:p(e[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:p(e.interval,`interval`,`text`),name:p(e.name,`name`,`text`),type:p(e.type,`type`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.posture.integrations.edit({...t,account_id:i,integration_id:e[`integration-id`]})),{successLabel:`Updated`});return}let a=l({config:{api_url:p(e[`config-api-url`],`config-api-url`,`text`),auth_url:p(e[`config-auth-url`],`config-auth-url`,`text`),client_id:p(e[`config-client-id`],`config-client-id`,`text`),client_secret:p(e[`config-client-secret`],`config-client-secret`,`text`),customer_id:p(e[`config-customer-id`],`config-customer-id`,`text`),client_key:p(e[`config-client-key`],`config-client-key`,`text`),access_client_id:p(e[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:p(e[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:p(e.interval,`interval`,`text`),name:p(e.name,`name`,`text`),type:p(e.type,`type`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.devices.posture.integrations.edit({...a,account_id:i,integration_id:e[`integration-id`]})),{successLabel:`Updated`})}};function ms(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const hs={command:`get <integration-id>`,describe:`Fetches details for a single device posture integration.`,builder:ms,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices posture integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/posture/integration/${e[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(e[`integration-id`]))}`,pathParams:{"integration-id":String(e[`integration-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.posture.integrations.get({account_id:i,integration_id:e[`integration-id`]})),{successLabel:`Loaded`})}};function gs(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _s={command:`list`,describe:`Fetches the list of device posture integrations for an account.`,builder:gs,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices posture integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/posture/integration`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.posture.integrations.list({account_id:i})),{successLabel:`Loaded`})}},vs={command:`integrations`,describe:`Operations for devices.posture.integrations`,builder:e=>e.command(ls).command(ds).command(ps).command(hs).command(_s).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ys(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const bs={command:`list`,describe:`Fetches device posture rules for a Zero Trust account.`,builder:ys,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices posture list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/posture`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.posture.list({account_id:i})),{successLabel:`Loaded`})}};function xs(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`The description of the device posture rule.`}).option(`expiration`,{type:`string`,description:`Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.`}).option(`input-exists`,{type:`boolean`,description:`Whether or not file exists.`}).option(`input-operating-system`,{type:`string`,description:`Operating system.`,choices:[`windows`,`linux`,`mac`,`android`,`ios`,`chromeos`]}).option(`input-path`,{type:`string`,description:`File path.`}).option(`input-sha256`,{type:`string`,description:`SHA-256.`}).option(`input-thumbprint`,{type:`string`,description:`Signing certificate thumbprint.`}).option(`input-id`,{type:`string`,description:`List ID.`}).option(`input-domain`,{type:`string`,description:`Domain.`}).option(`input-operator`,{type:`string`,description:`Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-os-distro-name`,{type:`string`,description:`Operating System Distribution Name (linux only).`}).option(`input-os-distro-revision`,{type:`string`,description:`Version of OS Distribution (linux only).`}).option(`input-os-version-extra`,{type:`string`,description:`Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.`}).option(`input-version`,{type:`string`,description:`Version of OS.`}).option(`input-enabled`,{type:`boolean`,description:`Enabled.`}).option(`input-check-disks`,{type:`string`,array:!0,description:`List of volume names to be checked for encryption.`}).option(`input-require-all`,{type:`boolean`,description:`Whether to check all disks for encryption.`}).option(`input-certificate-id`,{type:`string`,description:`UUID of Cloudflare managed certificate.`}).option(`input-cn`,{type:`string`,description:`Common Name that is protected by the certificate.`}).option(`input-check-private-key`,{type:`boolean`,description:`Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.`}).option(`input-extended-key-usage`,{type:`string`,array:!0,description:`List of values indicating purposes for which the certificate public key can be used.`}).option(`input-locations-paths`,{type:`string`,array:!0,description:`List of paths to check for client certificate on linux.`}).option(`input-locations-trust-stores`,{type:`string`,array:!0,description:`List of trust stores to check for client certificate.`}).option(`input-subject-alternative-names`,{type:`string`,array:!0,description:`List of certificate Subject Alternative Names.`}).option(`input-update-window-days`,{type:`number`,description:`Number of days that the antivirus should be updated within.`}).option(`input-compliance-status`,{type:`string`,description:`Compliance Status.`,choices:[`compliant`,`noncompliant`,`unknown`,`notapplicable`,`ingraceperiod`,`error`]}).option(`input-connection-id`,{type:`string`,description:`Posture Integration ID.`}).option(`input-last-seen`,{type:`string`,description:`For more details on last seen, please refer to the Crowdstrike documentation.`}).option(`input-os`,{type:`string`,description:`Os Version.`}).option(`input-overall`,{type:`string`,description:`Overall.`}).option(`input-sensor-config`,{type:`string`,description:`SensorConfig.`}).option(`input-state`,{type:`string`,description:`For more details on state, please refer to the Crowdstrike documentation.`,choices:[`online`,`offline`,`unknown`]}).option(`input-version-operator`,{type:`string`,description:`Version Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-auth-state`,{type:`string`,array:!0,description:`The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.`}).option(`input-count-operator`,{type:`string`,description:`Count Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-issue-count`,{type:`string`,description:`The Number of Issues.`}).option(`input-eid-last-seen`,{type:`string`,description:`For more details on eid last seen, refer to the Tanium documentation.`}).option(`input-risk-level`,{type:`string`,description:`For more details on risk level, refer to the Tanium documentation.`,choices:[`low`,`medium`,`high`,`critical`]}).option(`input-score-operator`,{type:`string`,description:`Score Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-total-score`,{type:`number`,description:`For more details on total score, refer to the Tanium documentation.`}).option(`input-active-threats`,{type:`number`,description:`The Number of active threats.`}).option(`input-infected`,{type:`boolean`,description:`Whether device is infected.`}).option(`input-is-active`,{type:`boolean`,description:`Whether device is active.`}).option(`input-network-status`,{type:`string`,description:`Network status of device.`,choices:[`connected`,`disconnected`,`disconnecting`,`connecting`]}).option(`input-operational-state`,{type:`string`,description:`Agent operational state.`,choices:[`na`,`partially_disabled`,`auto_fully_disabled`,`fully_disabled`,`auto_partially_disabled`,`disabled_error`,`db_corruption`]}).option(`input-score`,{type:`number`,description:`A value between 0-100 assigned to devices set by the 3rd party posture provider.`}).option(`name`,{type:`string`,description:`The name of the device posture rule.`}).option(`schedule`,{type:`string`,description:"Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`."}).option(`type`,{type:`string`,description:`The type of device posture rule.`,choices:[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`input-exists`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operating-system`,`input-id.input-check-disks.input-require-all.input-certificate-id.input-cn.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-operator.input-os.input-overall.input-sensor-config.input-state.input-version.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-path`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sha256`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-thumbprint`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-id`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-domain`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operator`,[`input-exists`,`input-path`,`input-sha256`,`input-thumbprint`,`input-operating-system`,`input-id`,`input-domain`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`,`input-compliance-status`,`input-connection-id`,`input-auth-state`,`input-count-operator`,`input-issue-count`]).conflicts(`input-os-distro-name`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-distro-revision`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-version-extra`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-version`,[`input-operating-system`,`input-operator`]).conflicts(`input-enabled`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-enabled`,[`input-operating-system`]).conflicts(`input-check-disks`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-require-all`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-certificate-id`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-cn`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-cn`,[`input-certificate-id`]).conflicts(`input-check-private-key`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-check-private-key`,[`input-certificate-id`,`input-operating-system`]).conflicts(`input-extended-key-usage`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-paths`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-trust-stores`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-subject-alternative-names`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-update-window-days`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-compliance-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-connection-id`,[`input-exists`,`input-operating-system`,`input-path`,`input-sha256`,`input-thumbprint`,`input-id`,`input-domain`,`input-operator`,`input-os-distro-name`,`input-os-distro-revision`,`input-os-version-extra`,`input-version`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`]).conflicts(`input-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-overall`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sensor-config`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-auth-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-count-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-issue-count`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-eid-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-risk-level`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-score-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-total-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-active-threats`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-infected`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-is-active`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-network-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-operational-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state`.split(`.`)).implies(`input-score`,[`input-connection-id`,`input-operator`])}const Ss={command:`update <rule-id>`,describe:`Updates a device posture rule.`,builder:xs,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust devices posture update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/posture/${i[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(i[`rule-id`]))}`,pathParams:{"rule-id":String(i[`rule-id`]??``)},bodyKind:`json`,body:i.body===void 0?l({description:p(i.description,`description`,`text`),expiration:p(i.expiration,`expiration`,`text`),input:{exists:i[`input-exists`],operating_system:p(i[`input-operating-system`],`input-operating-system`,`text`),path:p(i[`input-path`],`input-path`,`text`),sha256:p(i[`input-sha256`],`input-sha256`,`text`),thumbprint:p(i[`input-thumbprint`],`input-thumbprint`,`text`),id:p(i[`input-id`],`input-id`,`text`),domain:p(i[`input-domain`],`input-domain`,`text`),operator:p(i[`input-operator`],`input-operator`,`text`),os_distro_name:p(i[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:p(i[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:p(i[`input-os-version-extra`],`input-os-version-extra`,`text`),version:p(i[`input-version`],`input-version`,`text`),enabled:i[`input-enabled`],checkDisks:i[`input-check-disks`],requireAll:i[`input-require-all`],certificate_id:p(i[`input-certificate-id`],`input-certificate-id`,`text`),cn:p(i[`input-cn`],`input-cn`,`text`),check_private_key:i[`input-check-private-key`],extended_key_usage:i[`input-extended-key-usage`],locations:{paths:i[`input-locations-paths`],trust_stores:i[`input-locations-trust-stores`]},subject_alternative_names:i[`input-subject-alternative-names`],update_window_days:i[`input-update-window-days`],compliance_status:p(i[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:p(i[`input-connection-id`],`input-connection-id`,`text`),last_seen:p(i[`input-last-seen`],`input-last-seen`,`text`),os:p(i[`input-os`],`input-os`,`text`),overall:p(i[`input-overall`],`input-overall`,`text`),sensor_config:p(i[`input-sensor-config`],`input-sensor-config`,`text`),state:p(i[`input-state`],`input-state`,`text`),versionOperator:p(i[`input-version-operator`],`input-version-operator`,`text`),auth_state:i[`input-auth-state`],countOperator:p(i[`input-count-operator`],`input-count-operator`,`text`),issue_count:p(i[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:p(i[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:p(i[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:p(i[`input-score-operator`],`input-score-operator`,`text`),total_score:i[`input-total-score`],active_threats:i[`input-active-threats`],infected:i[`input-infected`],is_active:i[`input-is-active`],network_status:p(i[`input-network-status`],`input-network-status`,`text`),operational_state:p(i[`input-operational-state`],`input-operational-state`,`text`),score:i[`input-score`]},name:p(i.name,`name`,`text`),schedule:p(i.schedule,`schedule`,`text`),type:p(i.type,`type`,`text`)}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Updating`,async()=>a.zeroTrust.devices.posture.update({...e,account_id:o,rule_id:i[`rule-id`]})),{successLabel:`Updated`});return}i.name===void 0&&(i.name=await e(`name`,`The name of the device posture rule.`)),i.type===void 0&&(i.type=await n(`type`,`The type of device posture rule.`,[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]));let m=l({description:p(i.description,`description`,`text`),expiration:p(i.expiration,`expiration`,`text`),input:{exists:i[`input-exists`],operating_system:p(i[`input-operating-system`],`input-operating-system`,`text`),path:p(i[`input-path`],`input-path`,`text`),sha256:p(i[`input-sha256`],`input-sha256`,`text`),thumbprint:p(i[`input-thumbprint`],`input-thumbprint`,`text`),id:p(i[`input-id`],`input-id`,`text`),domain:p(i[`input-domain`],`input-domain`,`text`),operator:p(i[`input-operator`],`input-operator`,`text`),os_distro_name:p(i[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:p(i[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:p(i[`input-os-version-extra`],`input-os-version-extra`,`text`),version:p(i[`input-version`],`input-version`,`text`),enabled:i[`input-enabled`],checkDisks:i[`input-check-disks`],requireAll:i[`input-require-all`],certificate_id:p(i[`input-certificate-id`],`input-certificate-id`,`text`),cn:p(i[`input-cn`],`input-cn`,`text`),check_private_key:i[`input-check-private-key`],extended_key_usage:i[`input-extended-key-usage`],locations:{paths:i[`input-locations-paths`],trust_stores:i[`input-locations-trust-stores`]},subject_alternative_names:i[`input-subject-alternative-names`],update_window_days:i[`input-update-window-days`],compliance_status:p(i[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:p(i[`input-connection-id`],`input-connection-id`,`text`),last_seen:p(i[`input-last-seen`],`input-last-seen`,`text`),os:p(i[`input-os`],`input-os`,`text`),overall:p(i[`input-overall`],`input-overall`,`text`),sensor_config:p(i[`input-sensor-config`],`input-sensor-config`,`text`),state:p(i[`input-state`],`input-state`,`text`),versionOperator:p(i[`input-version-operator`],`input-version-operator`,`text`),auth_state:i[`input-auth-state`],countOperator:p(i[`input-count-operator`],`input-count-operator`,`text`),issue_count:p(i[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:p(i[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:p(i[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:p(i[`input-score-operator`],`input-score-operator`,`text`),total_score:i[`input-total-score`],active_threats:i[`input-active-threats`],infected:i[`input-infected`],is_active:i[`input-is-active`],network_status:p(i[`input-network-status`],`input-network-status`,`text`),operational_state:p(i[`input-operational-state`],`input-operational-state`,`text`),score:i[`input-score`]},name:p(i.name,`name`,`text`),schedule:p(i.schedule,`schedule`,`text`),type:p(i.type,`type`,`text`)});u(await f(`Updating`,async()=>a.zeroTrust.devices.posture.update({...m,account_id:o,rule_id:i[`rule-id`]})),{successLabel:`Updated`})}},Cs={command:`posture`,describe:`Operations for devices.posture`,builder:e=>e.command(rs).command(as).command(ss).command(bs).command(Ss).command(vs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ws(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ts={command:`bulk-delete`,describe:`Deletes a list of WARP registrations.`,builder:ws,handler:async e=>{let n={id:e.id};if(e.dryRun){d({command:`cf zero-trust devices registrations bulk-delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/registrations`,pathParams:{},query:n,bodyKind:`none`});return}let a=await s(e),o=e.local?h:await r(a);if(e.accountId=o,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>a.zeroTrust.devices.registrations.bulkDelete({account_id:o,...n})),{successLabel:`Deleted`})}};function Es(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ds={command:`delete <registration-id>`,describe:`Deletes a WARP registration.`,builder:Es,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices registrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/registrations/${e[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(e[`registration-id`]))}`,pathParams:{"registration-id":String(e[`registration-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.registrations.delete({account_id:a,registration_id:e[`registration-id`]})),{successLabel:`Deleted`})}};function Os(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the registration response. Supported values are: "policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ks={command:`get <registration-id>`,describe:`Fetches a single WARP registration.`,builder:Os,handler:async e=>{let n={include:e.include};if(e.dryRun){d({command:`cf zero-trust devices registrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/registrations/${e[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(e[`registration-id`]))}`,pathParams:{"registration-id":String(e[`registration-id`]??``)},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.devices.registrations.get({account_id:a,registration_id:e[`registration-id`],...n})),{successLabel:`Loaded`})}};function As(e){return e.option(`user-id`,{type:`string`,description:`Filter by user ID.`}).option(`seen-after`,{type:`string`,description:`Filter by the last_seen timestamp - returns only registrations last seen after this timestamp.`}).option(`seen-before`,{type:`string`,description:`Filter by the last_seen timestamp - returns only registrations last seen before this timestamp.`}).option(`status`,{type:`string`,description:`Filter by registration status. Defaults to 'active'.`,choices:[`active`,`all`,`revoked`]}).option(`per-page`,{type:`number`,description:`The maximum number of devices to return in a single response.`}).option(`search`,{type:`string`,description:`Filter by registration details.`}).option(`sort-by`,{type:`string`,description:`The registration field to order results by.`,choices:[`id`,`user.name`,`user.email`,`last_seen_at`,`created_at`]}).option(`sort-order`,{type:`string`,description:`Sort direction.`,choices:[`asc`,`desc`]}).option(`cursor`,{type:`string`,description:`Opaque token indicating the starting position when requesting the next set of records. A cursor value can be obtained from the result_info.cursor field in the response.`}).option(`id`,{type:`string`,description:`Filter by registration ID.`}).option(`device-id`,{type:`string`,description:`Filter by WARP device ID.`}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the registration response. Supported values are: "policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const js={command:`list`,describe:`Lists WARP registrations.`,builder:g(As),handler:async e=>{let n={"user.id":e[`user-id`],seen_after:e[`seen-after`],seen_before:e[`seen-before`],status:e.status,per_page:e[`per-page`],search:e.search,sort_by:e[`sort-by`],sort_order:e[`sort-order`],cursor:e.cursor,id:e.id,"device.id":e[`device-id`],include:e.include};if(e.dryRun){d({command:`cf zero-trust devices registrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/registrations`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.devices.registrations.list({account_id:a,...n})),{successLabel:`Loaded`})}};function Ms(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to revoke.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ns={command:`revoke`,describe:`Revokes a list of WARP registrations.`,builder:Ms,handler:async e=>{let n={id:e.id};if(e.dryRun){d({command:`cf zero-trust devices registrations revoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/registrations/revoke`,pathParams:{},query:n,bodyKind:`none`});return}let a=await s(e),o=e.local?h:await r(a);if(e.accountId=o,!await i({force:!!e.force,message:`This operation revokes device registrations destructively.`})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>a.zeroTrust.devices.registrations.revoke({account_id:o,...n})),{successLabel:`Deleted`})}};function Ps(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to unrevoke.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fs={command:`unrevoke`,describe:`Unrevokes a list of WARP registrations.`,builder:Ps,handler:async e=>{let n={id:e.id};if(e.dryRun){d({command:`cf zero-trust devices registrations unrevoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/registrations/unrevoke`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Creating`,async()=>i.zeroTrust.devices.registrations.unrevoke({account_id:a,...n})),{successLabel:`Created`})}},Is={command:`registrations`,describe:`Operations for devices.registrations`,builder:e=>e.command(Ts).command(Ds).command(ks).command(js).command(Ns).command(Fs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ls(e){return e.option(`disconnect`,{type:`boolean`,description:`Disconnects all devices on the account using Global WARP override.`}).option(`justification`,{type:`string`,description:`Reasoning for setting the Global WARP override state. This will be surfaced in the audit log.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Rs={command:`create`,describe:`Sets the Global WARP override state.`,builder:Ls,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices resilience global-warp-override create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/resilience/disconnect`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({disconnect:e.disconnect,justification:p(e.justification,`justification`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.devices.resilience.globalWarpOverride.create({...t,account_id:i})),{successLabel:`Created`});return}if(e.disconnect===void 0)throw Error(`--disconnect is required (or pass --body with this field set).`);let a=l({disconnect:e.disconnect,justification:p(e.justification,`justification`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.devices.resilience.globalWarpOverride.create({...a,account_id:i})),{successLabel:`Created`})}};function zs(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bs={command:`get`,describe:`Fetch the Global WARP override state.`,builder:zs,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices resilience global-warp-override get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/resilience/disconnect`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.resilience.globalWarpOverride.get({account_id:i})),{successLabel:`Loaded`})}},Vs={command:`global-warp-override`,describe:`Operations for devices.resilience.global-warp-override`,builder:e=>e.command(Rs).command(Bs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Hs={command:`resilience`,describe:`Operations for devices.resilience`,builder:e=>e.command(Vs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Us(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`A list of Registration IDs to revoke.`})}const Ws={command:`create`,describe:`Revokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/revoke instead.`,builder:Us,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices revoke create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/revoke`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force,message:`This operation revokes sessions for a batch of devices destructively.`})){process.stderr.write(`Aborted.
+`);return}if(e.body){let t=c(e.body);u(await f(`Deleting`,async()=>n.zeroTrust.devices.revoke.create({body:t,account_id:a})),{successLabel:`Deleted`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Gs={command:`revoke`,describe:`Operations for devices.revoke`,builder:e=>e.command(Ws).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ks(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const qs={command:`delete`,describe:`Resets the current device settings for a Zero Trust account.`,builder:Ks,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices settings delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.devices.settings.delete({account_id:a})),{successLabel:`Deleted`})}};function Js(e){return e.option(`disable-for-time`,{type:`number`,description:`Sets the time limit, in seconds, that a user can use an override code to bypass WARP.`}).option(`external-emergency-signal-enabled`,{type:`boolean`,description:`Controls whether the external emergency disconnect feature is enabled.`}).option(`external-emergency-signal-fingerprint`,{type:`string`,description:`The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.`}).option(`external-emergency-signal-interval`,{type:`string`,description:`The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.`}).option(`external-emergency-signal-url`,{type:`string`,description:`The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.`}).option(`gateway-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on TCP.`}).option(`gateway-udp-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on UDP.`}).option(`root-certificate-installation-enabled`,{type:`boolean`,description:`Enable installation of cloudflare managed root certificate.`}).option(`use-zt-virtual-ip`,{type:`boolean`,description:`Enable using CGNAT virtual IPv4.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ys={command:`edit`,describe:`Patches the current device settings for a Zero Trust account.`,builder:Js,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({disable_for_time:e[`disable-for-time`],external_emergency_signal_enabled:e[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:p(e[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:p(e[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:p(e[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:e[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:e[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:e[`root-certificate-installation-enabled`],use_zt_virtual_ip:e[`use-zt-virtual-ip`]}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.settings.edit({body:t,account_id:i})),{successLabel:`Updated`});return}let a=l({disable_for_time:e[`disable-for-time`],external_emergency_signal_enabled:e[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:p(e[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:p(e[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:p(e[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:e[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:e[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:e[`root-certificate-installation-enabled`],use_zt_virtual_ip:e[`use-zt-virtual-ip`]});u(await f(`Updating`,async()=>n.zeroTrust.devices.settings.edit({body:a,account_id:i})),{successLabel:`Updated`})}};function Xs(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zs={command:`get`,describe:`Describes the current device settings for a Zero Trust account.`,builder:Xs,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.devices.settings.get({account_id:i})),{successLabel:`Loaded`})}};function Qs(e){return e.option(`disable-for-time`,{type:`number`,description:`Sets the time limit, in seconds, that a user can use an override code to bypass WARP.`}).option(`external-emergency-signal-enabled`,{type:`boolean`,description:`Controls whether the external emergency disconnect feature is enabled.`}).option(`external-emergency-signal-fingerprint`,{type:`string`,description:`The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.`}).option(`external-emergency-signal-interval`,{type:`string`,description:`The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.`}).option(`external-emergency-signal-url`,{type:`string`,description:`The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.`}).option(`gateway-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on TCP.`}).option(`gateway-udp-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on UDP.`}).option(`root-certificate-installation-enabled`,{type:`boolean`,description:`Enable installation of cloudflare managed root certificate.`}).option(`use-zt-virtual-ip`,{type:`boolean`,description:`Enable using CGNAT virtual IPv4.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const $s={command:`update`,describe:`Updates the current device settings for a Zero Trust account.`,builder:Qs,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({disable_for_time:e[`disable-for-time`],external_emergency_signal_enabled:e[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:p(e[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:p(e[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:p(e[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:e[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:e[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:e[`root-certificate-installation-enabled`],use_zt_virtual_ip:e[`use-zt-virtual-ip`]}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.devices.settings.update({body:t,account_id:i})),{successLabel:`Updated`});return}let a=l({disable_for_time:e[`disable-for-time`],external_emergency_signal_enabled:e[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:p(e[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:p(e[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:p(e[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:e[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:e[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:e[`root-certificate-installation-enabled`],use_zt_virtual_ip:e[`use-zt-virtual-ip`]});u(await f(`Updating`,async()=>n.zeroTrust.devices.settings.update({body:a,account_id:i})),{successLabel:`Updated`})}},ec={command:`settings`,describe:`Operations for devices.settings`,builder:e=>e.command(qs).command(Ys).command(Zs).command($s).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function tc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A list of Registration IDs to unrevoke.`})}const nc={command:`create`,describe:`Unrevokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/unrevoke instead.`,builder:tc,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust devices unrevoke create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/devices/unrevoke`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.devices.unrevoke.create({body:t,account_id:i})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},rc={command:`unrevoke`,describe:`Operations for devices.unrevoke`,builder:e=>e.command(nc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ic={command:`devices`,describe:`Operations for devices`,builder:e=>e.command(va).command(ja).command(ia).command(ga).command(ka).command(Ha).command(qa).command(no).command(ts).command(Cs).command(Is).command(Hs).command(Gs).command(ec).command(rc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ac(e){return e.option(`from`,{type:`string`,description:`Start time for connection period in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for connection period in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`sort-by`,{type:`string`,description:`Type of usage that colos should be sorted by. If unspecified, returns all Cloudflare colos sorted alphabetically.`,choices:[`fleet-status-usage`,`application-tests-usage`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const oc={command:`list`,describe:`List Cloudflare colos that account's devices were connected to during a time period, sorted by usage starting from the most used colo. Colos without traffic are also returned and sorted alphabetically.`,builder:g(ac),handler:async e=>{let n={from:e.from,to:e.to,sortBy:e[`sort-by`]};if(e.dryRun){d({command:`cf zero-trust dex colos list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/colos`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.colos.list({account_id:a,...n})),{successLabel:`Loaded`})}},sc={command:`colos`,describe:`Operations for dex.colos`,builder:e=>e.command(oc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const lc={command:`create`,describe:`Initiate commands for up to 10 devices per account.`,builder:cc,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dex commands create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/commands`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.dex.commands.create({...t,account_id:i})),{successLabel:`Created`});return}u(await f(`Creating`,async()=>o(n,`POST`,`/accounts/${i}/dex/commands`)),{successLabel:`Created`})}};function uc(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`search`,{type:`string`,description:`Filter devices by name or email.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dc={command:`list`,describe:`List devices with WARP client support for remote captures which have been connected in the last 1 hour.`,builder:uc,handler:async e=>{let n={page:e.page,per_page:e[`per-page`],search:e.search};if(e.dryRun){d({command:`cf zero-trust dex commands eligible-devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/commands/devices`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.commands.eligibleDevices.list({account_id:a,...n})),{successLabel:`Loaded`})}},fc={command:`eligible-devices`,describe:`Operations for dex.commands.eligible-devices`,builder:e=>e.command(dc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pc(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`}).option(`device-id`,{type:`string`,description:`Unique identifier for a device.`}).option(`user-email`,{type:`string`,description:`Email tied to the device.`}).option(`command-type`,{type:`string`,description:`Optionally filter executed commands by command type.`,choices:[`pcap`,`speed-test`,`warp-diag`]}).option(`status`,{type:`string`,description:`Optionally filter executed commands by status.`,choices:[`PENDING_EXEC`,`PENDING_UPLOAD`,`SUCCESS`,`FAILED`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const mc={command:`list`,describe:`Retrieves a paginated list of commands issued to devices under the specified account, optionally filtered by time range, device, or other parameters`,builder:g(pc),handler:async e=>{let n={page:e.page,per_page:e[`per-page`],from:e.from,to:e.to,device_id:e[`device-id`],user_email:e[`user-email`],command_type:e[`command-type`],status:e.status};if(e.dryRun){d({command:`cf zero-trust dex commands list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/commands`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.commands.list({account_id:a,...n})),{successLabel:`Loaded`})}};function hc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gc={command:`get`,describe:`Retrieves the current quota usage and limits for device commands within a specific account, including the time when the quota will reset`,builder:hc,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dex commands quota get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/commands/quota`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.dex.commands.quota.get({account_id:i})),{successLabel:`Loaded`})}},_c={command:`quota`,describe:`Operations for dex.commands.quota`,builder:e=>e.command(gc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function vc(e){return e.positional(`filename`,{type:`string`,description:"The name of the file to be downloaded, including the `.zip` extension.",demandOption:!0}).option(`command-id`,{type:`string`,description:`Unique identifier for command.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`text`,{type:`boolean`,description:`Decode the response body as UTF-8 text instead of writing raw bytes`,default:!1})}const yc={command:`get <filename>`,describe:`Downloads artifacts for an executed command. Bulk downloads are not supported`,builder:vc,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dex commands results get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/commands/${e[`command-id`]==null?`<command-id>`:encodeURIComponent(String(e[`command-id`]))}/downloads/${e.filename==null?`<filename>`:encodeURIComponent(String(e.filename))}`,pathParams:{"command-id":String(e[`command-id`]??``),filename:String(e.filename??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i;let a=await f(`Loading`,async()=>te(`/accounts/${i}/dex/commands/${encodeURIComponent(String(e[`command-id`]))}/downloads/${encodeURIComponent(String(e.filename))}`,{method:`GET`,localEndpoint:e.local?e.localEndpoint:void 0}));ee(e.text===!0?a.toString(`utf-8`):a)}},bc={command:`results`,describe:`Operations for dex.commands.results`,builder:e=>e.command(yc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},xc={command:`commands`,describe:`Operations for dex.commands`,builder:e=>e.command(lc).command(mc).command(fc).command(_c).command(bc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Sc(e){return e.option(`since-minutes`,{type:`number`,description:`Number of minutes before current time.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cc={command:`get`,describe:`Get details for live (up to 60 minutes) devices using WARP.`,builder:Sc,handler:async e=>{let n={since_minutes:e[`since-minutes`]};if(e.dryRun){d({command:`cf zero-trust dex devices aggregates live get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/fleet-status/live`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.devices.aggregates.live.get({account_id:a,...n})),{successLabel:`Loaded`})}},wc={command:`live`,describe:`Operations for dex.devices.aggregates.live`,builder:e=>e.command(Cc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Tc(e){return e.option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Cloudflare colo airport code.`}).option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ec={command:`get`,describe:`Get aggregate details for devices using WARP, up to 7 days.`,builder:Tc,handler:async e=>{let n={to:e.to,from:e.from,colo:e.colo,device_id:e[`device-id`]};if(e.dryRun){d({command:`cf zero-trust dex devices aggregates over-time get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/fleet-status/over-time`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.devices.aggregates.overTime.get({account_id:a,...n})),{successLabel:`Loaded`})}},Dc={command:`over-time`,describe:`Operations for dex.devices.aggregates.over-time`,builder:e=>e.command(Ec).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Oc={command:`aggregates`,describe:`Operations for dex.devices.aggregates`,builder:e=>e.command(wc).command(Dc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function kc(e){return e.positional(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`since-minutes`,{type:`number`,description:`Number of minutes before current time.`,demandOption:!0}).option(`time-now`,{type:`string`,description:`Current time in ISO format.`}).option(`colo`,{type:`string`,description:`List of data centers to filter results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ac={command:`get <device-id>`,describe:`Get the latest status of a device given device_id from the device_state table.`,builder:kc,handler:async e=>{let n={since_minutes:e[`since-minutes`],time_now:e[`time-now`],colo:e.colo};if(e.dryRun){d({command:`cf zero-trust dex devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}/fleet-status/live`,pathParams:{"device-id":String(e[`device-id`]??``)},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.devices.get({account_id:a,device_id:e[`device-id`],...n})),{successLabel:`Loaded`})}};function jc(e){return e.option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`sort-by`,{type:`string`,description:`Dimension to sort results by.`,choices:[`colo`,`device_id`,`mode`,`platform`,`status`,`timestamp`,`version`]}).option(`colo`,{type:`string`,description:`Cloudflare colo airport code.`}).option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`}).option(`mode`,{type:`string`,description:`The mode under which the WARP client is run.`}).option(`status`,{type:`string`,description:`Network status.`}).option(`platform`,{type:`string`,description:`Operating system.`}).option(`version`,{type:`string`,description:`WARP client version.`}).option(`source`,{type:`string`,description:"Source:\n  * `hourly` - device details aggregated hourly, up to 7 days prior\n  * `last_seen` - device details, up to 60 minutes prior. Time windows exceeding 60 minutes will be rejected from June 1st, 2026. Please use 'hourly' or 'raw' instead for longer time ranges.\n  * `raw` - device details, up to 7 days prior",choices:[`last_seen`,`hourly`,`raw`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Mc={command:`list`,describe:`List details of devices using WARP.`,builder:g(jc),handler:async e=>{let n={to:e.to,from:e.from,page:e.page,per_page:e[`per-page`],sort_by:e[`sort-by`],colo:e.colo,device_id:e[`device-id`],mode:e.mode,status:e.status,platform:e.platform,version:e.version,source:e.source};if(e.dryRun){d({command:`cf zero-trust dex devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/fleet-status/devices`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.devices.list({account_id:a,...n})),{successLabel:`Loaded`})}};function Nc(e){return e.positional(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`List of data centers to filter results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pc={command:`get <device-id>`,describe:`Get time-bucketed status metrics for a specific device.`,builder:g(Nc),handler:async e=>{let n={from:e.from,to:e.to,interval:e.interval,colo:e.colo};if(e.dryRun){d({command:`cf zero-trust dex devices over-time get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}/fleet-status/over-time`,pathParams:{"device-id":String(e[`device-id`]??``)},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.devices.overTime.get({account_id:a,device_id:e[`device-id`],...n})),{successLabel:`Loaded`})}},Fc={command:`over-time`,describe:`Operations for dex.devices.over-time`,builder:e=>e.command(Pc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ic={command:`devices`,describe:`Operations for dex.devices`,builder:e=>e.command(Ac).command(Mc).command(Oc).command(Fc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Lc(e){return e.option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of paginated results. Mutually exclusive with cursor.`}).option(`per-page`,{type:`number`,description:`Number of items per page`,demandOption:!0}).option(`cursor`,{type:`string`,description:`Cursor for cursor-based pagination. Mutually exclusive with page.`}).option(`sort-by`,{type:`string`,description:`The field to sort results by.`,choices:[`time_start`]}).option(`sort-order`,{type:`string`,description:`The order to sort results.`,choices:[`ASC`,`DESC`]}).option(`from`,{type:`string`,description:`Start time for the query in ISO 8601 format.`}).option(`to`,{type:`string`,description:`End time for the query in ISO 8601 format.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Rc={command:`list`,describe:`List ISP information observed for a specific device during traceroute tests.`,builder:g(Lc),handler:async e=>{let n={page:e.page,per_page:e[`per-page`],cursor:e.cursor,sort_by:e[`sort-by`],sort_order:e[`sort-order`],from:e.from,to:e.to};if(e.dryRun){d({command:`cf zero-trust dex isps list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}/isps`,pathParams:{"device-id":String(e[`device-id`]??``)},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.isps.list({account_id:a,device_id:e[`device-id`],...n})),{successLabel:`Loaded`})}},zc={command:`isps`,describe:`Operations for dex.isps`,builder:e=>e.command(Rc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bc(e){return e.option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`test-name`,{type:`string`,description:`Optionally filter results by test name.`}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`registration-id`,{type:`string`,description:`Optionally filter results to a specific device registration. Must be used in combination with a single deviceId.`}).option(`page`,{type:`number`,description:`Page number of paginated results`}).option(`per-page`,{type:`number`,description:`Number of items per page`}).option(`kind`,{type:`string`,description:`Filter by test type.`,choices:[`http`,`traceroute`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vc={command:`list`,describe:`List DEX tests with overview metrics.`,builder:g(Bc),handler:async e=>{let n={colo:e.colo,testName:e[`test-name`],deviceId:e[`device-id`],registration_id:e[`registration-id`],page:e.page,per_page:e[`per-page`],kind:e.kind};if(e.dryRun){d({command:`cf zero-trust dex overview tests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/tests/overview`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.overview.tests.list({account_id:a,...n})),{successLabel:`Loaded`})}};function Hc(e){return e.option(`test-name`,{type:`string`,description:`Optionally filter results by test name.`}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Uc={command:`get`,describe:`Returns unique count of devices that have run synthetic application monitoring tests in the past 7 days.`,builder:Hc,handler:async e=>{let n={testName:e[`test-name`],deviceId:e[`device-id`]};if(e.dryRun){d({command:`cf zero-trust dex overview tests unique-devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/tests/unique-devices`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.overview.tests.uniqueDevices.get({account_id:a,...n})),{successLabel:`Loaded`})}},Wc={command:`unique-devices`,describe:`Operations for dex.overview.tests.unique-devices`,builder:e=>e.command(Uc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Gc={command:`tests`,describe:`Operations for dex.overview.tests`,builder:e=>e.command(Vc).command(Wc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Kc={command:`overview`,describe:`Operations for dex.overview`,builder:e=>e.command(Gc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function qc(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`match`,{type:`string`,description:`The wirefilter expression to match.`}).option(`name`,{type:`string`,description:`The name of the Rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Jc={command:`create`,describe:`Create a DEX Rule.`,builder:qc,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dex rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/rules`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({description:p(n.description,`description`,`text`),match:p(n.match,`match`,`text`),name:p(n.name,`name`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.dex.rules.create({...e,account_id:a})),{successLabel:`Created`});return}n.match===void 0&&(n.match=await e(`match`,`The wirefilter expression to match.`)),n.name===void 0&&(n.name=await e(`name`,`The name of the Rule.`));let o=l({description:p(n.description,`description`,`text`),match:p(n.match,`match`,`text`),name:p(n.name,`name`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.dex.rules.create({...o,account_id:a})),{successLabel:`Created`})}};function Yc(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Xc={command:`delete <rule-id>`,describe:`Delete a DEX Rule.`,builder:Yc,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dex rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dex.rules.delete({account_id:a,rule_id:e[`rule-id`]})),{successLabel:`Deleted`})}};function Zc(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qc={command:`get <rule-id>`,describe:`Get details for a DEX Rule.`,builder:Zc,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dex rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.dex.rules.get({account_id:i,rule_id:e[`rule-id`]})),{successLabel:`Loaded`})}};function $c(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`sort-order`,{type:`string`,description:`Sort direction for sort_by property.`,choices:[`ASC`,`DESC`]}).option(`sort-by`,{type:`string`,description:`Which property to sort results by.`,choices:[`name`,`created_at`,`updated_at`]}).option(`name`,{type:`string`,description:`Filter results by rule name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const el={command:`list`,describe:`List DEX Rules.`,builder:g($c),handler:async e=>{let n={page:e.page,per_page:e[`per-page`],sort_order:e[`sort-order`],sort_by:e[`sort-by`],name:e.name};if(e.dryRun){d({command:`cf zero-trust dex rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/rules`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.rules.list({account_id:a,...n})),{successLabel:`Loaded`})}};function tl(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`match`,{type:`string`,description:`The wirefilter expression to match.`}).option(`name`,{type:`string`,description:`The name of the Rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const nl={command:`update <rule-id>`,describe:`Update a DEX Rule.`,builder:tl,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dex rules update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({description:p(e.description,`description`,`text`),match:p(e.match,`match`,`text`),name:p(e.name,`name`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.dex.rules.update({...t,account_id:i,rule_id:e[`rule-id`]})),{successLabel:`Updated`});return}let a=l({description:p(e.description,`description`,`text`),match:p(e.match,`match`,`text`),name:p(e.name,`name`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.dex.rules.update({...a,account_id:i,rule_id:e[`rule-id`]})),{successLabel:`Updated`})}},rl={command:`rules`,describe:`Operations for dex.rules`,builder:e=>e.command(Jc).command(Xc).command(Qc).command(el).command(nl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function il(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const al={command:`get <test-id>`,describe:`Get test details and aggregate performance metrics for an http test for a given time period between 1 hour and 7 days.`,builder:g(il),handler:async e=>{let n={deviceId:e[`device-id`],from:e.from,to:e.to,interval:e.interval,colo:e.colo};if(e.dryRun){d({command:`cf zero-trust dex test-results http get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/http-tests/${e[`test-id`]==null?`<test-id>`:encodeURIComponent(String(e[`test-id`]))}`,pathParams:{"test-id":String(e[`test-id`]??``)},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.testResults.http.get({account_id:a,test_id:e[`test-id`],...n})),{successLabel:`Loaded`})}};function ol(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sl={command:`get <test-id>`,describe:`Get percentiles for an http test for a given time period between 1 hour and 7 days.`,builder:ol,handler:async e=>{let n={deviceId:e[`device-id`],from:e.from,to:e.to,colo:e.colo};if(e.dryRun){d({command:`cf zero-trust dex test-results http percentiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/http-tests/${e[`test-id`]==null?`<test-id>`:encodeURIComponent(String(e[`test-id`]))}/percentiles`,pathParams:{"test-id":String(e[`test-id`]??``)},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.testResults.http.percentiles.get({account_id:a,test_id:e[`test-id`],...n})),{successLabel:`Loaded`})}},cl={command:`percentiles`,describe:`Operations for dex.test-results.http.percentiles`,builder:e=>e.command(sl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ll={command:`http`,describe:`Operations for dex.test-results.http`,builder:e=>e.command(al).command(cl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ul(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dl={command:`get <test-id>`,describe:`Get test details and aggregate performance metrics for a traceroute test for a given time period between 1 hour and 7 days.`,builder:g(ul),handler:async e=>{let n={deviceId:e[`device-id`],from:e.from,to:e.to,interval:e.interval,colo:e.colo};if(e.dryRun){d({command:`cf zero-trust dex test-results traceroute get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/traceroute-tests/${e[`test-id`]==null?`<test-id>`:encodeURIComponent(String(e[`test-id`]))}`,pathParams:{"test-id":String(e[`test-id`]??``)},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.testResults.traceroute.get({account_id:a,test_id:e[`test-id`],...n})),{successLabel:`Loaded`})}};function fl(e){return e.positional(`test-result-id`,{type:`string`,description:`Unique identifier for a specific traceroute test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pl={command:`get <test-result-id>`,describe:`Get a breakdown of hops and performance metrics for a specific traceroute test run`,builder:fl,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dex test-results traceroute network-path get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/traceroute-test-results/${e[`test-result-id`]==null?`<test-result-id>`:encodeURIComponent(String(e[`test-result-id`]))}/network-path`,pathParams:{"test-result-id":String(e[`test-result-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.dex.testResults.traceroute.networkPath.get({account_id:i,test_result_id:e[`test-result-id`]})),{successLabel:`Loaded`})}},ml={command:`network-path`,describe:`Operations for dex.test-results.traceroute.network-path`,builder:e=>e.command(pl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function hl(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gl={command:`get <test-id>`,describe:`Get percentiles for a traceroute test for a given time period between 1 hour and 7 days.`,builder:hl,handler:async e=>{let n={deviceId:e[`device-id`],from:e.from,to:e.to,colo:e.colo};if(e.dryRun){d({command:`cf zero-trust dex test-results traceroute percentiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/traceroute-tests/${e[`test-id`]==null?`<test-id>`:encodeURIComponent(String(e[`test-id`]))}/percentiles`,pathParams:{"test-id":String(e[`test-id`]??``)},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.testResults.traceroute.percentiles.get({account_id:a,test_id:e[`test-id`],...n})),{successLabel:`Loaded`})}},_l={command:`percentiles`,describe:`Operations for dex.test-results.traceroute.percentiles`,builder:e=>e.command(gl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},vl={command:`traceroute`,describe:`Operations for dex.test-results.traceroute`,builder:e=>e.command(dl).command(ml).command(_l).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},yl={command:`test-results`,describe:`Operations for dex.test-results`,builder:e=>e.command(ll).command(vl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bl(e){return e.option(`data-host`,{type:`string`,description:`The desired endpoint to test.`}).option(`data-kind`,{type:`string`,description:`The type of test.`,choices:[`http`,`traceroute`]}).option(`data-method`,{type:`string`,description:`The HTTP request method type.`,choices:[`GET`]}).option(`description`,{type:`string`,description:`Additional details about the test.`}).option(`enabled`,{type:`boolean`,description:`Determines whether or not the test is active.`}).option(`interval`,{type:`string`,description:`How often the test will run.`}).option(`name`,{type:`string`,description:`The name of the DEX test. Must be unique.`}).option(`targeted`,{type:`boolean`,description:`The targeted field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xl={command:`create`,describe:`Create a DEX test.`,builder:bl,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust dex tests create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/devices/dex_tests`,pathParams:{},bodyKind:`json`,body:i.body===void 0?l({data:{host:p(i[`data-host`],`data-host`,`text`),kind:p(i[`data-kind`],`data-kind`,`text`),method:p(i[`data-method`],`data-method`,`text`)},description:p(i.description,`description`,`text`),enabled:i.enabled,interval:p(i.interval,`interval`,`text`),name:p(i.name,`name`,`text`),targeted:i.targeted}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Creating`,async()=>a.zeroTrust.dex.tests.create({body:e,account_id:o})),{successLabel:`Created`});return}if(i[`data-host`]===void 0&&(i[`data-host`]=await e(`data-host`,`The desired endpoint to test.`)),i[`data-kind`]===void 0&&(i[`data-kind`]=await n(`data-kind`,`The type of test.`,[`http`,`traceroute`])),i.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);i.interval===void 0&&(i.interval=await e(`interval`,`How often the test will run.`)),i.name===void 0&&(i.name=await e(`name`,`The name of the DEX test. Must be unique.`));let m=l({data:{host:p(i[`data-host`],`data-host`,`text`),kind:p(i[`data-kind`],`data-kind`,`text`),method:p(i[`data-method`],`data-method`,`text`)},description:p(i.description,`description`,`text`),enabled:i.enabled,interval:p(i.interval,`interval`,`text`),name:p(i.name,`name`,`text`),targeted:i.targeted});u(await f(`Creating`,async()=>a.zeroTrust.dex.tests.create({body:m,account_id:o})),{successLabel:`Created`})}};function Sl(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Cl={command:`delete <dex-test-id>`,describe:`Delete a Device DEX test. Returns the remaining device dex tests for the account.`,builder:Sl,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dex tests delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/devices/dex_tests/${e[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(e[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(e[`dex-test-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dex.tests.delete({account_id:a,dex_test_id:e[`dex-test-id`]})),{successLabel:`Deleted`})}};function wl(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Tl={command:`get <dex-test-id>`,describe:`Fetch a single DEX test.`,builder:wl,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dex tests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/devices/dex_tests/${e[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(e[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(e[`dex-test-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.dex.tests.get({account_id:i,dex_test_id:e[`dex-test-id`]})),{successLabel:`Loaded`})}};function El(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`test-name`,{type:`string`,description:`Filter by test name.`}).option(`kind`,{type:`string`,description:`Filter by test type.`,choices:[`http`,`traceroute`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dl={command:`list`,describe:`Fetch all DEX tests.`,builder:g(El),handler:async e=>{let n={page:e.page,per_page:e[`per-page`],testName:e[`test-name`],kind:e.kind};if(e.dryRun){d({command:`cf zero-trust dex tests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/devices/dex_tests`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.tests.list({account_id:a,...n})),{successLabel:`Loaded`})}};function Ol(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Device to filter traceroute result runs to.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const kl={command:`get <test-id>`,describe:`Get a breakdown of metrics by hop for individual traceroute test runs.`,builder:g(Ol),handler:async e=>{let n={deviceId:e[`device-id`],from:e.from,to:e.to,interval:e.interval};if(e.dryRun){d({command:`cf zero-trust dex tests network-path get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/traceroute-tests/${e[`test-id`]==null?`<test-id>`:encodeURIComponent(String(e[`test-id`]))}/network-path`,pathParams:{"test-id":String(e[`test-id`]??``)},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.tests.networkPath.get({account_id:a,test_id:e[`test-id`],...n})),{successLabel:`Loaded`})}},Al={command:`network-path`,describe:`Operations for dex.tests.network-path`,builder:e=>e.command(kl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function jl(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`data-host`,{type:`string`,description:`The desired endpoint to test.`}).option(`data-kind`,{type:`string`,description:`The type of test.`,choices:[`http`,`traceroute`]}).option(`data-method`,{type:`string`,description:`The HTTP request method type.`,choices:[`GET`]}).option(`description`,{type:`string`,description:`Additional details about the test.`}).option(`enabled`,{type:`boolean`,description:`Determines whether or not the test is active.`}).option(`interval`,{type:`string`,description:`How often the test will run.`}).option(`name`,{type:`string`,description:`The name of the DEX test. Must be unique.`}).option(`targeted`,{type:`boolean`,description:`The targeted field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ml={command:`update <dex-test-id>`,describe:`Update a DEX test.`,builder:jl,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust dex tests update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/devices/dex_tests/${i[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(i[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(i[`dex-test-id`]??``)},bodyKind:`json`,body:i.body===void 0?l({data:{host:p(i[`data-host`],`data-host`,`text`),kind:p(i[`data-kind`],`data-kind`,`text`),method:p(i[`data-method`],`data-method`,`text`)},description:p(i.description,`description`,`text`),enabled:i.enabled,interval:p(i.interval,`interval`,`text`),name:p(i.name,`name`,`text`),targeted:i.targeted}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Updating`,async()=>a.zeroTrust.dex.tests.update({body:e,account_id:o,dex_test_id:i[`dex-test-id`]})),{successLabel:`Updated`});return}if(i[`data-host`]===void 0&&(i[`data-host`]=await e(`data-host`,`The desired endpoint to test.`)),i[`data-kind`]===void 0&&(i[`data-kind`]=await n(`data-kind`,`The type of test.`,[`http`,`traceroute`])),i.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);i.interval===void 0&&(i.interval=await e(`interval`,`How often the test will run.`)),i.name===void 0&&(i.name=await e(`name`,`The name of the DEX test. Must be unique.`));let m=l({data:{host:p(i[`data-host`],`data-host`,`text`),kind:p(i[`data-kind`],`data-kind`,`text`),method:p(i[`data-method`],`data-method`,`text`)},description:p(i.description,`description`,`text`),enabled:i.enabled,interval:p(i.interval,`interval`,`text`),name:p(i.name,`name`,`text`),targeted:i.targeted});u(await f(`Updating`,async()=>a.zeroTrust.dex.tests.update({body:m,account_id:o,dex_test_id:i[`dex-test-id`]})),{successLabel:`Updated`})}},Nl={command:`tests`,describe:`Operations for dex.tests`,builder:e=>e.command(xl).command(Cl).command(Tl).command(Dl).command(Ml).command(Al).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Pl(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`type`,{type:`string`,description:`Filter events by type 'config' or 'toggle'.`,choices:[`config`,`toggle`]}).option(`toggle`,{type:`string`,description:`Filter events by type toggle value. Applicable to type='toggle' events only.`,choices:[`on`,`off`]}).option(`config-name`,{type:`string`,description:`Filter events by WARP configuration name changed from or to. Applicable to type='config' events only.`}).option(`account-name`,{type:`string`,description:`Filter events by account name.`}).option(`sort-order`,{type:`string`,description:`Sort response by event timestamp.`,choices:[`ASC`,`DESC`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fl={command:`list`,describe:`List WARP configuration and enablement toggle change events by device.`,builder:g(Pl),handler:async e=>{let n={page:e.page,per_page:e[`per-page`],from:e.from,to:e.to,type:e.type,toggle:e.toggle,config_name:e[`config-name`],account_name:e[`account-name`],sort_order:e[`sort-order`]};if(e.dryRun){d({command:`cf zero-trust dex warp-change-events list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dex/warp-change-events`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dex.warpChangeEvents.list({account_id:a,...n})),{successLabel:`Loaded`})}},Il={command:`warp-change-events`,describe:`Operations for dex.warp-change-events`,builder:e=>e.command(Fl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ll={command:`dex`,describe:`Operations for dex`,builder:e=>e.command(sc).command(xc).command(Ic).command(zc).command(Kc).command(rl).command(yl).command(Nl).command(Il).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Rl(e){return e.option(`case-sensitive`,{type:`boolean`,description:`Only applies to custom word lists.
 Determines if the words should be matched in a case-sensitive manner
 Cannot be set to false if \`secret\` is true or undefined`}).option(`description`,{type:`string`,description:`The description of the dataset.`}).option(`encoding-version`,{type:`number`,description:`Dataset encoding version
 
@@ -59,16 +59,16 @@ Omitting this field provides the default value 0, which is interpreted
 the same as 1.`}).option(`name`,{type:`string`,description:`The name field`}).option(`secret`,{type:`boolean`,description:`Generate a secret dataset.
 
 If true, the response will include a secret to use with the EDM encoder.
-If false, the response has no secret and the dataset is uploaded in plaintext.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset description.`})}const zl={command:`create`,describe:`Creates a new DLP (Data Loss Prevention) dataset for storing custom detection patterns. Datasets can contain exact match data, word lists, or EDM (Exact Data Match) configurations.`,builder:Rl,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dlp datasets create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/datasets`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({case_sensitive:n[`case-sensitive`],description:p(n.description,`description`,`text`),encoding_version:n[`encoding-version`],name:p(n.name,`name`,`text`),secret:n.secret}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.dlp.datasets.create({...e,account_id:i})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await t(`name`,`The name field`));let o=l({case_sensitive:n[`case-sensitive`],description:p(n.description,`description`,`text`),encoding_version:n[`encoding-version`],name:p(n.name,`name`,`text`),secret:n.secret});u(await f(`Creating`,async()=>r.zeroTrust.dlp.datasets.create({...o,account_id:i})),{successLabel:`Created`})}};function Bl(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Vl={command:`delete <dataset-id>`,describe:`This deletes all versions of the dataset.`,builder:Bl,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp datasets delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/datasets/${t[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(t[`dataset-id`]))}`,pathParams:{"dataset-id":String(t[`dataset-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dlp.datasets.delete({account_id:r,dataset_id:t[`dataset-id`]})),{successLabel:`Deleted`})}};function Hl(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ul={command:`get <dataset-id>`,describe:`Gets a dataset and its latest upload status.`,builder:Hl,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp datasets get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/datasets/${t[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(t[`dataset-id`]))}`,pathParams:{"dataset-id":String(t[`dataset-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.dlp.datasets.get({account_id:r,dataset_id:t[`dataset-id`]})),{successLabel:`Loaded`})}};function Wl(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gl={command:`list`,describe:`Lists all DLP datasets configured for the account, including custom word lists and EDM datasets.`,builder:Wl,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp datasets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/datasets`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.dlp.datasets.list({account_id:r})),{successLabel:`Loaded`})}};function Kl(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`case-sensitive`,{type:`boolean`,description:`Determines if the words should be matched in a case-sensitive manner.
+If false, the response has no secret and the dataset is uploaded in plaintext.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset description.`})}const zl={command:`create`,describe:`Creates a new DLP (Data Loss Prevention) dataset for storing custom detection patterns. Datasets can contain exact match data, word lists, or EDM (Exact Data Match) configurations.`,builder:Rl,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dlp datasets create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/datasets`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({case_sensitive:n[`case-sensitive`],description:p(n.description,`description`,`text`),encoding_version:n[`encoding-version`],name:p(n.name,`name`,`text`),secret:n.secret}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.dlp.datasets.create({...e,account_id:a})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await e(`name`,`The name field`));let o=l({case_sensitive:n[`case-sensitive`],description:p(n.description,`description`,`text`),encoding_version:n[`encoding-version`],name:p(n.name,`name`,`text`),secret:n.secret});u(await f(`Creating`,async()=>i.zeroTrust.dlp.datasets.create({...o,account_id:a})),{successLabel:`Created`})}};function Bl(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Vl={command:`delete <dataset-id>`,describe:`This deletes all versions of the dataset.`,builder:Bl,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp datasets delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}`,pathParams:{"dataset-id":String(e[`dataset-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dlp.datasets.delete({account_id:a,dataset_id:e[`dataset-id`]})),{successLabel:`Deleted`})}};function Hl(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ul={command:`get <dataset-id>`,describe:`Gets a dataset and its latest upload status.`,builder:Hl,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp datasets get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}`,pathParams:{"dataset-id":String(e[`dataset-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.dlp.datasets.get({account_id:i,dataset_id:e[`dataset-id`]})),{successLabel:`Loaded`})}};function Wl(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gl={command:`list`,describe:`Lists all DLP datasets configured for the account, including custom word lists and EDM datasets.`,builder:Wl,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp datasets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/datasets`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.dlp.datasets.list({account_id:i})),{successLabel:`Loaded`})}};function Kl(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`case-sensitive`,{type:`boolean`,description:`Determines if the words should be matched in a case-sensitive manner.
 
-Only required for custom word lists.`}).option(`description`,{type:`string`,description:`The description of the dataset.`}).option(`name`,{type:`string`,description:`The name of the dataset, must be unique.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset description.`})}const ql={command:`update <dataset-id>`,describe:`Updates the configuration of an existing DLP dataset, such as its name, description, or detection settings.`,builder:Kl,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp datasets update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/datasets/${t[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(t[`dataset-id`]))}`,pathParams:{"dataset-id":String(t[`dataset-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({case_sensitive:t[`case-sensitive`],description:p(t.description,`description`,`text`),name:p(t.name,`name`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.dlp.datasets.update({...e,account_id:r,dataset_id:t[`dataset-id`]})),{successLabel:`Updated`});return}let i=l({case_sensitive:t[`case-sensitive`],description:p(t.description,`description`,`text`),name:p(t.name,`name`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.dlp.datasets.update({...i,account_id:r,dataset_id:t[`dataset-id`]})),{successLabel:`Updated`})}};function Jl(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yl={command:`create <dataset-id>`,describe:`Creates a new version of a DLP dataset, allowing you to stage changes before activation. Used for single-column EDM and custom word lists.`,builder:Jl,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp datasets upload create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/datasets/${t[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(t[`dataset-id`]))}/upload`,pathParams:{"dataset-id":String(t[`dataset-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Creating`,async()=>n.zeroTrust.dlp.datasets.upload.create({account_id:r,dataset_id:t[`dataset-id`]})),{successLabel:`Created`})}};function Xl(e){return e.positional(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset. For custom wordlists this contains UTF-8 patterns separated by newline characters.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Zl={command:`edit <version>`,describe:`This is used for single-column EDMv1 and Custom Word Lists. The EDM format can only be created in the Cloudflare dashboard. For other clients, this operation can only be used for non-secret Custom Word Lists. The body must be a UTF-8 encoded, newline (NL or CRNL) separated list of words to be matched.`,builder:Xl,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp datasets upload edit`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/datasets/${t[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(t[`dataset-id`]))}/upload/${t.version==null?`<version>`:encodeURIComponent(String(t.version))}`,pathParams:{"dataset-id":String(t[`dataset-id`]??``),version:String(t.version??``)},bodyKind:`octet-stream`,body:t.body});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.file){let e=m(t.file);u(await f(`Creating`,async()=>o(n,`POST`,`/accounts/${r}/dlp/datasets/${encodeURIComponent(String(t[`dataset-id`]))}/upload/${encodeURIComponent(String(t.version))}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(t.body){let e=p(t.body,`body`,`binary`);u(await f(`Creating`,async()=>o(n,`POST`,`/accounts/${r}/dlp/datasets/${encodeURIComponent(String(t[`dataset-id`]))}/upload/${encodeURIComponent(String(t.version))}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ql={command:`upload`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Yl).command(Zl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $l(e){return e.positional(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`array of new columns to create for this dataset version.`})}const eu={command:`create <version>`,describe:`This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. The columns in the response appear in the same order as in the request.`,builder:g($l),handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp datasets versions create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/datasets/${t[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(t[`dataset-id`]))}/versions/${t.version==null?`<version>`:encodeURIComponent(String(t.version))}`,pathParams:{"dataset-id":String(t[`dataset-id`]??``),version:String(t.version??``)},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.dlp.datasets.versions.create({body:e,account_id:r,dataset_id:t[`dataset-id`],version:t.version})),{successLabel:`Created`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function tu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset content.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const nu={command:`create <entry-id>`,describe:`This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard.`,builder:tu,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp datasets versions entries create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/datasets/${t[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(t[`dataset-id`]))}/versions/${t.version==null?`<version>`:encodeURIComponent(String(t.version))}/entries/${t[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(t[`entry-id`]))}`,pathParams:{"dataset-id":String(t[`dataset-id`]??``),version:String(t.version??``),"entry-id":String(t[`entry-id`]??``)},bodyKind:`octet-stream`,body:t.body});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.file){let e=m(t.file);u(await f(`Creating`,async()=>o(n,`POST`,`/accounts/${r}/dlp/datasets/${encodeURIComponent(String(t[`dataset-id`]))}/versions/${encodeURIComponent(String(t.version))}/entries/${encodeURIComponent(String(t[`entry-id`]))}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(t.body){let e=p(t.body,`body`,`binary`);u(await f(`Creating`,async()=>o(n,`POST`,`/accounts/${r}/dlp/datasets/${encodeURIComponent(String(t[`dataset-id`]))}/versions/${encodeURIComponent(String(t.version))}/entries/${encodeURIComponent(String(t[`entry-id`]))}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},ru={command:`entries`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(nu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},iu={command:`versions`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(eu).command(ru).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},$={command:`datasets`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(zl).command(Vl).command(Ul).command(Gl).command(ql).command(Ql).command(iu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function au(e){return e.option(`auth-requirements-allowed-microsoft-organizations`,{type:`string`,array:!0,description:`The auth_requirements.allowed_microsoft_organizations field`}).option(`auth-requirements-type`,{type:`string`,description:`The auth_requirements.type field`,choices:[`Org`,`NoAuth`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Account mapping.`})}const ou={command:`create`,describe:`Creates a mapping between a Cloudflare account and an email provider for DLP email scanning integration.`,builder:au,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp email account-mapping create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/email/account_mapping`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({auth_requirements:{allowed_microsoft_organizations:t[`auth-requirements-allowed-microsoft-organizations`],type:p(t[`auth-requirements-type`],`auth-requirements-type`,`text`)}}):c(t.body)});return}let r=await s(t),i=t.local?h:await a(r);if(t.accountId=i,t.body){let e=c(t.body);u(await f(`Creating`,async()=>r.zeroTrust.dlp.email.accountMapping.create({...e,account_id:i})),{successLabel:`Created`});return}t[`auth-requirements-type`]===void 0&&(t[`auth-requirements-type`]=await n(`auth-requirements-type`,`The auth_requirements.type field`,[`Org`,`NoAuth`]));let o=l({auth_requirements:{allowed_microsoft_organizations:t[`auth-requirements-allowed-microsoft-organizations`],type:p(t[`auth-requirements-type`],`auth-requirements-type`,`text`)}});u(await f(`Creating`,async()=>r.zeroTrust.dlp.email.accountMapping.create({...o,account_id:i})),{successLabel:`Created`})}};function su(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const cu={command:`get`,describe:`Retrieves the email provider mapping configuration for DLP email scanning.`,builder:su,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp email account-mapping get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/email/account_mapping`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.dlp.email.accountMapping.get({account_id:r})),{successLabel:`Loaded`})}},lu={command:`account-mapping`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(ou).command(cu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function uu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule priorities.`})}const du={command:`bulk-edit`,describe:`Reorders DLP email scanning rules by updating their priority values. Higher priority rules are evaluated first.`,builder:uu,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp email rules bulk-edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.dlp.email.rules.bulkEdit({...e,account_id:r})),{successLabel:`Updated`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function fu(e){return e.option(`action-action`,{type:`string`,description:`The action.action field`,choices:[`Block`]}).option(`action-message`,{type:`string`,description:`The action.message field`}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule description.`})}const pu={command:`create`,describe:`Creates a new DLP email scanning rule that defines what content patterns to detect in email messages and what actions to take.`,builder:fu,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust dlp email rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?l({action:{action:p(r[`action-action`],`action-action`,`text`),message:p(r[`action-message`],`action-message`,`text`)},description:p(r.description,`description`,`text`),enabled:r.enabled,name:p(r.name,`name`,`text`)}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Creating`,async()=>i.zeroTrust.dlp.email.rules.create({body:e,account_id:o})),{successLabel:`Created`});return}if(r[`action-action`]===void 0&&(r[`action-action`]=await n(`action-action`,`The action.action field`,[`Block`])),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await t(`name`,`The name field`));let m=l({action:{action:p(r[`action-action`],`action-action`,`text`),message:p(r[`action-message`],`action-message`,`text`)},description:p(r.description,`description`,`text`),enabled:r.enabled,name:p(r.name,`name`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.dlp.email.rules.create({body:m,account_id:o})),{successLabel:`Created`})}};function mu(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const hu={command:`delete <rule-id>`,describe:`Removes a DLP email scanning rule. The rule will no longer be applied to email messages.`,builder:mu,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp email rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/email/rules/${t[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(t[`rule-id`]))}`,pathParams:{"rule-id":String(t[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dlp.email.rules.delete({account_id:r,rule_id:t[`rule-id`]})),{successLabel:`Deleted`})}};function gu(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _u={command:`get <rule-id>`,describe:`Gets detailed configuration for a specific DLP email scanning rule, including detection patterns and actions.`,builder:gu,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp email rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/email/rules/${t[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(t[`rule-id`]))}`,pathParams:{"rule-id":String(t[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.dlp.email.rules.get({account_id:r,rule_id:t[`rule-id`]})),{successLabel:`Loaded`})}};function vu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yu={command:`list`,describe:`Lists all email scanner rules for an account.`,builder:vu,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp email rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.dlp.email.rules.list({account_id:r})),{successLabel:`Loaded`})}};function bu(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`action-action`,{type:`string`,description:`The action.action field`,choices:[`Block`]}).option(`action-message`,{type:`string`,description:`The action.message field`}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule description.`})}const xu={command:`update <rule-id>`,describe:`Updates a DLP email scanning rule.`,builder:bu,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust dlp email rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/email/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?l({action:{action:p(r[`action-action`],`action-action`,`text`),message:p(r[`action-message`],`action-message`,`text`)},description:p(r.description,`description`,`text`),enabled:r.enabled,name:p(r.name,`name`,`text`)}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Updating`,async()=>i.zeroTrust.dlp.email.rules.update({body:e,account_id:o,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}if(r[`action-action`]===void 0&&(r[`action-action`]=await n(`action-action`,`The action.action field`,[`Block`])),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.name===void 0&&(r.name=await t(`name`,`The name field`));let m=l({action:{action:p(r[`action-action`],`action-action`,`text`),message:p(r[`action-message`],`action-message`,`text`)},description:p(r.description,`description`,`text`),enabled:r.enabled,name:p(r.name,`name`,`text`)});u(await f(`Updating`,async()=>i.zeroTrust.dlp.email.rules.update({body:m,account_id:o,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},Su={command:`rules`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(du).command(pu).command(hu).command(_u).command(yu).command(xu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Cu={command:`email`,describe:`Operations for dlp.email`,builder:e=>e.command(lu).command(Su).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function wu(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new entry to create.`})}const Tu={command:`create`,describe:`Creates a DLP custom entry.`,builder:wu,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dlp entries create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({description:p(n.description,`description`,`text`),enabled:n.enabled,name:p(n.name,`name`,`text`),pattern:{regex:p(n[`pattern-regex`],`pattern-regex`,`text`)},profile_id:p(n[`profile-id`],`profile-id`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.dlp.entries.create({...e,account_id:i})),{successLabel:`Created`});return}if(n.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);n.name===void 0&&(n.name=await t(`name`,`The name field`)),n[`pattern-regex`]===void 0&&(n[`pattern-regex`]=await t(`pattern-regex`,`The pattern.regex field`));let o=l({description:p(n.description,`description`,`text`),enabled:n.enabled,name:p(n.name,`name`,`text`),pattern:{regex:p(n[`pattern-regex`],`pattern-regex`,`text`)},profile_id:p(n[`profile-id`],`profile-id`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.dlp.entries.create({...o,account_id:i})),{successLabel:`Created`})}};function Eu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the entry.`})}const Du={command:`update <entry-id>`,describe:`Updates a DLP custom entry.`,builder:Eu,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dlp entries custom update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/entries/custom/${n[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(n[`entry-id`]))}`,pathParams:{"entry-id":String(n[`entry-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`),pattern:{regex:p(n[`pattern-regex`],`pattern-regex`,`text`)},enabled:n.enabled}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Updating`,async()=>r.zeroTrust.dlp.entries.custom.update({...e,account_id:i,entry_id:n[`entry-id`]})),{successLabel:`Updated`});return}if(n.name===void 0&&(n.name=await t(`name`,`The name field`)),n[`pattern-regex`]===void 0&&(n[`pattern-regex`]=await t(`pattern-regex`,`The pattern.regex field`)),n.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let o=l({description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`),pattern:{regex:p(n[`pattern-regex`],`pattern-regex`,`text`)},enabled:n.enabled});u(await f(`Updating`,async()=>r.zeroTrust.dlp.entries.custom.update({...o,account_id:i,entry_id:n[`entry-id`]})),{successLabel:`Updated`})}},Ou={command:`custom`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Du).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ku(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Au={command:`delete <entry-id>`,describe:`Deletes a DLP custom entry.`,builder:ku,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp entries delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/entries/${t[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(t[`entry-id`]))}`,pathParams:{"entry-id":String(t[`entry-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dlp.entries.delete({account_id:r,entry_id:t[`entry-id`]})),{successLabel:`Deleted`})}};function ju(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Mu={command:`get <entry-id>`,describe:`Fetches a DLP entry by ID.`,builder:ju,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp entries get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/entries/${t[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(t[`entry-id`]))}`,pathParams:{"entry-id":String(t[`entry-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.dlp.entries.get({account_id:r,entry_id:t[`entry-id`]})),{successLabel:`Loaded`})}};function Nu(e){return e.option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`entry-id`,{type:`string`,description:`The entry_id field`}).option(`profile-id`,{type:`string`,description:`This field is not used as the owning profile.
-For predefined entries it is already set to a predefined profile.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`This endpoint will update an existing integration entry. It is not possible to create new integration entries.`})}const Pu={command:`create`,describe:`Integration entries can't be created, this will update an existing integration entry. This is needed for our generated terraform API.`,builder:Nu,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dlp entries integration create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/entries/integration`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({enabled:n.enabled,entry_id:p(n[`entry-id`],`entry-id`,`text`),profile_id:p(n[`profile-id`],`profile-id`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.dlp.entries.integration.create({body:e,account_id:i})),{successLabel:`Created`});return}if(n.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);n[`entry-id`]===void 0&&(n[`entry-id`]=await t(`entry-id`,`The entry_id field`));let o=l({enabled:n.enabled,entry_id:p(n[`entry-id`],`entry-id`,`text`),profile_id:p(n[`profile-id`],`profile-id`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.dlp.entries.integration.create({body:o,account_id:i})),{successLabel:`Created`})}};function Fu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Iu={command:`delete <entry-id>`,describe:`This is a no-op as integration entires can't be deleted but is needed for our generated terraform API.`,builder:Fu,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp entries integration delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/entries/integration/${t[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(t[`entry-id`]))}`,pathParams:{"entry-id":String(t[`entry-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dlp.entries.integration.delete({account_id:r,entry_id:t[`entry-id`]})),{successLabel:`Deleted`})}};function Lu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Enable or disable integration entry in owning profile.`})}const Ru={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:Lu,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp entries integration update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/entries/integration/${t[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(t[`entry-id`]))}`,pathParams:{"entry-id":String(t[`entry-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({enabled:t.enabled}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.dlp.entries.integration.update({body:e,account_id:r,entry_id:t[`entry-id`]})),{successLabel:`Updated`});return}if(t.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let i=l({enabled:t.enabled});u(await f(`Updating`,async()=>n.zeroTrust.dlp.entries.integration.update({body:i,account_id:r,entry_id:t[`entry-id`]})),{successLabel:`Updated`})}},zu={command:`integration`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Pu).command(Iu).command(Ru).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vu={command:`list`,describe:`Lists all DLP entries in an account.`,builder:Bu,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp entries list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.dlp.entries.list({account_id:r})),{successLabel:`Loaded`})}};function Hu(e){return e.option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`entry-id`,{type:`string`,description:`The entry_id field`}).option(`profile-id`,{type:`string`,description:`This field is not used as the owning profile.
-For predefined entries it is already set to a predefined profile.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`This endpoint will update an existing predefined entry. It is not possible to create new predefined entries.`})}const Uu={command:`create`,describe:`Predefined entries can't be created, this will update an existing predefined entry. This is needed for our generated terraform API.`,builder:Hu,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dlp entries predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/entries/predefined`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({enabled:n.enabled,entry_id:p(n[`entry-id`],`entry-id`,`text`),profile_id:p(n[`profile-id`],`profile-id`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.dlp.entries.predefined.create({body:e,account_id:i})),{successLabel:`Created`});return}if(n.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);n[`entry-id`]===void 0&&(n[`entry-id`]=await t(`entry-id`,`The entry_id field`));let o=l({enabled:n.enabled,entry_id:p(n[`entry-id`],`entry-id`,`text`),profile_id:p(n[`profile-id`],`profile-id`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.dlp.entries.predefined.create({body:o,account_id:i})),{successLabel:`Created`})}};function Wu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Gu={command:`delete <entry-id>`,describe:`This is a no-op as predefined entires can't be deleted but is needed for our generated terraform API.`,builder:Wu,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp entries predefined delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/entries/predefined/${t[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(t[`entry-id`]))}`,pathParams:{"entry-id":String(t[`entry-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dlp.entries.predefined.delete({account_id:r,entry_id:t[`entry-id`]})),{successLabel:`Deleted`})}};function Ku(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Settings to enable or disable predefined entry in owning profile.`})}const qu={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:Ku,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp entries predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/entries/predefined/${t[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(t[`entry-id`]))}`,pathParams:{"entry-id":String(t[`entry-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({enabled:t.enabled}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.dlp.entries.predefined.update({body:e,account_id:r,entry_id:t[`entry-id`]})),{successLabel:`Updated`});return}if(t.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let i=l({enabled:t.enabled});u(await f(`Updating`,async()=>n.zeroTrust.dlp.entries.predefined.update({body:i,account_id:r,entry_id:t[`entry-id`]})),{successLabel:`Updated`})}},Ju={command:`predefined`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Uu).command(Gu).command(qu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Yu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the entry.`})}const Xu={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:Yu,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp entries update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/entries/${t[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(t[`entry-id`]))}`,pathParams:{"entry-id":String(t[`entry-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({enabled:t.enabled}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.dlp.entries.update({body:e,account_id:r,entry_id:t[`entry-id`]})),{successLabel:`Updated`});return}if(t.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let i=l({enabled:t.enabled});u(await f(`Updating`,async()=>n.zeroTrust.dlp.entries.update({body:i,account_id:r,entry_id:t[`entry-id`]})),{successLabel:`Updated`})}},Zu={command:`entries`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Tu).command(Au).command(Mu).command(Vu).command(Xu).command(Ou).command(zu).command(Ju).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $u={command:`list`,describe:`Retrieves current DLP usage limits and quotas for the account, including maximum allowed counts and current usage for custom entries, dataset cells, and document fingerprints.`,builder:Qu,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp limits list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/limits`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.dlp.limits.list({account_id:r})),{successLabel:`Loaded`})}},ed={command:`limits`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command($u).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function td(e){return e.option(`max-match-bytes`,{type:`number`,description:"Maximum number of bytes that the regular expression can match.\n\nIf this is `null` then there is no limit on the length. Patterns can use\n`*` and `+`. Otherwise repeats should use a range `{m,n}` to restrict\npatterns to the length. If this field is missing, then a default length\nlimit is used.\n\nNote that the length is specified in bytes. Since regular expressions\nuse UTF-8 the pattern `.` can match up to 4 bytes. Hence `.{1,256}`\nhas a maximum length of 1024 bytes."}).option(`regex`,{type:`string`,description:`The regex field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Validation query.`})}const nd={command:`validate`,describe:"Validates whether this pattern is a valid regular expression. Rejects it if the regular expression is too complex or can match an unbounded-length string. The regex will be rejected if it uses `*` or `+`. Bound the maximum number of characters that can be matched using a range, e.g. `{1,100}`.",builder:td,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dlp patterns validate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/patterns/validate`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({max_match_bytes:n[`max-match-bytes`],regex:p(n.regex,`regex`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.dlp.patterns.validate({...e,account_id:i})),{successLabel:`Created`});return}n.regex===void 0&&(n.regex=await t(`regex`,`The regex field`));let o=l({max_match_bytes:n[`max-match-bytes`],regex:p(n.regex,`regex`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.dlp.patterns.validate({...o,account_id:i})),{successLabel:`Created`})}},rd={command:`patterns`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(nd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function id(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ad={command:`get`,describe:`Gets the current payload logging configuration for DLP, showing whether matched content is being logged.`,builder:id,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp payload-logs get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/payload_log`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.dlp.payloadLogs.get({account_id:r})),{successLabel:`Loaded`})}};function od(e){return e.option(`public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
+Only required for custom word lists.`}).option(`description`,{type:`string`,description:`The description of the dataset.`}).option(`name`,{type:`string`,description:`The name of the dataset, must be unique.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset description.`})}const ql={command:`update <dataset-id>`,describe:`Updates the configuration of an existing DLP dataset, such as its name, description, or detection settings.`,builder:Kl,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp datasets update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}`,pathParams:{"dataset-id":String(e[`dataset-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({case_sensitive:e[`case-sensitive`],description:p(e.description,`description`,`text`),name:p(e.name,`name`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.dlp.datasets.update({...t,account_id:i,dataset_id:e[`dataset-id`]})),{successLabel:`Updated`});return}let a=l({case_sensitive:e[`case-sensitive`],description:p(e.description,`description`,`text`),name:p(e.name,`name`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.dlp.datasets.update({...a,account_id:i,dataset_id:e[`dataset-id`]})),{successLabel:`Updated`})}};function Jl(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yl={command:`create <dataset-id>`,describe:`Creates a new version of a DLP dataset, allowing you to stage changes before activation. Used for single-column EDM and custom word lists.`,builder:Jl,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp datasets upload create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}/upload`,pathParams:{"dataset-id":String(e[`dataset-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Creating`,async()=>n.zeroTrust.dlp.datasets.upload.create({account_id:i,dataset_id:e[`dataset-id`]})),{successLabel:`Created`})}};function Xl(e){return e.positional(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset. For custom wordlists this contains UTF-8 patterns separated by newline characters.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Zl={command:`edit <version>`,describe:`This is used for single-column EDMv1 and Custom Word Lists. The EDM format can only be created in the Cloudflare dashboard. For other clients, this operation can only be used for non-secret Custom Word Lists. The body must be a UTF-8 encoded, newline (NL or CRNL) separated list of words to be matched.`,builder:Xl,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp datasets upload edit`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}/upload/${e.version==null?`<version>`:encodeURIComponent(String(e.version))}`,pathParams:{"dataset-id":String(e[`dataset-id`]??``),version:String(e.version??``)},bodyKind:`octet-stream`,body:e.body});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.file){let t=m(e.file);u(await f(`Creating`,async()=>o(n,`POST`,`/accounts/${i}/dlp/datasets/${encodeURIComponent(String(e[`dataset-id`]))}/upload/${encodeURIComponent(String(e.version))}`,{body:t,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(e.body){let t=p(e.body,`body`,`binary`);u(await f(`Creating`,async()=>o(n,`POST`,`/accounts/${i}/dlp/datasets/${encodeURIComponent(String(e[`dataset-id`]))}/upload/${encodeURIComponent(String(e.version))}`,{body:t,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ql={command:`upload`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Yl).command(Zl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $l(e){return e.positional(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`array of new columns to create for this dataset version.`})}const eu={command:`create <version>`,describe:`This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. The columns in the response appear in the same order as in the request.`,builder:g($l),handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp datasets versions create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}/versions/${e.version==null?`<version>`:encodeURIComponent(String(e.version))}`,pathParams:{"dataset-id":String(e[`dataset-id`]??``),version:String(e.version??``)},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.dlp.datasets.versions.create({body:t,account_id:i,dataset_id:e[`dataset-id`],version:e.version})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function tu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset content.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const nu={command:`create <entry-id>`,describe:`This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard.`,builder:tu,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp datasets versions entries create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}/versions/${e.version==null?`<version>`:encodeURIComponent(String(e.version))}/entries/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"dataset-id":String(e[`dataset-id`]??``),version:String(e.version??``),"entry-id":String(e[`entry-id`]??``)},bodyKind:`octet-stream`,body:e.body});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.file){let t=m(e.file);u(await f(`Creating`,async()=>o(n,`POST`,`/accounts/${i}/dlp/datasets/${encodeURIComponent(String(e[`dataset-id`]))}/versions/${encodeURIComponent(String(e.version))}/entries/${encodeURIComponent(String(e[`entry-id`]))}`,{body:t,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(e.body){let t=p(e.body,`body`,`binary`);u(await f(`Creating`,async()=>o(n,`POST`,`/accounts/${i}/dlp/datasets/${encodeURIComponent(String(e[`dataset-id`]))}/versions/${encodeURIComponent(String(e.version))}/entries/${encodeURIComponent(String(e[`entry-id`]))}`,{body:t,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},ru={command:`entries`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(nu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},iu={command:`versions`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(eu).command(ru).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},au={command:`datasets`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(zl).command(Vl).command(Ul).command(Gl).command(ql).command(Ql).command(iu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ou(e){return e.option(`auth-requirements-allowed-microsoft-organizations`,{type:`string`,array:!0,description:`The auth_requirements.allowed_microsoft_organizations field`}).option(`auth-requirements-type`,{type:`string`,description:`The auth_requirements.type field`,choices:[`Org`,`NoAuth`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Account mapping.`})}const su={command:`create`,describe:`Creates a mapping between a Cloudflare account and an email provider for DLP email scanning integration.`,builder:ou,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp email account-mapping create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/email/account_mapping`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({auth_requirements:{allowed_microsoft_organizations:e[`auth-requirements-allowed-microsoft-organizations`],type:p(e[`auth-requirements-type`],`auth-requirements-type`,`text`)}}):c(e.body)});return}let i=await s(e),a=e.local?h:await r(i);if(e.accountId=a,e.body){let t=c(e.body);u(await f(`Creating`,async()=>i.zeroTrust.dlp.email.accountMapping.create({...t,account_id:a})),{successLabel:`Created`});return}e[`auth-requirements-type`]===void 0&&(e[`auth-requirements-type`]=await n(`auth-requirements-type`,`The auth_requirements.type field`,[`Org`,`NoAuth`]));let o=l({auth_requirements:{allowed_microsoft_organizations:e[`auth-requirements-allowed-microsoft-organizations`],type:p(e[`auth-requirements-type`],`auth-requirements-type`,`text`)}});u(await f(`Creating`,async()=>i.zeroTrust.dlp.email.accountMapping.create({...o,account_id:a})),{successLabel:`Created`})}};function cu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $={command:`get`,describe:`Retrieves the email provider mapping configuration for DLP email scanning.`,builder:cu,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp email account-mapping get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/email/account_mapping`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.dlp.email.accountMapping.get({account_id:i})),{successLabel:`Loaded`})}},lu={command:`account-mapping`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(su).command($).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function uu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule priorities.`})}const du={command:`bulk-edit`,describe:`Reorders DLP email scanning rules by updating their priority values. Higher priority rules are evaluated first.`,builder:uu,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp email rules bulk-edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.dlp.email.rules.bulkEdit({...t,account_id:i})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function fu(e){return e.option(`action-action`,{type:`string`,description:`The action.action field`,choices:[`Block`]}).option(`action-message`,{type:`string`,description:`The action.message field`}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule description.`})}const pu={command:`create`,describe:`Creates a new DLP email scanning rule that defines what content patterns to detect in email messages and what actions to take.`,builder:fu,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust dlp email rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`json`,body:i.body===void 0?l({action:{action:p(i[`action-action`],`action-action`,`text`),message:p(i[`action-message`],`action-message`,`text`)},description:p(i.description,`description`,`text`),enabled:i.enabled,name:p(i.name,`name`,`text`)}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Creating`,async()=>a.zeroTrust.dlp.email.rules.create({body:e,account_id:o})),{successLabel:`Created`});return}if(i[`action-action`]===void 0&&(i[`action-action`]=await n(`action-action`,`The action.action field`,[`Block`])),i.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);i.name===void 0&&(i.name=await e(`name`,`The name field`));let m=l({action:{action:p(i[`action-action`],`action-action`,`text`),message:p(i[`action-message`],`action-message`,`text`)},description:p(i.description,`description`,`text`),enabled:i.enabled,name:p(i.name,`name`,`text`)});u(await f(`Creating`,async()=>a.zeroTrust.dlp.email.rules.create({body:m,account_id:o})),{successLabel:`Created`})}};function mu(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const hu={command:`delete <rule-id>`,describe:`Removes a DLP email scanning rule. The rule will no longer be applied to email messages.`,builder:mu,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp email rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/email/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dlp.email.rules.delete({account_id:a,rule_id:e[`rule-id`]})),{successLabel:`Deleted`})}};function gu(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _u={command:`get <rule-id>`,describe:`Gets detailed configuration for a specific DLP email scanning rule, including detection patterns and actions.`,builder:gu,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp email rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/email/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.dlp.email.rules.get({account_id:i,rule_id:e[`rule-id`]})),{successLabel:`Loaded`})}};function vu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yu={command:`list`,describe:`Lists all email scanner rules for an account.`,builder:vu,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp email rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.dlp.email.rules.list({account_id:i})),{successLabel:`Loaded`})}};function bu(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`action-action`,{type:`string`,description:`The action.action field`,choices:[`Block`]}).option(`action-message`,{type:`string`,description:`The action.message field`}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule description.`})}const xu={command:`update <rule-id>`,describe:`Updates a DLP email scanning rule.`,builder:bu,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust dlp email rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/email/rules/${i[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(i[`rule-id`]))}`,pathParams:{"rule-id":String(i[`rule-id`]??``)},bodyKind:`json`,body:i.body===void 0?l({action:{action:p(i[`action-action`],`action-action`,`text`),message:p(i[`action-message`],`action-message`,`text`)},description:p(i.description,`description`,`text`),enabled:i.enabled,name:p(i.name,`name`,`text`)}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Updating`,async()=>a.zeroTrust.dlp.email.rules.update({body:e,account_id:o,rule_id:i[`rule-id`]})),{successLabel:`Updated`});return}if(i[`action-action`]===void 0&&(i[`action-action`]=await n(`action-action`,`The action.action field`,[`Block`])),i.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);i.name===void 0&&(i.name=await e(`name`,`The name field`));let m=l({action:{action:p(i[`action-action`],`action-action`,`text`),message:p(i[`action-message`],`action-message`,`text`)},description:p(i.description,`description`,`text`),enabled:i.enabled,name:p(i.name,`name`,`text`)});u(await f(`Updating`,async()=>a.zeroTrust.dlp.email.rules.update({body:m,account_id:o,rule_id:i[`rule-id`]})),{successLabel:`Updated`})}},Su={command:`rules`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(du).command(pu).command(hu).command(_u).command(yu).command(xu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Cu={command:`email`,describe:`Operations for dlp.email`,builder:e=>e.command(lu).command(Su).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function wu(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new entry to create.`})}const Tu={command:`create`,describe:`Creates a DLP custom entry.`,builder:wu,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dlp entries create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({description:p(n.description,`description`,`text`),enabled:n.enabled,name:p(n.name,`name`,`text`),pattern:{regex:p(n[`pattern-regex`],`pattern-regex`,`text`)},profile_id:p(n[`profile-id`],`profile-id`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.dlp.entries.create({...e,account_id:a})),{successLabel:`Created`});return}if(n.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);n.name===void 0&&(n.name=await e(`name`,`The name field`)),n[`pattern-regex`]===void 0&&(n[`pattern-regex`]=await e(`pattern-regex`,`The pattern.regex field`));let o=l({description:p(n.description,`description`,`text`),enabled:n.enabled,name:p(n.name,`name`,`text`),pattern:{regex:p(n[`pattern-regex`],`pattern-regex`,`text`)},profile_id:p(n[`profile-id`],`profile-id`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.dlp.entries.create({...o,account_id:a})),{successLabel:`Created`})}};function Eu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the entry.`})}const Du={command:`update <entry-id>`,describe:`Updates a DLP custom entry.`,builder:Eu,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dlp entries custom update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/entries/custom/${n[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(n[`entry-id`]))}`,pathParams:{"entry-id":String(n[`entry-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`),pattern:{regex:p(n[`pattern-regex`],`pattern-regex`,`text`)},enabled:n.enabled}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Updating`,async()=>i.zeroTrust.dlp.entries.custom.update({...e,account_id:a,entry_id:n[`entry-id`]})),{successLabel:`Updated`});return}if(n.name===void 0&&(n.name=await e(`name`,`The name field`)),n[`pattern-regex`]===void 0&&(n[`pattern-regex`]=await e(`pattern-regex`,`The pattern.regex field`)),n.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let o=l({description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`),pattern:{regex:p(n[`pattern-regex`],`pattern-regex`,`text`)},enabled:n.enabled});u(await f(`Updating`,async()=>i.zeroTrust.dlp.entries.custom.update({...o,account_id:a,entry_id:n[`entry-id`]})),{successLabel:`Updated`})}},Ou={command:`custom`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Du).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ku(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Au={command:`delete <entry-id>`,describe:`Deletes a DLP custom entry.`,builder:ku,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp entries delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/entries/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dlp.entries.delete({account_id:a,entry_id:e[`entry-id`]})),{successLabel:`Deleted`})}};function ju(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Mu={command:`get <entry-id>`,describe:`Fetches a DLP entry by ID.`,builder:ju,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp entries get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/entries/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.dlp.entries.get({account_id:i,entry_id:e[`entry-id`]})),{successLabel:`Loaded`})}};function Nu(e){return e.option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`entry-id`,{type:`string`,description:`The entry_id field`}).option(`profile-id`,{type:`string`,description:`This field is not used as the owning profile.
+For predefined entries it is already set to a predefined profile.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`This endpoint will update an existing integration entry. It is not possible to create new integration entries.`})}const Pu={command:`create`,describe:`Integration entries can't be created, this will update an existing integration entry. This is needed for our generated terraform API.`,builder:Nu,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dlp entries integration create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/entries/integration`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({enabled:n.enabled,entry_id:p(n[`entry-id`],`entry-id`,`text`),profile_id:p(n[`profile-id`],`profile-id`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.dlp.entries.integration.create({body:e,account_id:a})),{successLabel:`Created`});return}if(n.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);n[`entry-id`]===void 0&&(n[`entry-id`]=await e(`entry-id`,`The entry_id field`));let o=l({enabled:n.enabled,entry_id:p(n[`entry-id`],`entry-id`,`text`),profile_id:p(n[`profile-id`],`profile-id`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.dlp.entries.integration.create({body:o,account_id:a})),{successLabel:`Created`})}};function Fu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Iu={command:`delete <entry-id>`,describe:`This is a no-op as integration entires can't be deleted but is needed for our generated terraform API.`,builder:Fu,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp entries integration delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/entries/integration/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dlp.entries.integration.delete({account_id:a,entry_id:e[`entry-id`]})),{successLabel:`Deleted`})}};function Lu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Enable or disable integration entry in owning profile.`})}const Ru={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:Lu,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp entries integration update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/entries/integration/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({enabled:e.enabled}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.dlp.entries.integration.update({body:t,account_id:i,entry_id:e[`entry-id`]})),{successLabel:`Updated`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let a=l({enabled:e.enabled});u(await f(`Updating`,async()=>n.zeroTrust.dlp.entries.integration.update({body:a,account_id:i,entry_id:e[`entry-id`]})),{successLabel:`Updated`})}},zu={command:`integration`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Pu).command(Iu).command(Ru).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vu={command:`list`,describe:`Lists all DLP entries in an account.`,builder:Bu,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp entries list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.dlp.entries.list({account_id:i})),{successLabel:`Loaded`})}};function Hu(e){return e.option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`entry-id`,{type:`string`,description:`The entry_id field`}).option(`profile-id`,{type:`string`,description:`This field is not used as the owning profile.
+For predefined entries it is already set to a predefined profile.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`This endpoint will update an existing predefined entry. It is not possible to create new predefined entries.`})}const Uu={command:`create`,describe:`Predefined entries can't be created, this will update an existing predefined entry. This is needed for our generated terraform API.`,builder:Hu,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dlp entries predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/entries/predefined`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({enabled:n.enabled,entry_id:p(n[`entry-id`],`entry-id`,`text`),profile_id:p(n[`profile-id`],`profile-id`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.dlp.entries.predefined.create({body:e,account_id:a})),{successLabel:`Created`});return}if(n.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);n[`entry-id`]===void 0&&(n[`entry-id`]=await e(`entry-id`,`The entry_id field`));let o=l({enabled:n.enabled,entry_id:p(n[`entry-id`],`entry-id`,`text`),profile_id:p(n[`profile-id`],`profile-id`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.dlp.entries.predefined.create({body:o,account_id:a})),{successLabel:`Created`})}};function Wu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Gu={command:`delete <entry-id>`,describe:`This is a no-op as predefined entires can't be deleted but is needed for our generated terraform API.`,builder:Wu,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp entries predefined delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/entries/predefined/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dlp.entries.predefined.delete({account_id:a,entry_id:e[`entry-id`]})),{successLabel:`Deleted`})}};function Ku(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Settings to enable or disable predefined entry in owning profile.`})}const qu={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:Ku,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp entries predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/entries/predefined/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({enabled:e.enabled}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.dlp.entries.predefined.update({body:t,account_id:i,entry_id:e[`entry-id`]})),{successLabel:`Updated`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let a=l({enabled:e.enabled});u(await f(`Updating`,async()=>n.zeroTrust.dlp.entries.predefined.update({body:a,account_id:i,entry_id:e[`entry-id`]})),{successLabel:`Updated`})}},Ju={command:`predefined`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Uu).command(Gu).command(qu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Yu(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the entry.`})}const Xu={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:Yu,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp entries update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/entries/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({enabled:e.enabled}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.dlp.entries.update({body:t,account_id:i,entry_id:e[`entry-id`]})),{successLabel:`Updated`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let a=l({enabled:e.enabled});u(await f(`Updating`,async()=>n.zeroTrust.dlp.entries.update({body:a,account_id:i,entry_id:e[`entry-id`]})),{successLabel:`Updated`})}},Zu={command:`entries`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Tu).command(Au).command(Mu).command(Vu).command(Xu).command(Ou).command(zu).command(Ju).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $u={command:`list`,describe:`Retrieves current DLP usage limits and quotas for the account, including maximum allowed counts and current usage for custom entries, dataset cells, and document fingerprints.`,builder:Qu,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp limits list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/limits`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.dlp.limits.list({account_id:i})),{successLabel:`Loaded`})}},ed={command:`limits`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command($u).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function td(e){return e.option(`max-match-bytes`,{type:`number`,description:"Maximum number of bytes that the regular expression can match.\n\nIf this is `null` then there is no limit on the length. Patterns can use\n`*` and `+`. Otherwise repeats should use a range `{m,n}` to restrict\npatterns to the length. If this field is missing, then a default length\nlimit is used.\n\nNote that the length is specified in bytes. Since regular expressions\nuse UTF-8 the pattern `.` can match up to 4 bytes. Hence `.{1,256}`\nhas a maximum length of 1024 bytes."}).option(`regex`,{type:`string`,description:`The regex field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Validation query.`})}const nd={command:`validate`,describe:"Validates whether this pattern is a valid regular expression. Rejects it if the regular expression is too complex or can match an unbounded-length string. The regex will be rejected if it uses `*` or `+`. Bound the maximum number of characters that can be matched using a range, e.g. `{1,100}`.",builder:td,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dlp patterns validate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/patterns/validate`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({max_match_bytes:n[`max-match-bytes`],regex:p(n.regex,`regex`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.dlp.patterns.validate({...e,account_id:a})),{successLabel:`Created`});return}n.regex===void 0&&(n.regex=await e(`regex`,`The regex field`));let o=l({max_match_bytes:n[`max-match-bytes`],regex:p(n.regex,`regex`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.dlp.patterns.validate({...o,account_id:a})),{successLabel:`Created`})}},rd={command:`patterns`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(nd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function id(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ad={command:`get`,describe:`Gets the current payload logging configuration for DLP, showing whether matched content is being logged.`,builder:id,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp payload-logs get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/payload_log`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.dlp.payloadLogs.get({account_id:i})),{successLabel:`Loaded`})}};function od(e){return e.option(`public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
 
 - Set to null or empty string to disable payload logging.
 - Set to a non-empty base64 string to enable payload logging with the given key.
@@ -77,42 +77,42 @@ For customers with configurable payload masking feature rolled out:
 - If the field is missing, the existing setting will be kept. Note that this is different from setting to null or empty string.
 
 For all other customers:
-- If the field is missing, the existing setting will be cleared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`New payload log settings.`})}const sd={command:`update`,describe:`Enables or disables payload logging for DLP matches. When enabled, matched content is stored for review.`,builder:od,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp payload-logs update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/payload_log`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({public_key:p(t[`public-key`],`public-key`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.dlp.payloadLogs.update({...e,account_id:r})),{successLabel:`Updated`});return}let i=l({public_key:p(t[`public-key`],`public-key`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.dlp.payloadLogs.update({...i,account_id:r})),{successLabel:`Updated`})}},cd={command:`payload-logs`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(ad).command(sd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ld(e){return e.option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`Related DLP policies will trigger when the match count exceeds the number set.`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`data-classes`,{type:`string`,array:!0,description:`Data class IDs to associate with the profile.`}).option(`data-tags`,{type:`string`,array:!0,description:`Data tag IDs to associate with the profile.`}).option(`description`,{type:`string`,description:`The description of the profile.`}).option(`name`,{type:`string`,description:`The name field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new profile to create.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const ud={command:`create`,describe:`Creates a DLP custom profile.`,builder:ld,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dlp profiles custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/profiles/custom`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({ai_context_enabled:n[`ai-context-enabled`],allowed_match_count:n[`allowed-match-count`],confidence_threshold:p(n[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:n[`context-awareness-enabled`],skip:{files:n[`context-awareness-skip-files`]}},data_classes:n[`data-classes`],data_tags:n[`data-tags`],description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`),ocr_enabled:n[`ocr-enabled`]}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.dlp.profiles.custom.create({...e,account_id:i})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await t(`name`,`The name field`));let o=l({ai_context_enabled:n[`ai-context-enabled`],allowed_match_count:n[`allowed-match-count`],confidence_threshold:p(n[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:n[`context-awareness-enabled`],skip:{files:n[`context-awareness-skip-files`]}},data_classes:n[`data-classes`],data_tags:n[`data-tags`],description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`),ocr_enabled:n[`ocr-enabled`]});u(await f(`Creating`,async()=>r.zeroTrust.dlp.profiles.custom.create({...o,account_id:i})),{successLabel:`Created`})}};function dd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const fd={command:`delete <profile-id>`,describe:`Deletes a DLP custom profile.`,builder:dd,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp profiles custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/profiles/custom/${t[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(t[`profile-id`]))}`,pathParams:{"profile-id":String(t[`profile-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dlp.profiles.custom.delete({account_id:r,profile_id:t[`profile-id`]})),{successLabel:`Deleted`})}};function pd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const md={command:`get <profile-id>`,describe:`Fetches a custom DLP profile by id.`,builder:pd,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp profiles custom get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/profiles/custom/${t[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(t[`profile-id`]))}`,pathParams:{"profile-id":String(t[`profile-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.dlp.profiles.custom.get({account_id:r,profile_id:t[`profile-id`]})),{successLabel:`Loaded`})}};function hd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`data-classes`,{type:`string`,array:!0,description:`Data class IDs to associate with the profile. If omitted, existing associations are unchanged.`}).option(`data-tags`,{type:`string`,array:!0,description:`Data tag IDs to associate with the profile. If omitted, existing associations are unchanged.`}).option(`description`,{type:`string`,description:`The description of the profile.`}).option(`name`,{type:`string`,description:`The name field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the profile.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const gd={command:`update <profile-id>`,describe:`Updates a DLP custom profile.`,builder:hd,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dlp profiles custom update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/profiles/custom/${n[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(n[`profile-id`]))}`,pathParams:{"profile-id":String(n[`profile-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({ai_context_enabled:n[`ai-context-enabled`],allowed_match_count:n[`allowed-match-count`],confidence_threshold:p(n[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:n[`context-awareness-enabled`],skip:{files:n[`context-awareness-skip-files`]}},data_classes:n[`data-classes`],data_tags:n[`data-tags`],description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`),ocr_enabled:n[`ocr-enabled`]}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Updating`,async()=>r.zeroTrust.dlp.profiles.custom.update({...e,account_id:i,profile_id:n[`profile-id`]})),{successLabel:`Updated`});return}n.name===void 0&&(n.name=await t(`name`,`The name field`));let o=l({ai_context_enabled:n[`ai-context-enabled`],allowed_match_count:n[`allowed-match-count`],confidence_threshold:p(n[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:n[`context-awareness-enabled`],skip:{files:n[`context-awareness-skip-files`]}},data_classes:n[`data-classes`],data_tags:n[`data-tags`],description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`),ocr_enabled:n[`ocr-enabled`]});u(await f(`Updating`,async()=>r.zeroTrust.dlp.profiles.custom.update({...o,account_id:i,profile_id:n[`profile-id`]})),{successLabel:`Updated`})}},_d={command:`custom`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(ud).command(fd).command(md).command(gd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function vd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yd={command:`get <profile-id>`,describe:`Fetches a DLP profile by ID.`,builder:vd,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp profiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/profiles/${t[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(t[`profile-id`]))}`,pathParams:{"profile-id":String(t[`profile-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.dlp.profiles.get({account_id:r,profile_id:t[`profile-id`]})),{successLabel:`Loaded`})}};function bd(e){return e.option(`all`,{type:`boolean`,description:`Return all profiles, including those that current account does not have access to.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xd={command:`list`,describe:`Lists all DLP profiles in an account.`,builder:bd,handler:async t=>{let n={all:t.all};if(t.dryRun){d({command:`cf zero-trust dlp profiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/profiles`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.dlp.profiles.list({account_id:i,...n})),{successLabel:`Loaded`})}};function Sd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`enabled-entries`,{type:`string`,array:!0,description:`The enabled_entries field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Predefined profiles can not be created. This endpoint will only update an existing predefined profiles settings.`})}const Cd={command:`create <profile-id>`,describe:"This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Creates a DLP predefined profile. Only supports enabling/disabling entries.",builder:Sd,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp profiles predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/profiles/predefined/${t[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(t[`profile-id`]))}/config`,pathParams:{"profile-id":String(t[`profile-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({ai_context_enabled:t[`ai-context-enabled`],allowed_match_count:t[`allowed-match-count`],confidence_threshold:p(t[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:t[`enabled-entries`],ocr_enabled:t[`ocr-enabled`]}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.dlp.profiles.predefined.create({body:e,account_id:r,profile_id:t[`profile-id`]})),{successLabel:`Created`});return}let i=l({ai_context_enabled:t[`ai-context-enabled`],allowed_match_count:t[`allowed-match-count`],confidence_threshold:p(t[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:t[`enabled-entries`],ocr_enabled:t[`ocr-enabled`]});u(await f(`Creating`,async()=>n.zeroTrust.dlp.profiles.predefined.create({body:i,account_id:r,profile_id:t[`profile-id`]})),{successLabel:`Created`})}};function wd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Td={command:`delete <profile-id>`,describe:`This is a no-op as predefined profiles can't be deleted but is needed for our generated terraform API.`,builder:wd,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp profiles predefined delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/profiles/predefined/${t[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(t[`profile-id`]))}`,pathParams:{"profile-id":String(t[`profile-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dlp.profiles.predefined.delete({account_id:r,profile_id:t[`profile-id`]})),{successLabel:`Deleted`})}};function Ed(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dd={command:`get <profile-id>`,describe:"This is similar to `get_predefined` but only returns entries that are enabled. This is needed for our terraform API Fetches a predefined DLP profile by id.",builder:Ed,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp profiles predefined get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/profiles/predefined/${t[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(t[`profile-id`]))}/config`,pathParams:{"profile-id":String(t[`profile-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.dlp.profiles.predefined.get({account_id:r,profile_id:t[`profile-id`]})),{successLabel:`Loaded`})}};function Od(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`enabled-entries`,{type:`string`,array:!0,description:`The enabled_entries field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the predefined profile.`})}const kd={command:`update <profile-id>`,describe:"This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Updates a DLP predefined profile. Only supports enabling/disabling entries.",builder:Od,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust dlp profiles predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/profiles/predefined/${t[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(t[`profile-id`]))}/config`,pathParams:{"profile-id":String(t[`profile-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({ai_context_enabled:t[`ai-context-enabled`],allowed_match_count:t[`allowed-match-count`],confidence_threshold:p(t[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:t[`enabled-entries`],ocr_enabled:t[`ocr-enabled`]}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.dlp.profiles.predefined.update({body:e,account_id:r,profile_id:t[`profile-id`]})),{successLabel:`Updated`});return}let i=l({ai_context_enabled:t[`ai-context-enabled`],allowed_match_count:t[`allowed-match-count`],confidence_threshold:p(t[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:t[`enabled-entries`],ocr_enabled:t[`ocr-enabled`]});u(await f(`Updating`,async()=>n.zeroTrust.dlp.profiles.predefined.update({body:i,account_id:r,profile_id:t[`profile-id`]})),{successLabel:`Updated`})}},Ad={command:`predefined`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Cd).command(Td).command(Dd).command(kd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},jd={command:`profiles`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(yd).command(xd).command(_d).command(Ad).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Md={command:`dlp`,describe:`Operations for dlp`,builder:e=>e.command($).command(Cu).command(Zu).command(ed).command(rd).command(cd).command(jd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Nd(e){return e.option(`description`,{type:`string`,description:`The description field`,default:``}).option(`match-percent`,{type:`number`,description:`The match_percent field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new document fingerprint.`})}const Pd={command:`fingerprints`,describe:`Creates a new document fingerprint for DLP scanning. Document fingerprints detect documents that are structurally similar to the uploaded sample.`,builder:Nd,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust document-fingerprints create document fingerprints`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/document_fingerprints`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({description:p(n.description,`description`,`text`),match_percent:n[`match-percent`],name:p(n.name,`name`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.documentFingerprints.create.document.fingerprints({...e,account_id:i})),{successLabel:`Created`});return}if(n[`match-percent`]===void 0)throw Error(`--match-percent is required (or pass --body with this field set).`);n.name===void 0&&(n.name=await t(`name`,`The name field`));let o=l({description:p(n.description,`description`,`text`),match_percent:n[`match-percent`],name:p(n.name,`name`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.documentFingerprints.create.document.fingerprints({...o,account_id:i})),{successLabel:`Created`})}},Fd={command:`document`,describe:`Document Fingerprints operations`,builder:e=>e.command(Pd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Id(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`match-percent`,{type:`number`,description:`The match_percent field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the document fingerprint to update.`})}const Ld={command:`v2 <document-fingerprint-id>`,describe:`Updates metadata for an existing document fingerprint, such as its name or description.`,builder:Id,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust document-fingerprints create v2`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/document_fingerprints/${t[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(t[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(t[`document-fingerprint-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({description:p(t.description,`description`,`text`),match_percent:t[`match-percent`],name:p(t.name,`name`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.documentFingerprints.create.v2({...e,account_id:r,document_fingerprint_id:t[`document-fingerprint-id`]})),{successLabel:`Created`});return}let i=l({description:p(t.description,`description`,`text`),match_percent:t[`match-percent`],name:p(t.name,`name`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.documentFingerprints.create.v2({...i,account_id:r,document_fingerprint_id:t[`document-fingerprint-id`]})),{successLabel:`Created`})}},Rd={command:`create`,describe:`Document Fingerprints operations`,builder:e=>e.command(Ld).command(Fd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function zd(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Bd={command:`delete <document-fingerprint-id>`,describe:`Removes a document fingerprint from DLP configuration. Documents matching this fingerprint will no longer be detected.`,builder:zd,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust document-fingerprints delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/document_fingerprints/${t[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(t[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(t[`document-fingerprint-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.documentFingerprints.delete({account_id:r,document_fingerprint_id:t[`document-fingerprint-id`]})),{successLabel:`Deleted`})}};function Vd(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Hd={command:`fingerprints <document-fingerprint-id>`,describe:`Gets a document fingerprint and its latest upload status.`,builder:Vd,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust document-fingerprints get document fingerprints`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/document_fingerprints/${t[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(t[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(t[`document-fingerprint-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.documentFingerprints.get.document.fingerprints({account_id:r,document_fingerprint_id:t[`document-fingerprint-id`]})),{successLabel:`Loaded`})}},Ud={command:`document`,describe:`Document Fingerprints operations`,builder:e=>e.command(Hd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Wd(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gd={command:`all`,describe:`Lists all document fingerprints configured for DLP scanning in the account.`,builder:Wd,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust document-fingerprints get fingerprints all`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/document_fingerprints`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.documentFingerprints.get.fingerprints.all({account_id:r})),{successLabel:`Loaded`})}},Kd={command:`fingerprints`,describe:`Document Fingerprints operations`,builder:e=>e.command(Gd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},qd={command:`get`,describe:`Operations for document-fingerprints.get`,builder:e=>e.command(Ud).command(Kd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Jd(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`File used for document fingerprinting.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Yd={command:`update <document-fingerprint-id>`,describe:`Uploads a new document to create or update a fingerprint. The document structure is analyzed to enable detection of similar documents.`,builder:Jd,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust document-fingerprints update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/document_fingerprints/${t[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(t[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(t[`document-fingerprint-id`]??``)},bodyKind:`multipart`,body:{body:t.body,file:t.file}});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.file!==void 0||t.body!==void 0){let e=new FormData;if(t.file){let n=m(t.file);e.append(`file`,new Blob([n]),t.file.split(/[\\/]/).filter(Boolean).pop())}else t.body!==void 0&&e.append(`file`,t.body);u(await f(`Updating`,async()=>o(n,`PUT`,`/accounts/${r}/dlp/document_fingerprints/${encodeURIComponent(String(t[`document-fingerprint-id`]))}`,{body:e})),{successLabel:`Updated`});return}if(t.body){let e=p(t.body,`body`,`binary`);u(await f(`Updating`,async()=>o(n,`PUT`,`/accounts/${r}/dlp/document_fingerprints/${encodeURIComponent(String(t[`document-fingerprint-id`]))}`,{body:e,headers:{"Content-Type":`multipart/form-data`}})),{successLabel:`Updated`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Xd={command:`document-fingerprints`,describe:`Document Fingerprints operations`,builder:e=>e.command(Bd).command(Yd).command(Rd).command(qd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Zd(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qd={command:`list`,describe:`List all application and application type mappings.`,builder:Zd,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway app-types list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/app_types`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.appTypes.list({account_id:r})),{successLabel:`Loaded`})}},$d={command:`app-types`,describe:`Operations for gateway.app-types`,builder:e=>e.command(Qd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ef(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const tf={command:`get`,describe:`Retrieve all Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.`,builder:ef,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway audit-ssh-settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/audit_ssh_settings`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.auditSshSettings.get({account_id:r})),{successLabel:`Loaded`})}};function nf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const rf={command:`rotate-seed`,describe:`Rotate the SSH account seed that generates the host key identity when connecting through the Cloudflare SSH Proxy.`,builder:nf,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway audit-ssh-settings rotate-seed`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/audit_ssh_settings/rotate_seed`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Creating`,async()=>n.zeroTrust.gateway.auditSshSettings.rotateSeed({account_id:r})),{successLabel:`Created`})}};function af(e){return e.option(`public-key`,{type:`string`,description:`Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const of={command:`update`,describe:`Update Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.`,builder:af,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust gateway audit-ssh-settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/audit_ssh_settings`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({public_key:p(n[`public-key`],`public-key`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Updating`,async()=>r.zeroTrust.gateway.auditSshSettings.update({...e,account_id:i})),{successLabel:`Updated`});return}n[`public-key`]===void 0&&(n[`public-key`]=await t(`public-key`,`Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging.`));let o=l({public_key:p(n[`public-key`],`public-key`,`text`)});u(await f(`Updating`,async()=>r.zeroTrust.gateway.auditSshSettings.update({...o,account_id:i})),{successLabel:`Updated`})}},sf={command:`audit-ssh-settings`,describe:`Operations for gateway.audit-ssh-settings`,builder:e=>e.command(tf).command(rf).command(of).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lf={command:`list`,describe:`List all categories.`,builder:cf,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway categories list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/categories`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.categories.list({account_id:r})),{successLabel:`Loaded`})}},uf={command:`categories`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(lf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function df(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ff={command:`activate <certificate-id>`,describe:`Bind a single Zero Trust certificate to the edge.`,builder:df,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway certificates activate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/certificates/${t[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(t[`certificate-id`]))}/activate`,pathParams:{"certificate-id":String(t[`certificate-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Creating`,async()=>n.zeroTrust.gateway.certificates.activate({account_id:r,certificate_id:t[`certificate-id`]})),{successLabel:`Created`})}};function pf(e){return e.option(`validity-period-days`,{type:`number`,description:"Sets the certificate validity period in days (range: 1-10,950 days / ~30 years). Defaults to 1,825 days (5 years). **Important**: This field is only settable during the certificate creation.  Certificates becomes immutable after creation - use the `/activate` and `/deactivate` endpoints to manage certificate lifecycle."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const mf={command:`create`,describe:`Create a new Zero Trust certificate.`,builder:pf,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/certificates`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({validity_period_days:t[`validity-period-days`]}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.gateway.certificates.create({...e,account_id:r})),{successLabel:`Created`});return}let i=l({validity_period_days:t[`validity-period-days`]});u(await f(`Creating`,async()=>n.zeroTrust.gateway.certificates.create({...i,account_id:r})),{successLabel:`Created`})}};function hf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gf={command:`deactivate <certificate-id>`,describe:`Unbind a single Zero Trust certificate from the edge.`,builder:hf,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway certificates deactivate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/certificates/${t[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(t[`certificate-id`]))}/deactivate`,pathParams:{"certificate-id":String(t[`certificate-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Creating`,async()=>n.zeroTrust.gateway.certificates.deactivate({account_id:r,certificate_id:t[`certificate-id`]})),{successLabel:`Created`})}};function _f(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const vf={command:`delete <certificate-id>`,describe:`Delete a gateway-managed Zero Trust certificate. You must deactivate the certificate from the edge (inactive) before deleting it.`,builder:_f,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/certificates/${t[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(t[`certificate-id`]))}`,pathParams:{"certificate-id":String(t[`certificate-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.gateway.certificates.delete({account_id:r,certificate_id:t[`certificate-id`]})),{successLabel:`Deleted`})}};function yf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const bf={command:`get <certificate-id>`,describe:`Get a single Zero Trust certificate.`,builder:yf,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/certificates/${t[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(t[`certificate-id`]))}`,pathParams:{"certificate-id":String(t[`certificate-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.certificates.get({account_id:r,certificate_id:t[`certificate-id`]})),{successLabel:`Loaded`})}};function xf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sf={command:`list`,describe:`List all Zero Trust certificates for an account.`,builder:xf,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/certificates`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.certificates.list({account_id:r})),{successLabel:`Loaded`})}},Cf={command:`certificates`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(ff).command(mf).command(gf).command(vf).command(bf).command(Sf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function wf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Tf={command:`get`,describe:`Retrieve the current Zero Trust certificate configuration.`,builder:wf,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway configurations custom-certificate get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/configuration/custom_certificate`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.configurations.customCertificate.get({account_id:r})),{successLabel:`Loaded`})}},Ef={command:`custom-certificate`,describe:`Operations for gateway.configurations.custom-certificate`,builder:e=>e.command(Tf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Df(e){return e.option(`settings-activity-log-enabled`,{type:`boolean`,description:`Specify whether to log activity.`}).option(`settings-antivirus-enabled-download-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on downloads.`}).option(`settings-antivirus-enabled-upload-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on uploads.`}).option(`settings-antivirus-fail-closed`,{type:`boolean`,description:`Specify whether to block requests for unscannable files.`}).option(`settings-antivirus-notification-settings-enabled`,{type:`boolean`,description:`Specify whether to enable notifications.`}).option(`settings-antivirus-notification-settings-include-context`,{type:`boolean`,description:`Specify whether to include context information as query parameters.`}).option(`settings-antivirus-notification-settings-msg`,{type:`string`,description:`Specify the message to show in the notification.`}).option(`settings-antivirus-notification-settings-support-url`,{type:`string`,description:`Specify a URL that directs users to more information. If unset, the notification opens a block page.`}).option(`settings-block-page-background-color`,{type:`string`,description:"Specify the block page background color in `#rrggbb` format when the mode is customized_block_page."}).option(`settings-block-page-enabled`,{type:`boolean`,description:`Specify whether to enable the custom block page.`}).option(`settings-block-page-footer-text`,{type:`string`,description:`Specify the block page footer text when the mode is customized_block_page.`}).option(`settings-block-page-header-text`,{type:`string`,description:`Specify the block page header text when the mode is customized_block_page.`}).option(`settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to append context to target_uri as query parameters. This applies only when the mode is redirect_uri.`}).option(`settings-block-page-logo-path`,{type:`string`,description:`Specify the full URL to the logo file when the mode is customized_block_page.`}).option(`settings-block-page-mailto-address`,{type:`string`,description:`Specify the admin email for users to contact when the mode is customized_block_page.`}).option(`settings-block-page-mailto-subject`,{type:`string`,description:`Specify the subject line for emails created from the block page when the mode is customized_block_page.`}).option(`settings-block-page-mode`,{type:`string`,description:`Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.`,choices:[`customized_block_page`,`redirect_uri`]}).option(`settings-block-page-name`,{type:`string`,description:`Specify the block page title when the mode is customized_block_page.`}).option(`settings-block-page-suppress-footer`,{type:`boolean`,description:`Specify whether to suppress detailed information at the bottom of the block page when the mode is customized_block_page.`}).option(`settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to redirect users to when the mode is redirect_uri.`}).option(`settings-body-scanning-inspection-mode`,{type:`string`,description:"Specify the inspection mode as either `deep` or `shallow`.",choices:[`deep`,`shallow`]}).option(`settings-browser-isolation-non-identity-enabled`,{type:`boolean`,description:`Specify whether to enable non-identity onramp support for Browser Isolation.`}).option(`settings-browser-isolation-url-browser-isolation-enabled`,{type:`boolean`,description:`Specify whether to enable Clientless Browser Isolation.`}).option(`settings-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.`}).option(`settings-custom-certificate-enabled`,{type:`boolean`,description:`Specify whether to enable a custom certificate authority for signing Gateway traffic.`}).option(`settings-custom-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate (ID from MTLS certificate store).`}).option(`settings-extended-email-matching-enabled`,{type:`boolean`,description:`Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.`}).option(`settings-fips-tls`,{type:`boolean`,description:`Enforce cipher suites and TLS versions compliant with FIPS 140-2.`}).option(`settings-host-selector-enabled`,{type:`boolean`,description:`Specify whether to enable filtering via hosts for egress policies.`}).option(`settings-inspection-mode`,{type:`string`,description:`Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.`,choices:[`static`,`dynamic`]}).option(`settings-max-ttl-secs`,{type:`number`,description:"Account-level cap on DNS response TTLs, in seconds. Gateway rewrites DNS responses so returned record TTLs do not exceed this value. Null means no cap. Each DNS location can inherit, override, or disable it through the location `max_ttl` setting."}).option(`settings-protocol-detection-enabled`,{type:`boolean`,description:`Specify whether to detect protocols from the initial bytes of client traffic.`}).option(`settings-sandbox-enabled`,{type:`boolean`,description:`Specify whether to enable the sandbox.`}).option(`settings-sandbox-fallback-action`,{type:`string`,description:`Specify the action to take when the system cannot scan the file.`,choices:[`allow`,`block`]}).option(`settings-tls-decrypt-enabled`,{type:`boolean`,description:`Specify whether to inspect encrypted HTTP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Specify account settings.`}).check(e=>{if(`settings-activity-log-enabled.settings-antivirus-enabled-download-phase.settings-antivirus-enabled-upload-phase.settings-antivirus-fail-closed.settings-antivirus-notification-settings-enabled.settings-antivirus-notification-settings-include-context.settings-antivirus-notification-settings-msg.settings-antivirus-notification-settings-support-url.settings-block-page-background-color.settings-block-page-enabled.settings-block-page-footer-text.settings-block-page-header-text.settings-block-page-include-context.settings-block-page-logo-path.settings-block-page-mailto-address.settings-block-page-mailto-subject.settings-block-page-name.settings-block-page-suppress-footer.settings-block-page-target-uri.settings-body-scanning-inspection-mode.settings-browser-isolation-non-identity-enabled.settings-browser-isolation-url-browser-isolation-enabled.settings-certificate-id.settings-custom-certificate-enabled.settings-custom-certificate-id.settings-extended-email-matching-enabled.settings-fips-tls.settings-host-selector-enabled.settings-inspection-mode.settings-max-ttl-secs.settings-protocol-detection-enabled.settings-sandbox-enabled.settings-sandbox-fallback-action.settings-tls-decrypt-enabled`.split(`.`).some(t=>e[t]!==void 0)){let t=[`settings-certificate-id`,`settings-custom-certificate-enabled`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --settings-* flag is set`)}return!0})}const Of={command:`edit`,describe:"Update (PATCH) a single subcollection of settings such as `antivirus`, `tls_decrypt`, `activity_log`, `block_page`, `browser_isolation`, `fips`, `body_scanning`, `certificate`, or `max_ttl_secs` without updating the entire configuration object. This endpoint returns an error if any settings collection lacks proper configuration.",builder:Df,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway configurations edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({settings:{activity_log:{enabled:t[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:t[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:t[`settings-antivirus-enabled-upload-phase`],fail_closed:t[`settings-antivirus-fail-closed`],notification_settings:{enabled:t[`settings-antivirus-notification-settings-enabled`],include_context:t[`settings-antivirus-notification-settings-include-context`],msg:p(t[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:p(t[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:p(t[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:t[`settings-block-page-enabled`],footer_text:p(t[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:p(t[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:t[`settings-block-page-include-context`],logo_path:p(t[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:p(t[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:p(t[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:p(t[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:p(t[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:t[`settings-block-page-suppress-footer`],target_uri:p(t[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:p(t[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:t[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:t[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:p(t[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:t[`settings-custom-certificate-enabled`],id:p(t[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:t[`settings-extended-email-matching-enabled`]},fips:{tls:t[`settings-fips-tls`]},host_selector:{enabled:t[`settings-host-selector-enabled`]},inspection:{mode:p(t[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:t[`settings-max-ttl-secs`],protocol_detection:{enabled:t[`settings-protocol-detection-enabled`]},sandbox:{enabled:t[`settings-sandbox-enabled`],fallback_action:p(t[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:t[`settings-tls-decrypt-enabled`]}}}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.gateway.configurations.edit({body:e,account_id:r})),{successLabel:`Updated`});return}let i=l({settings:{activity_log:{enabled:t[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:t[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:t[`settings-antivirus-enabled-upload-phase`],fail_closed:t[`settings-antivirus-fail-closed`],notification_settings:{enabled:t[`settings-antivirus-notification-settings-enabled`],include_context:t[`settings-antivirus-notification-settings-include-context`],msg:p(t[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:p(t[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:p(t[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:t[`settings-block-page-enabled`],footer_text:p(t[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:p(t[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:t[`settings-block-page-include-context`],logo_path:p(t[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:p(t[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:p(t[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:p(t[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:p(t[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:t[`settings-block-page-suppress-footer`],target_uri:p(t[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:p(t[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:t[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:t[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:p(t[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:t[`settings-custom-certificate-enabled`],id:p(t[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:t[`settings-extended-email-matching-enabled`]},fips:{tls:t[`settings-fips-tls`]},host_selector:{enabled:t[`settings-host-selector-enabled`]},inspection:{mode:p(t[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:t[`settings-max-ttl-secs`],protocol_detection:{enabled:t[`settings-protocol-detection-enabled`]},sandbox:{enabled:t[`settings-sandbox-enabled`],fallback_action:p(t[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:t[`settings-tls-decrypt-enabled`]}}});u(await f(`Updating`,async()=>n.zeroTrust.gateway.configurations.edit({body:i,account_id:r})),{successLabel:`Updated`})}};function kf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Af={command:`get`,describe:`Retrieve the current Zero Trust account configuration.`,builder:kf,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway configurations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.configurations.get({account_id:r})),{successLabel:`Loaded`})}};function jf(e){return e.option(`settings-activity-log-enabled`,{type:`boolean`,description:`Specify whether to log activity.`}).option(`settings-antivirus-enabled-download-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on downloads.`}).option(`settings-antivirus-enabled-upload-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on uploads.`}).option(`settings-antivirus-fail-closed`,{type:`boolean`,description:`Specify whether to block requests for unscannable files.`}).option(`settings-antivirus-notification-settings-enabled`,{type:`boolean`,description:`Specify whether to enable notifications.`}).option(`settings-antivirus-notification-settings-include-context`,{type:`boolean`,description:`Specify whether to include context information as query parameters.`}).option(`settings-antivirus-notification-settings-msg`,{type:`string`,description:`Specify the message to show in the notification.`}).option(`settings-antivirus-notification-settings-support-url`,{type:`string`,description:`Specify a URL that directs users to more information. If unset, the notification opens a block page.`}).option(`settings-block-page-background-color`,{type:`string`,description:"Specify the block page background color in `#rrggbb` format when the mode is customized_block_page."}).option(`settings-block-page-enabled`,{type:`boolean`,description:`Specify whether to enable the custom block page.`}).option(`settings-block-page-footer-text`,{type:`string`,description:`Specify the block page footer text when the mode is customized_block_page.`}).option(`settings-block-page-header-text`,{type:`string`,description:`Specify the block page header text when the mode is customized_block_page.`}).option(`settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to append context to target_uri as query parameters. This applies only when the mode is redirect_uri.`}).option(`settings-block-page-logo-path`,{type:`string`,description:`Specify the full URL to the logo file when the mode is customized_block_page.`}).option(`settings-block-page-mailto-address`,{type:`string`,description:`Specify the admin email for users to contact when the mode is customized_block_page.`}).option(`settings-block-page-mailto-subject`,{type:`string`,description:`Specify the subject line for emails created from the block page when the mode is customized_block_page.`}).option(`settings-block-page-mode`,{type:`string`,description:`Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.`,choices:[`customized_block_page`,`redirect_uri`]}).option(`settings-block-page-name`,{type:`string`,description:`Specify the block page title when the mode is customized_block_page.`}).option(`settings-block-page-suppress-footer`,{type:`boolean`,description:`Specify whether to suppress detailed information at the bottom of the block page when the mode is customized_block_page.`}).option(`settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to redirect users to when the mode is redirect_uri.`}).option(`settings-body-scanning-inspection-mode`,{type:`string`,description:"Specify the inspection mode as either `deep` or `shallow`.",choices:[`deep`,`shallow`]}).option(`settings-browser-isolation-non-identity-enabled`,{type:`boolean`,description:`Specify whether to enable non-identity onramp support for Browser Isolation.`}).option(`settings-browser-isolation-url-browser-isolation-enabled`,{type:`boolean`,description:`Specify whether to enable Clientless Browser Isolation.`}).option(`settings-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.`}).option(`settings-custom-certificate-enabled`,{type:`boolean`,description:`Specify whether to enable a custom certificate authority for signing Gateway traffic.`}).option(`settings-custom-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate (ID from MTLS certificate store).`}).option(`settings-extended-email-matching-enabled`,{type:`boolean`,description:`Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.`}).option(`settings-fips-tls`,{type:`boolean`,description:`Enforce cipher suites and TLS versions compliant with FIPS 140-2.`}).option(`settings-host-selector-enabled`,{type:`boolean`,description:`Specify whether to enable filtering via hosts for egress policies.`}).option(`settings-inspection-mode`,{type:`string`,description:`Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.`,choices:[`static`,`dynamic`]}).option(`settings-max-ttl-secs`,{type:`number`,description:"Account-level cap on DNS response TTLs, in seconds. Gateway rewrites DNS responses so returned record TTLs do not exceed this value. Null means no cap. Each DNS location can inherit, override, or disable it through the location `max_ttl` setting."}).option(`settings-protocol-detection-enabled`,{type:`boolean`,description:`Specify whether to detect protocols from the initial bytes of client traffic.`}).option(`settings-sandbox-enabled`,{type:`boolean`,description:`Specify whether to enable the sandbox.`}).option(`settings-sandbox-fallback-action`,{type:`string`,description:`Specify the action to take when the system cannot scan the file.`,choices:[`allow`,`block`]}).option(`settings-tls-decrypt-enabled`,{type:`boolean`,description:`Specify whether to inspect encrypted HTTP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Specify account settings.`}).check(e=>{if(`settings-activity-log-enabled.settings-antivirus-enabled-download-phase.settings-antivirus-enabled-upload-phase.settings-antivirus-fail-closed.settings-antivirus-notification-settings-enabled.settings-antivirus-notification-settings-include-context.settings-antivirus-notification-settings-msg.settings-antivirus-notification-settings-support-url.settings-block-page-background-color.settings-block-page-enabled.settings-block-page-footer-text.settings-block-page-header-text.settings-block-page-include-context.settings-block-page-logo-path.settings-block-page-mailto-address.settings-block-page-mailto-subject.settings-block-page-name.settings-block-page-suppress-footer.settings-block-page-target-uri.settings-body-scanning-inspection-mode.settings-browser-isolation-non-identity-enabled.settings-browser-isolation-url-browser-isolation-enabled.settings-certificate-id.settings-custom-certificate-enabled.settings-custom-certificate-id.settings-extended-email-matching-enabled.settings-fips-tls.settings-host-selector-enabled.settings-inspection-mode.settings-max-ttl-secs.settings-protocol-detection-enabled.settings-sandbox-enabled.settings-sandbox-fallback-action.settings-tls-decrypt-enabled`.split(`.`).some(t=>e[t]!==void 0)){let t=[`settings-certificate-id`,`settings-custom-certificate-enabled`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --settings-* flag is set`)}return!0})}const Mf={command:`update`,describe:`Update the current Zero Trust account configuration.`,builder:jf,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway configurations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({settings:{activity_log:{enabled:t[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:t[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:t[`settings-antivirus-enabled-upload-phase`],fail_closed:t[`settings-antivirus-fail-closed`],notification_settings:{enabled:t[`settings-antivirus-notification-settings-enabled`],include_context:t[`settings-antivirus-notification-settings-include-context`],msg:p(t[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:p(t[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:p(t[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:t[`settings-block-page-enabled`],footer_text:p(t[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:p(t[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:t[`settings-block-page-include-context`],logo_path:p(t[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:p(t[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:p(t[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:p(t[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:p(t[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:t[`settings-block-page-suppress-footer`],target_uri:p(t[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:p(t[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:t[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:t[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:p(t[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:t[`settings-custom-certificate-enabled`],id:p(t[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:t[`settings-extended-email-matching-enabled`]},fips:{tls:t[`settings-fips-tls`]},host_selector:{enabled:t[`settings-host-selector-enabled`]},inspection:{mode:p(t[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:t[`settings-max-ttl-secs`],protocol_detection:{enabled:t[`settings-protocol-detection-enabled`]},sandbox:{enabled:t[`settings-sandbox-enabled`],fallback_action:p(t[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:t[`settings-tls-decrypt-enabled`]}}}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.gateway.configurations.update({body:e,account_id:r})),{successLabel:`Updated`});return}let i=l({settings:{activity_log:{enabled:t[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:t[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:t[`settings-antivirus-enabled-upload-phase`],fail_closed:t[`settings-antivirus-fail-closed`],notification_settings:{enabled:t[`settings-antivirus-notification-settings-enabled`],include_context:t[`settings-antivirus-notification-settings-include-context`],msg:p(t[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:p(t[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:p(t[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:t[`settings-block-page-enabled`],footer_text:p(t[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:p(t[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:t[`settings-block-page-include-context`],logo_path:p(t[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:p(t[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:p(t[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:p(t[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:p(t[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:t[`settings-block-page-suppress-footer`],target_uri:p(t[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:p(t[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:t[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:t[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:p(t[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:t[`settings-custom-certificate-enabled`],id:p(t[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:t[`settings-extended-email-matching-enabled`]},fips:{tls:t[`settings-fips-tls`]},host_selector:{enabled:t[`settings-host-selector-enabled`]},inspection:{mode:p(t[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:t[`settings-max-ttl-secs`],protocol_detection:{enabled:t[`settings-protocol-detection-enabled`]},sandbox:{enabled:t[`settings-sandbox-enabled`],fallback_action:p(t[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:t[`settings-tls-decrypt-enabled`]}}});u(await f(`Updating`,async()=>n.zeroTrust.gateway.configurations.update({body:i,account_id:r})),{successLabel:`Updated`})}},Nf={command:`configurations`,describe:`Operations for gateway.configurations`,builder:e=>e.command(Of).command(Af).command(Mf).command(Ef).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Pf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ff={command:`create`,describe:`Create a Zero Trust account for an existing Cloudflare account.`,builder:Pf,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Creating`,async()=>n.zeroTrust.gateway.create({account_id:r})),{successLabel:`Created`})}};function If(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Lf={command:`list`,describe:`Retrieve information about the current Zero Trust account.`,builder:If,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.list({account_id:r})),{successLabel:`Loaded`})}};function Rf(e){return e.option(`description`,{type:`string`,description:`Provide the list description.`}).option(`name`,{type:`string`,description:`Specify the list name.`}).option(`type`,{type:`string`,description:`Specify the list type.`,choices:[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const zf={command:`create`,describe:`Creates a new Zero Trust list.`,builder:Rf,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust gateway lists create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/lists`,pathParams:{},bodyKind:`json`,body:r.body===void 0?l({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`)}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Creating`,async()=>i.zeroTrust.gateway.lists.create({...e,account_id:o})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await t(`name`,`Specify the list name.`)),r.type===void 0&&(r.type=await n(`type`,`Specify the list type.`,[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]));let m=l({description:p(r.description,`description`,`text`),name:p(r.name,`name`,`text`),type:p(r.type,`type`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.gateway.lists.create({...m,account_id:o})),{successLabel:`Created`})}};function Bf(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Vf={command:`delete <list-id>`,describe:`Deletes a Zero Trust list.`,builder:Bf,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway lists delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/lists/${t[`list-id`]==null?`<list-id>`:encodeURIComponent(String(t[`list-id`]))}`,pathParams:{"list-id":String(t[`list-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.gateway.lists.delete({account_id:r,list_id:t[`list-id`]})),{successLabel:`Deleted`})}};function Hf(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`remove`,{type:`string`,array:!0,description:`Lists of item values you want to remove.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Uf={command:`edit <list-id>`,describe:`Appends or removes an item from a configured Zero Trust list.`,builder:Hf,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway lists edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/lists/${t[`list-id`]==null?`<list-id>`:encodeURIComponent(String(t[`list-id`]))}`,pathParams:{"list-id":String(t[`list-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({remove:t.remove}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.gateway.lists.edit({...e,account_id:r,list_id:t[`list-id`]})),{successLabel:`Updated`});return}let i=l({remove:t.remove});u(await f(`Updating`,async()=>n.zeroTrust.gateway.lists.edit({...i,account_id:r,list_id:t[`list-id`]})),{successLabel:`Updated`})}};function Wf(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gf={command:`get <list-id>`,describe:`Fetch a single Zero Trust list.`,builder:Wf,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway lists get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/lists/${t[`list-id`]==null?`<list-id>`:encodeURIComponent(String(t[`list-id`]))}`,pathParams:{"list-id":String(t[`list-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.lists.get({account_id:r,list_id:t[`list-id`]})),{successLabel:`Loaded`})}};function Kf(e){return e.option(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qf={command:`list`,describe:`Fetch all items in a single Zero Trust list.`,builder:Kf,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway lists items list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/lists/${t[`list-id`]==null?`<list-id>`:encodeURIComponent(String(t[`list-id`]))}/items`,pathParams:{"list-id":String(t[`list-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.lists.items.list({account_id:r,list_id:t[`list-id`]})),{successLabel:`Loaded`})}},Jf={command:`items`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(qf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Yf(e){return e.option(`type`,{type:`string`,description:`Specify the list type.`,choices:[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xf={command:`list`,describe:`Fetch all Zero Trust lists for an account.`,builder:g(Yf),handler:async t=>{let n={type:t.type};if(t.dryRun){d({command:`cf zero-trust gateway lists list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/lists`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.gateway.lists.list({account_id:i,...n})),{successLabel:`Loaded`})}};function Zf(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`Provide the list description.`}).option(`name`,{type:`string`,description:`Specify the list name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Qf={command:`update <list-id>`,describe:`Updates a configured Zero Trust list. Skips updating list items if not included in the payload. A non empty list items will overwrite the existing list.`,builder:Zf,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust gateway lists update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/lists/${n[`list-id`]==null?`<list-id>`:encodeURIComponent(String(n[`list-id`]))}`,pathParams:{"list-id":String(n[`list-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Updating`,async()=>r.zeroTrust.gateway.lists.update({...e,account_id:i,list_id:n[`list-id`]})),{successLabel:`Updated`});return}n.name===void 0&&(n.name=await t(`name`,`Specify the list name.`));let o=l({description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`)});u(await f(`Updating`,async()=>r.zeroTrust.gateway.lists.update({...o,account_id:i,list_id:n[`list-id`]})),{successLabel:`Updated`})}},$f={command:`lists`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(zf).command(Vf).command(Uf).command(Gf).command(Xf).command(Qf).command(Jf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ep(e){return e.option(`client-default`,{type:`boolean`,description:`Indicate whether this location is the default location.`,default:!1}).option(`dns-destination-ips-id`,{type:`string`,description:`Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.`}).option(`ecs-support`,{type:`boolean`,description:`Indicate whether the location must resolve EDNS queries.`,default:!1}).option(`endpoints-doh-enabled`,{type:`boolean`,description:`Indicate whether the DOH endpoint is enabled for this location.`}).option(`endpoints-doh-require-token`,{type:`boolean`,description:`Specify whether the DOH endpoint requires user identity authentication.`}).option(`endpoints-dot-enabled`,{type:`boolean`,description:`Indicate whether the DOT endpoint is enabled for this location.`}).option(`endpoints-ipv4-enabled`,{type:`boolean`,description:`Indicate whether the IPv4 endpoint is enabled for this location.`}).option(`endpoints-ipv6-enabled`,{type:`boolean`,description:`Indicate whether the IPV6 endpoint is enabled for this location.`}).option(`max-ttl-mode`,{type:`string`,description:"`inherit` uses the account `max_ttl_secs`. `override` uses this location's `ttl_secs`. `disabled` leaves returned TTLs unchanged.",choices:[`inherit`,`override`,`disabled`]}).option(`max-ttl-ttl-secs`,{type:`number`,description:"Location-specific cap on DNS response TTLs, in seconds. Required when `mode` is `override`. Must be omitted when `mode` is `inherit` or `disabled`."}).option(`name`,{type:`string`,description:`Specify the location name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`max-ttl-mode`,`max-ttl-ttl-secs`].some(t=>e[t]!==void 0)){let t=[`max-ttl-mode`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --max_ttl-* flag is set`)}return!0})}const tp={command:`create`,describe:`Create a new Zero Trust Gateway location.`,builder:ep,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust gateway locations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/locations`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({client_default:n[`client-default`],dns_destination_ips_id:p(n[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:n[`ecs-support`],endpoints:{doh:{enabled:n[`endpoints-doh-enabled`],require_token:n[`endpoints-doh-require-token`]},dot:{enabled:n[`endpoints-dot-enabled`]},ipv4:{enabled:n[`endpoints-ipv4-enabled`]},ipv6:{enabled:n[`endpoints-ipv6-enabled`]}},max_ttl:{mode:p(n[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:n[`max-ttl-ttl-secs`]},name:p(n.name,`name`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.gateway.locations.create({...e,account_id:i})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await t(`name`,`Specify the location name.`));let o=l({client_default:n[`client-default`],dns_destination_ips_id:p(n[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:n[`ecs-support`],endpoints:{doh:{enabled:n[`endpoints-doh-enabled`],require_token:n[`endpoints-doh-require-token`]},dot:{enabled:n[`endpoints-dot-enabled`]},ipv4:{enabled:n[`endpoints-ipv4-enabled`]},ipv6:{enabled:n[`endpoints-ipv6-enabled`]}},max_ttl:{mode:p(n[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:n[`max-ttl-ttl-secs`]},name:p(n.name,`name`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.gateway.locations.create({...o,account_id:i})),{successLabel:`Created`})}};function np(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const rp={command:`delete <location-id>`,describe:`Delete a configured Zero Trust Gateway location.`,builder:np,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway locations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/locations/${t[`location-id`]==null?`<location-id>`:encodeURIComponent(String(t[`location-id`]))}`,pathParams:{"location-id":String(t[`location-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.gateway.locations.delete({account_id:r,location_id:t[`location-id`]})),{successLabel:`Deleted`})}};function ip(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ap={command:`get <location-id>`,describe:`Get a single Zero Trust Gateway location.`,builder:ip,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway locations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/locations/${t[`location-id`]==null?`<location-id>`:encodeURIComponent(String(t[`location-id`]))}`,pathParams:{"location-id":String(t[`location-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.locations.get({account_id:r,location_id:t[`location-id`]})),{successLabel:`Loaded`})}};function op(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sp={command:`list`,describe:`List Zero Trust Gateway locations for an account.`,builder:op,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway locations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/locations`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.locations.list({account_id:r})),{successLabel:`Loaded`})}};function cp(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`client-default`,{type:`boolean`,description:`Indicate whether this location is the default location.`}).option(`dns-destination-ips-id`,{type:`string`,description:`Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.`}).option(`ecs-support`,{type:`boolean`,description:`Indicate whether the location must resolve EDNS queries.`}).option(`endpoints-doh-enabled`,{type:`boolean`,description:`Indicate whether the DOH endpoint is enabled for this location.`}).option(`endpoints-doh-require-token`,{type:`boolean`,description:`Specify whether the DOH endpoint requires user identity authentication.`}).option(`endpoints-dot-enabled`,{type:`boolean`,description:`Indicate whether the DOT endpoint is enabled for this location.`}).option(`endpoints-ipv4-enabled`,{type:`boolean`,description:`Indicate whether the IPv4 endpoint is enabled for this location.`}).option(`endpoints-ipv6-enabled`,{type:`boolean`,description:`Indicate whether the IPV6 endpoint is enabled for this location.`}).option(`max-ttl-mode`,{type:`string`,description:"`inherit` uses the account `max_ttl_secs`. `override` uses this location's `ttl_secs`. `disabled` leaves returned TTLs unchanged.",choices:[`inherit`,`override`,`disabled`]}).option(`max-ttl-ttl-secs`,{type:`number`,description:"Location-specific cap on DNS response TTLs, in seconds. Required when `mode` is `override`. Must be omitted when `mode` is `inherit` or `disabled`."}).option(`name`,{type:`string`,description:`Specify the location name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`max-ttl-mode`,`max-ttl-ttl-secs`].some(t=>e[t]!==void 0)){let t=[`max-ttl-mode`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --max_ttl-* flag is set`)}return!0})}const lp={command:`update <location-id>`,describe:`Update a configured Zero Trust Gateway location.`,builder:cp,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust gateway locations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/locations/${n[`location-id`]==null?`<location-id>`:encodeURIComponent(String(n[`location-id`]))}`,pathParams:{"location-id":String(n[`location-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({client_default:n[`client-default`],dns_destination_ips_id:p(n[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:n[`ecs-support`],endpoints:{doh:{enabled:n[`endpoints-doh-enabled`],require_token:n[`endpoints-doh-require-token`]},dot:{enabled:n[`endpoints-dot-enabled`]},ipv4:{enabled:n[`endpoints-ipv4-enabled`]},ipv6:{enabled:n[`endpoints-ipv6-enabled`]}},max_ttl:{mode:p(n[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:n[`max-ttl-ttl-secs`]},name:p(n.name,`name`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Updating`,async()=>r.zeroTrust.gateway.locations.update({...e,account_id:i,location_id:n[`location-id`]})),{successLabel:`Updated`});return}n.name===void 0&&(n.name=await t(`name`,`Specify the location name.`));let o=l({client_default:n[`client-default`],dns_destination_ips_id:p(n[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:n[`ecs-support`],endpoints:{doh:{enabled:n[`endpoints-doh-enabled`],require_token:n[`endpoints-doh-require-token`]},dot:{enabled:n[`endpoints-dot-enabled`]},ipv4:{enabled:n[`endpoints-ipv4-enabled`]},ipv6:{enabled:n[`endpoints-ipv6-enabled`]}},max_ttl:{mode:p(n[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:n[`max-ttl-ttl-secs`]},name:p(n.name,`name`,`text`)});u(await f(`Updating`,async()=>r.zeroTrust.gateway.locations.update({...o,account_id:i,location_id:n[`location-id`]})),{successLabel:`Updated`})}},up={command:`locations`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(tp).command(rp).command(ap).command(sp).command(lp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function dp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fp={command:`get`,describe:`Retrieve the current logging settings for the Zero Trust account.`,builder:dp,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway logging get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/logging`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.logging.get({account_id:r})),{successLabel:`Loaded`})}};function pp(e){return e.option(`redact-pii`,{type:`boolean`,description:`Indicate whether to redact personally identifiable information from activity logging (PII fields include source IP, user email, user ID, device ID, URL, referrer, and user agent).`}).option(`settings-by-rule-type-dns-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-dns-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`settings-by-rule-type-http-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-http-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`settings-by-rule-type-l4-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-l4-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const mp={command:`update`,describe:`Update logging settings for the current Zero Trust account.`,builder:pp,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway logging update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/logging`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({redact_pii:t[`redact-pii`],settings_by_rule_type:{dns:{log_all:t[`settings-by-rule-type-dns-log-all`],log_blocks:t[`settings-by-rule-type-dns-log-blocks`]},http:{log_all:t[`settings-by-rule-type-http-log-all`],log_blocks:t[`settings-by-rule-type-http-log-blocks`]},l4:{log_all:t[`settings-by-rule-type-l4-log-all`],log_blocks:t[`settings-by-rule-type-l4-log-blocks`]}}}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.gateway.logging.update({body:e,account_id:r})),{successLabel:`Updated`});return}let i=l({redact_pii:t[`redact-pii`],settings_by_rule_type:{dns:{log_all:t[`settings-by-rule-type-dns-log-all`],log_blocks:t[`settings-by-rule-type-dns-log-blocks`]},http:{log_all:t[`settings-by-rule-type-http-log-all`],log_blocks:t[`settings-by-rule-type-http-log-blocks`]},l4:{log_all:t[`settings-by-rule-type-l4-log-all`],log_blocks:t[`settings-by-rule-type-l4-log-blocks`]}}});u(await f(`Updating`,async()=>n.zeroTrust.gateway.logging.update({body:i,account_id:r})),{successLabel:`Updated`})}},hp={command:`logging`,describe:`Operations for gateway.logging`,builder:e=>e.command(fp).command(mp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function gp(e){return e.option(`contents`,{type:`string`,description:`Actual contents of the PAC file`}).option(`description`,{type:`string`,description:`Detailed description of the PAC file.`}).option(`name`,{type:`string`,description:`Name of the PAC file.`}).option(`slug`,{type:`string`,description:`URL-friendly version of the PAC file name. If not provided, it will be auto-generated`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _p={command:`create`,describe:`Create a new Zero Trust Gateway PAC file.`,builder:gp,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust gateway pacfiles create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/pacfiles`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({contents:p(n.contents,`contents`,`text`),description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`),slug:p(n.slug,`slug`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.gateway.pacfiles.create({...e,account_id:i})),{successLabel:`Created`});return}n.contents===void 0&&(n.contents=await t(`contents`,`Actual contents of the PAC file`)),n.name===void 0&&(n.name=await t(`name`,`Name of the PAC file.`));let o=l({contents:p(n.contents,`contents`,`text`),description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`),slug:p(n.slug,`slug`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.gateway.pacfiles.create({...o,account_id:i})),{successLabel:`Created`})}};function vp(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const yp={command:`delete <pacfile-id>`,describe:`Delete a configured Zero Trust Gateway PAC file.`,builder:vp,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway pacfiles delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/pacfiles/${t[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(t[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(t[`pacfile-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.gateway.pacfiles.delete({account_id:r,pacfile_id:t[`pacfile-id`]})),{successLabel:`Deleted`})}};function bp(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xp={command:`get <pacfile-id>`,describe:`Get a single Zero Trust Gateway PAC file.`,builder:bp,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway pacfiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/pacfiles/${t[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(t[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(t[`pacfile-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.pacfiles.get({account_id:r,pacfile_id:t[`pacfile-id`]})),{successLabel:`Loaded`})}};function Sp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cp={command:`list`,describe:`List all Zero Trust Gateway PAC files for an account.`,builder:Sp,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway pacfiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/pacfiles`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.pacfiles.list({account_id:r})),{successLabel:`Loaded`})}};function wp(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`contents`,{type:`string`,description:`Actual contents of the PAC file`}).option(`description`,{type:`string`,description:`Detailed description of the PAC file.`}).option(`name`,{type:`string`,description:`Name of the PAC file.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Tp={command:`update <pacfile-id>`,describe:`Update a configured Zero Trust Gateway PAC file.`,builder:wp,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust gateway pacfiles update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/pacfiles/${n[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(n[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(n[`pacfile-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({contents:p(n.contents,`contents`,`text`),description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Updating`,async()=>r.zeroTrust.gateway.pacfiles.update({...e,account_id:i,pacfile_id:n[`pacfile-id`]})),{successLabel:`Updated`});return}n.contents===void 0&&(n.contents=await t(`contents`,`Actual contents of the PAC file`)),n.description===void 0&&(n.description=await t(`description`,`Detailed description of the PAC file.`)),n.name===void 0&&(n.name=await t(`name`,`Name of the PAC file.`));let o=l({contents:p(n.contents,`contents`,`text`),description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`)});u(await f(`Updating`,async()=>r.zeroTrust.gateway.pacfiles.update({...o,account_id:i,pacfile_id:n[`pacfile-id`]})),{successLabel:`Updated`})}},Ep={command:`pacfiles`,describe:`Operations for gateway.pacfiles`,builder:e=>e.command(_p).command(yp).command(xp).command(Cp).command(Tp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Dp(e){return e.option(`kind`,{type:`string`,description:`The proxy endpoint kind.`,choices:[`ip`,`identity`],default:`ip`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Op={command:`create`,describe:`Create a new Zero Trust Gateway proxy endpoint.`,builder:Dp,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust gateway proxy-endpoints create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/proxy_endpoints`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({kind:p(n.kind,`kind`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.gateway.proxyEndpoints.create({body:e,account_id:i})),{successLabel:`Created`});return}n.kind===`identity`&&n.kind===void 0&&(n.kind=await t(`kind`,`The proxy endpoint kind.`,{question:`Enter value for --kind`}));let o=l({kind:p(n.kind,`kind`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.gateway.proxyEndpoints.create({body:o,account_id:i})),{successLabel:`Created`})}};function kp(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ap={command:`delete <proxy-endpoint-id>`,describe:`Delete a configured Zero Trust Gateway proxy endpoint.`,builder:kp,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway proxy-endpoints delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/proxy_endpoints/${t[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(t[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(t[`proxy-endpoint-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.gateway.proxyEndpoints.delete({account_id:r,proxy_endpoint_id:t[`proxy-endpoint-id`]})),{successLabel:`Deleted`})}};function jp(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`ips`,{type:`string`,array:!0,description:`Specify the list of CIDRs to restrict ingress connections.`}).option(`name`,{type:`string`,description:`Specify the name of the proxy endpoint.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Mp={command:`edit <proxy-endpoint-id>`,describe:`Update a configured Zero Trust Gateway proxy endpoint.`,builder:jp,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway proxy-endpoints edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/proxy_endpoints/${t[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(t[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(t[`proxy-endpoint-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({ips:t.ips,name:p(t.name,`name`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.gateway.proxyEndpoints.edit({...e,account_id:r,proxy_endpoint_id:t[`proxy-endpoint-id`]})),{successLabel:`Updated`});return}let i=l({ips:t.ips,name:p(t.name,`name`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.gateway.proxyEndpoints.edit({...i,account_id:r,proxy_endpoint_id:t[`proxy-endpoint-id`]})),{successLabel:`Updated`})}};function Np(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pp={command:`get <proxy-endpoint-id>`,describe:`Get a single Zero Trust Gateway proxy endpoint.`,builder:Np,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway proxy-endpoints get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/proxy_endpoints/${t[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(t[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(t[`proxy-endpoint-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.proxyEndpoints.get({account_id:r,proxy_endpoint_id:t[`proxy-endpoint-id`]})),{successLabel:`Loaded`})}};function Fp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ip={command:`list`,describe:`List all Zero Trust Gateway proxy endpoints for an account.`,builder:Fp,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway proxy-endpoints list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/proxy_endpoints`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.proxyEndpoints.list({account_id:r})),{successLabel:`Loaded`})}},Lp={command:`proxy-endpoints`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(Op).command(Ap).command(Mp).command(Pp).command(Ip).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Rp(e){return e.option(`action`,{type:`string`,description:"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",choices:[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`]}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`device-posture`,{type:`string`,description:`Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`,default:!1}).option(`expiration-duration`,{type:`number`,description:"Defines the default duration a policy active in minutes. Must set in order to use the `reset_expiration` endpoint on this rule."}).option(`filters`,{type:`string`,array:!0,description:`Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.`}).option(`identity`,{type:`string`,description:`Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`rule-settings-allow-child-bypass`,{type:`boolean`,description:`Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.`}).option(`rule-settings-audit-ssh-command-logging`,{type:`boolean`,description:`Enable SSH command logging.`}).option(`rule-settings-biso-admin-controls-copy`,{type:`string`,description:`Configure copy behavior. If set to remote_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dcp`,{type:`boolean`,description:'Set to false to enable copy-pasting. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dd`,{type:`boolean`,description:'Set to false to enable downloading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dk`,{type:`boolean`,description:'Set to false to enable keyboard usage. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-download`,{type:`string`,description:`Configure download behavior. When set to remote_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dp`,{type:`boolean`,description:'Set to false to enable printing. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-du`,{type:`boolean`,description:'Set to false to enable uploading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-keyboard`,{type:`string`,description:`Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-paste`,{type:`string`,description:`Configure paste behavior. If set to remote_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-printing`,{type:`string`,description:`Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-upload`,{type:`string`,description:`Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-version`,{type:`string`,description:`Indicate which version of the browser isolation controls should apply.`,choices:[`v1`,`v2`],default:`v1`}).option(`rule-settings-biso-admin-controls-wm-id`,{type:`string`,description:`Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser.`}).option(`rule-settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-block-page-enabled`,{type:`boolean`,description:"Enable the custom block page. Settable only for `dns` rules with action `block`."}).option(`rule-settings-block-reason`,{type:`string`,description:"Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`."}).option(`rule-settings-bypass-parent-rule`,{type:`boolean`,description:`Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.`}).option(`rule-settings-check-session-duration`,{type:`string`,description:`Sets the required session freshness threshold. The API returns a normalized version of this value.`}).option(`rule-settings-check-session-enforce`,{type:`boolean`,description:`Enable session enforcement.`}).option(`rule-settings-delete-headers`,{type:`string`,array:!0,description:"Remove headers from allowed requests by name. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes. Settable only for `http` rules with the action set to `allow`."}).option(`rule-settings-egress-ipv4`,{type:`string`,description:`Specify the IPv4 address to use for egress.`}).option(`rule-settings-egress-ipv4-fallback`,{type:`string`,description:`Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.`}).option(`rule-settings-egress-ipv6`,{type:`string`,description:`Specify the IPv6 range to use for egress.`}).option(`rule-settings-forensic-copy-enabled`,{type:`boolean`,description:`Enable sending the copy to storage.`}).option(`rule-settings-ignore-cname-category-matches`,{type:`boolean`,description:"Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-insecure-disable-dnssec-validation`,{type:`boolean`,description:"Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules."}).option(`rule-settings-ip-categories`,{type:`boolean`,description:"Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-ip-indicator-feeds`,{type:`boolean`,description:"Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-l4override-ip`,{type:`string`,description:`Defines the IPv4 or IPv6 address.`}).option(`rule-settings-l4override-port`,{type:`number`,description:`Defines a port number to use for TCP/UDP overrides.`}).option(`rule-settings-notification-settings-enabled`,{type:`boolean`,description:`Enable notification.`}).option(`rule-settings-notification-settings-include-context`,{type:`boolean`,description:`Indicates whether to pass the context information as query parameters.`}).option(`rule-settings-notification-settings-msg`,{type:`string`,description:`Customize the message shown in the notification.`}).option(`rule-settings-notification-settings-support-url`,{type:`string`,description:`Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.`}).option(`rule-settings-override-host`,{type:`string`,description:"Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-override-ips`,{type:`string`,array:!0,description:"Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-payload-log-enabled`,{type:`boolean`,description:`Enable DLP payload logging for this rule.`}).option(`rule-settings-quarantine-file-types`,{type:`string`,array:!0,description:`Specify the types of files to sandbox.`}).option(`rule-settings-redirect-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-redirect-preserve-path-and-query`,{type:`boolean`,description:`Specify whether to append the path and query parameters from the original request to target_uri.`}).option(`rule-settings-redirect-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-resolve-dns-internally-fallback`,{type:`string`,description:`Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.`,choices:[`none`,`public_dns`]}).option(`rule-settings-resolve-dns-internally-view-id`,{type:`string`,description:`Specify the internal DNS view identifier to pass to the internal DNS service.`}).option(`rule-settings-resolve-dns-through-cloudflare`,{type:`boolean`,description:"Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dns_resolver` rules."}).option(`rule-settings-untrusted-cert-action`,{type:`string`,description:`Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.`,choices:[`pass_through`,`block`,`error`]}).option(`schedule-fri`,{type:`string`,description:`Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-mon`,{type:`string`,description:`Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sat`,{type:`string`,description:`Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sun`,{type:`string`,description:`Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-thu`,{type:`string`,description:`Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-time-zone`,{type:`string`,description:`Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.`}).option(`schedule-tue`,{type:`string`,description:`Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-wed`,{type:`string`,description:`Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`traffic`,{type:`string`,description:`Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if(`rule-settings-allow-child-bypass.rule-settings-audit-ssh-command-logging.rule-settings-biso-admin-controls-copy.rule-settings-biso-admin-controls-dcp.rule-settings-biso-admin-controls-dd.rule-settings-biso-admin-controls-dk.rule-settings-biso-admin-controls-download.rule-settings-biso-admin-controls-dp.rule-settings-biso-admin-controls-du.rule-settings-biso-admin-controls-keyboard.rule-settings-biso-admin-controls-paste.rule-settings-biso-admin-controls-printing.rule-settings-biso-admin-controls-upload.rule-settings-biso-admin-controls-wm-id.rule-settings-block-page-include-context.rule-settings-block-page-target-uri.rule-settings-block-page-enabled.rule-settings-block-reason.rule-settings-bypass-parent-rule.rule-settings-check-session-duration.rule-settings-check-session-enforce.rule-settings-delete-headers.rule-settings-egress-ipv4.rule-settings-egress-ipv4-fallback.rule-settings-egress-ipv6.rule-settings-forensic-copy-enabled.rule-settings-ignore-cname-category-matches.rule-settings-insecure-disable-dnssec-validation.rule-settings-ip-categories.rule-settings-ip-indicator-feeds.rule-settings-l4override-ip.rule-settings-l4override-port.rule-settings-notification-settings-enabled.rule-settings-notification-settings-include-context.rule-settings-notification-settings-msg.rule-settings-notification-settings-support-url.rule-settings-override-host.rule-settings-override-ips.rule-settings-payload-log-enabled.rule-settings-quarantine-file-types.rule-settings-redirect-include-context.rule-settings-redirect-preserve-path-and-query.rule-settings-redirect-target-uri.rule-settings-resolve-dns-internally-fallback.rule-settings-resolve-dns-internally-view-id.rule-settings-resolve-dns-through-cloudflare.rule-settings-untrusted-cert-action`.split(`.`).some(t=>e[t]!==void 0)){let t=[`rule-settings-block-page-target-uri`,`rule-settings-redirect-target-uri`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --rule_settings-* flag is set`)}return!0})}const zp={command:`create`,describe:`Create a new Zero Trust Gateway rule.`,builder:Rp,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust gateway rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?l({action:p(r.action,`action`,`text`),description:p(r.description,`description`,`text`),device_posture:p(r[`device-posture`],`device-posture`,`text`),enabled:r.enabled,expiration:{duration:r[`expiration-duration`]},filters:r.filters,identity:p(r.identity,`identity`,`text`),name:p(r.name,`name`,`text`),precedence:r.precedence,rule_settings:{allow_child_bypass:r[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:r[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:p(r[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:r[`rule-settings-biso-admin-controls-dcp`],dd:r[`rule-settings-biso-admin-controls-dd`],dk:r[`rule-settings-biso-admin-controls-dk`],download:p(r[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:r[`rule-settings-biso-admin-controls-dp`],du:r[`rule-settings-biso-admin-controls-du`],keyboard:p(r[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:p(r[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:p(r[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:p(r[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:p(r[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:p(r[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:r[`rule-settings-block-page-include-context`],target_uri:p(r[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:r[`rule-settings-block-page-enabled`],block_reason:p(r[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:r[`rule-settings-bypass-parent-rule`],check_session:{duration:p(r[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:r[`rule-settings-check-session-enforce`]},delete_headers:r[`rule-settings-delete-headers`],egress:{ipv4:p(r[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:p(r[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:p(r[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:r[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:r[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:r[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:r[`rule-settings-ip-categories`],ip_indicator_feeds:r[`rule-settings-ip-indicator-feeds`],l4override:{ip:p(r[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:r[`rule-settings-l4override-port`]},notification_settings:{enabled:r[`rule-settings-notification-settings-enabled`],include_context:r[`rule-settings-notification-settings-include-context`],msg:p(r[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:p(r[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:p(r[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:r[`rule-settings-override-ips`],payload_log:{enabled:r[`rule-settings-payload-log-enabled`]},quarantine:{file_types:r[`rule-settings-quarantine-file-types`]},redirect:{include_context:r[`rule-settings-redirect-include-context`],preserve_path_and_query:r[`rule-settings-redirect-preserve-path-and-query`],target_uri:p(r[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:p(r[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:p(r[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:r[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:p(r[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:p(r[`schedule-fri`],`schedule-fri`,`text`),mon:p(r[`schedule-mon`],`schedule-mon`,`text`),sat:p(r[`schedule-sat`],`schedule-sat`,`text`),sun:p(r[`schedule-sun`],`schedule-sun`,`text`),thu:p(r[`schedule-thu`],`schedule-thu`,`text`),time_zone:p(r[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:p(r[`schedule-tue`],`schedule-tue`,`text`),wed:p(r[`schedule-wed`],`schedule-wed`,`text`)},traffic:p(r.traffic,`traffic`,`text`)}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Creating`,async()=>i.zeroTrust.gateway.rules.create({...e,account_id:o})),{successLabel:`Created`});return}r.action===void 0&&(r.action=await n(`action`,"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`])),r.name===void 0&&(r.name=await t(`name`,`Specify the rule name.`));let m=l({action:p(r.action,`action`,`text`),description:p(r.description,`description`,`text`),device_posture:p(r[`device-posture`],`device-posture`,`text`),enabled:r.enabled,expiration:{duration:r[`expiration-duration`]},filters:r.filters,identity:p(r.identity,`identity`,`text`),name:p(r.name,`name`,`text`),precedence:r.precedence,rule_settings:{allow_child_bypass:r[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:r[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:p(r[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:r[`rule-settings-biso-admin-controls-dcp`],dd:r[`rule-settings-biso-admin-controls-dd`],dk:r[`rule-settings-biso-admin-controls-dk`],download:p(r[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:r[`rule-settings-biso-admin-controls-dp`],du:r[`rule-settings-biso-admin-controls-du`],keyboard:p(r[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:p(r[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:p(r[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:p(r[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:p(r[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:p(r[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:r[`rule-settings-block-page-include-context`],target_uri:p(r[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:r[`rule-settings-block-page-enabled`],block_reason:p(r[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:r[`rule-settings-bypass-parent-rule`],check_session:{duration:p(r[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:r[`rule-settings-check-session-enforce`]},delete_headers:r[`rule-settings-delete-headers`],egress:{ipv4:p(r[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:p(r[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:p(r[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:r[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:r[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:r[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:r[`rule-settings-ip-categories`],ip_indicator_feeds:r[`rule-settings-ip-indicator-feeds`],l4override:{ip:p(r[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:r[`rule-settings-l4override-port`]},notification_settings:{enabled:r[`rule-settings-notification-settings-enabled`],include_context:r[`rule-settings-notification-settings-include-context`],msg:p(r[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:p(r[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:p(r[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:r[`rule-settings-override-ips`],payload_log:{enabled:r[`rule-settings-payload-log-enabled`]},quarantine:{file_types:r[`rule-settings-quarantine-file-types`]},redirect:{include_context:r[`rule-settings-redirect-include-context`],preserve_path_and_query:r[`rule-settings-redirect-preserve-path-and-query`],target_uri:p(r[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:p(r[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:p(r[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:r[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:p(r[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:p(r[`schedule-fri`],`schedule-fri`,`text`),mon:p(r[`schedule-mon`],`schedule-mon`,`text`),sat:p(r[`schedule-sat`],`schedule-sat`,`text`),sun:p(r[`schedule-sun`],`schedule-sun`,`text`),thu:p(r[`schedule-thu`],`schedule-thu`,`text`),time_zone:p(r[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:p(r[`schedule-tue`],`schedule-tue`,`text`),wed:p(r[`schedule-wed`],`schedule-wed`,`text`)},traffic:p(r.traffic,`traffic`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.gateway.rules.create({...m,account_id:o})),{successLabel:`Created`})}};function Bp(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Vp={command:`delete <rule-id>`,describe:`Delete a Zero Trust Gateway rule.`,builder:Bp,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/rules/${t[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(t[`rule-id`]))}`,pathParams:{"rule-id":String(t[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.gateway.rules.delete({account_id:r,rule_id:t[`rule-id`]})),{successLabel:`Deleted`})}};function Hp(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Up={command:`get <rule-id>`,describe:`Get a single Zero Trust Gateway rule.`,builder:Hp,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/rules/${t[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(t[`rule-id`]))}`,pathParams:{"rule-id":String(t[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.rules.get({account_id:r,rule_id:t[`rule-id`]})),{successLabel:`Loaded`})}};function Wp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gp={command:`list-tenant`,describe:`List Zero Trust Gateway rules for the parent account of an account in the MSP configuration.`,builder:Wp,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway rules list-tenant`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/rules/tenant`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.rules.listTenant({account_id:r})),{successLabel:`Loaded`})}};function Kp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qp={command:`list`,describe:`List Zero Trust Gateway rules for an account.`,builder:Kp,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/rules`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.gateway.rules.list({account_id:r})),{successLabel:`Loaded`})}};function Jp(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yp={command:`reset-expiration <rule-id>`,describe:"Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and it has a default duration. The Zero Trust Gateway Rule must have values for both `expiration.expires_at` and `expiration.duration`.",builder:Jp,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust gateway rules reset-expiration`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/rules/${t[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(t[`rule-id`]))}/reset_expiration`,pathParams:{"rule-id":String(t[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Creating`,async()=>n.zeroTrust.gateway.rules.resetExpiration({account_id:r,rule_id:t[`rule-id`]})),{successLabel:`Created`})}};function Xp(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`action`,{type:`string`,description:"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",choices:[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`]}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`device-posture`,{type:`string`,description:`Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`}).option(`expiration-duration`,{type:`number`,description:"Defines the default duration a policy active in minutes. Must set in order to use the `reset_expiration` endpoint on this rule."}).option(`filters`,{type:`string`,array:!0,description:`Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.`}).option(`identity`,{type:`string`,description:`Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`rule-settings-allow-child-bypass`,{type:`boolean`,description:`Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.`}).option(`rule-settings-audit-ssh-command-logging`,{type:`boolean`,description:`Enable SSH command logging.`}).option(`rule-settings-biso-admin-controls-copy`,{type:`string`,description:`Configure copy behavior. If set to remote_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dcp`,{type:`boolean`,description:'Set to false to enable copy-pasting. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dd`,{type:`boolean`,description:'Set to false to enable downloading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dk`,{type:`boolean`,description:'Set to false to enable keyboard usage. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-download`,{type:`string`,description:`Configure download behavior. When set to remote_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dp`,{type:`boolean`,description:'Set to false to enable printing. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-du`,{type:`boolean`,description:'Set to false to enable uploading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-keyboard`,{type:`string`,description:`Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-paste`,{type:`string`,description:`Configure paste behavior. If set to remote_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-printing`,{type:`string`,description:`Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-upload`,{type:`string`,description:`Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-version`,{type:`string`,description:`Indicate which version of the browser isolation controls should apply.`,choices:[`v1`,`v2`]}).option(`rule-settings-biso-admin-controls-wm-id`,{type:`string`,description:`Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser.`}).option(`rule-settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-block-page-enabled`,{type:`boolean`,description:"Enable the custom block page. Settable only for `dns` rules with action `block`."}).option(`rule-settings-block-reason`,{type:`string`,description:"Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`."}).option(`rule-settings-bypass-parent-rule`,{type:`boolean`,description:`Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.`}).option(`rule-settings-check-session-duration`,{type:`string`,description:`Sets the required session freshness threshold. The API returns a normalized version of this value.`}).option(`rule-settings-check-session-enforce`,{type:`boolean`,description:`Enable session enforcement.`}).option(`rule-settings-delete-headers`,{type:`string`,array:!0,description:"Remove headers from allowed requests by name. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes. Settable only for `http` rules with the action set to `allow`."}).option(`rule-settings-egress-ipv4`,{type:`string`,description:`Specify the IPv4 address to use for egress.`}).option(`rule-settings-egress-ipv4-fallback`,{type:`string`,description:`Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.`}).option(`rule-settings-egress-ipv6`,{type:`string`,description:`Specify the IPv6 range to use for egress.`}).option(`rule-settings-forensic-copy-enabled`,{type:`boolean`,description:`Enable sending the copy to storage.`}).option(`rule-settings-ignore-cname-category-matches`,{type:`boolean`,description:"Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-insecure-disable-dnssec-validation`,{type:`boolean`,description:"Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules."}).option(`rule-settings-ip-categories`,{type:`boolean`,description:"Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-ip-indicator-feeds`,{type:`boolean`,description:"Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-l4override-ip`,{type:`string`,description:`Defines the IPv4 or IPv6 address.`}).option(`rule-settings-l4override-port`,{type:`number`,description:`Defines a port number to use for TCP/UDP overrides.`}).option(`rule-settings-notification-settings-enabled`,{type:`boolean`,description:`Enable notification.`}).option(`rule-settings-notification-settings-include-context`,{type:`boolean`,description:`Indicates whether to pass the context information as query parameters.`}).option(`rule-settings-notification-settings-msg`,{type:`string`,description:`Customize the message shown in the notification.`}).option(`rule-settings-notification-settings-support-url`,{type:`string`,description:`Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.`}).option(`rule-settings-override-host`,{type:`string`,description:"Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-override-ips`,{type:`string`,array:!0,description:"Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-payload-log-enabled`,{type:`boolean`,description:`Enable DLP payload logging for this rule.`}).option(`rule-settings-quarantine-file-types`,{type:`string`,array:!0,description:`Specify the types of files to sandbox.`}).option(`rule-settings-redirect-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-redirect-preserve-path-and-query`,{type:`boolean`,description:`Specify whether to append the path and query parameters from the original request to target_uri.`}).option(`rule-settings-redirect-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-resolve-dns-internally-fallback`,{type:`string`,description:`Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.`,choices:[`none`,`public_dns`]}).option(`rule-settings-resolve-dns-internally-view-id`,{type:`string`,description:`Specify the internal DNS view identifier to pass to the internal DNS service.`}).option(`rule-settings-resolve-dns-through-cloudflare`,{type:`boolean`,description:"Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dns_resolver` rules."}).option(`rule-settings-untrusted-cert-action`,{type:`string`,description:`Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.`,choices:[`pass_through`,`block`,`error`]}).option(`schedule-fri`,{type:`string`,description:`Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-mon`,{type:`string`,description:`Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sat`,{type:`string`,description:`Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sun`,{type:`string`,description:`Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-thu`,{type:`string`,description:`Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-time-zone`,{type:`string`,description:`Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.`}).option(`schedule-tue`,{type:`string`,description:`Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-wed`,{type:`string`,description:`Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`traffic`,{type:`string`,description:`Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if(`rule-settings-allow-child-bypass.rule-settings-audit-ssh-command-logging.rule-settings-biso-admin-controls-copy.rule-settings-biso-admin-controls-dcp.rule-settings-biso-admin-controls-dd.rule-settings-biso-admin-controls-dk.rule-settings-biso-admin-controls-download.rule-settings-biso-admin-controls-dp.rule-settings-biso-admin-controls-du.rule-settings-biso-admin-controls-keyboard.rule-settings-biso-admin-controls-paste.rule-settings-biso-admin-controls-printing.rule-settings-biso-admin-controls-upload.rule-settings-biso-admin-controls-wm-id.rule-settings-block-page-include-context.rule-settings-block-page-target-uri.rule-settings-block-page-enabled.rule-settings-block-reason.rule-settings-bypass-parent-rule.rule-settings-check-session-duration.rule-settings-check-session-enforce.rule-settings-delete-headers.rule-settings-egress-ipv4.rule-settings-egress-ipv4-fallback.rule-settings-egress-ipv6.rule-settings-forensic-copy-enabled.rule-settings-ignore-cname-category-matches.rule-settings-insecure-disable-dnssec-validation.rule-settings-ip-categories.rule-settings-ip-indicator-feeds.rule-settings-l4override-ip.rule-settings-l4override-port.rule-settings-notification-settings-enabled.rule-settings-notification-settings-include-context.rule-settings-notification-settings-msg.rule-settings-notification-settings-support-url.rule-settings-override-host.rule-settings-override-ips.rule-settings-payload-log-enabled.rule-settings-quarantine-file-types.rule-settings-redirect-include-context.rule-settings-redirect-preserve-path-and-query.rule-settings-redirect-target-uri.rule-settings-resolve-dns-internally-fallback.rule-settings-resolve-dns-internally-view-id.rule-settings-resolve-dns-through-cloudflare.rule-settings-untrusted-cert-action`.split(`.`).some(t=>e[t]!==void 0)){let t=[`rule-settings-block-page-target-uri`,`rule-settings-redirect-target-uri`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --rule_settings-* flag is set`)}return!0})}const Zp={command:`update <rule-id>`,describe:`Update a configured Zero Trust Gateway rule.`,builder:Xp,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust gateway rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/gateway/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?l({action:p(r.action,`action`,`text`),description:p(r.description,`description`,`text`),device_posture:p(r[`device-posture`],`device-posture`,`text`),enabled:r.enabled,expiration:{duration:r[`expiration-duration`]},filters:r.filters,identity:p(r.identity,`identity`,`text`),name:p(r.name,`name`,`text`),precedence:r.precedence,rule_settings:{allow_child_bypass:r[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:r[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:p(r[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:r[`rule-settings-biso-admin-controls-dcp`],dd:r[`rule-settings-biso-admin-controls-dd`],dk:r[`rule-settings-biso-admin-controls-dk`],download:p(r[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:r[`rule-settings-biso-admin-controls-dp`],du:r[`rule-settings-biso-admin-controls-du`],keyboard:p(r[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:p(r[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:p(r[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:p(r[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:p(r[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:p(r[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:r[`rule-settings-block-page-include-context`],target_uri:p(r[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:r[`rule-settings-block-page-enabled`],block_reason:p(r[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:r[`rule-settings-bypass-parent-rule`],check_session:{duration:p(r[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:r[`rule-settings-check-session-enforce`]},delete_headers:r[`rule-settings-delete-headers`],egress:{ipv4:p(r[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:p(r[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:p(r[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:r[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:r[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:r[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:r[`rule-settings-ip-categories`],ip_indicator_feeds:r[`rule-settings-ip-indicator-feeds`],l4override:{ip:p(r[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:r[`rule-settings-l4override-port`]},notification_settings:{enabled:r[`rule-settings-notification-settings-enabled`],include_context:r[`rule-settings-notification-settings-include-context`],msg:p(r[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:p(r[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:p(r[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:r[`rule-settings-override-ips`],payload_log:{enabled:r[`rule-settings-payload-log-enabled`]},quarantine:{file_types:r[`rule-settings-quarantine-file-types`]},redirect:{include_context:r[`rule-settings-redirect-include-context`],preserve_path_and_query:r[`rule-settings-redirect-preserve-path-and-query`],target_uri:p(r[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:p(r[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:p(r[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:r[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:p(r[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:p(r[`schedule-fri`],`schedule-fri`,`text`),mon:p(r[`schedule-mon`],`schedule-mon`,`text`),sat:p(r[`schedule-sat`],`schedule-sat`,`text`),sun:p(r[`schedule-sun`],`schedule-sun`,`text`),thu:p(r[`schedule-thu`],`schedule-thu`,`text`),time_zone:p(r[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:p(r[`schedule-tue`],`schedule-tue`,`text`),wed:p(r[`schedule-wed`],`schedule-wed`,`text`)},traffic:p(r.traffic,`traffic`,`text`)}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Updating`,async()=>i.zeroTrust.gateway.rules.update({...e,account_id:o,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}r.action===void 0&&(r.action=await n(`action`,"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`])),r.name===void 0&&(r.name=await t(`name`,`Specify the rule name.`));let m=l({action:p(r.action,`action`,`text`),description:p(r.description,`description`,`text`),device_posture:p(r[`device-posture`],`device-posture`,`text`),enabled:r.enabled,expiration:{duration:r[`expiration-duration`]},filters:r.filters,identity:p(r.identity,`identity`,`text`),name:p(r.name,`name`,`text`),precedence:r.precedence,rule_settings:{allow_child_bypass:r[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:r[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:p(r[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:r[`rule-settings-biso-admin-controls-dcp`],dd:r[`rule-settings-biso-admin-controls-dd`],dk:r[`rule-settings-biso-admin-controls-dk`],download:p(r[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:r[`rule-settings-biso-admin-controls-dp`],du:r[`rule-settings-biso-admin-controls-du`],keyboard:p(r[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:p(r[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:p(r[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:p(r[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:p(r[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:p(r[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:r[`rule-settings-block-page-include-context`],target_uri:p(r[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:r[`rule-settings-block-page-enabled`],block_reason:p(r[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:r[`rule-settings-bypass-parent-rule`],check_session:{duration:p(r[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:r[`rule-settings-check-session-enforce`]},delete_headers:r[`rule-settings-delete-headers`],egress:{ipv4:p(r[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:p(r[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:p(r[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:r[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:r[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:r[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:r[`rule-settings-ip-categories`],ip_indicator_feeds:r[`rule-settings-ip-indicator-feeds`],l4override:{ip:p(r[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:r[`rule-settings-l4override-port`]},notification_settings:{enabled:r[`rule-settings-notification-settings-enabled`],include_context:r[`rule-settings-notification-settings-include-context`],msg:p(r[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:p(r[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:p(r[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:r[`rule-settings-override-ips`],payload_log:{enabled:r[`rule-settings-payload-log-enabled`]},quarantine:{file_types:r[`rule-settings-quarantine-file-types`]},redirect:{include_context:r[`rule-settings-redirect-include-context`],preserve_path_and_query:r[`rule-settings-redirect-preserve-path-and-query`],target_uri:p(r[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:p(r[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:p(r[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:r[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:p(r[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:p(r[`schedule-fri`],`schedule-fri`,`text`),mon:p(r[`schedule-mon`],`schedule-mon`,`text`),sat:p(r[`schedule-sat`],`schedule-sat`,`text`),sun:p(r[`schedule-sun`],`schedule-sun`,`text`),thu:p(r[`schedule-thu`],`schedule-thu`,`text`),time_zone:p(r[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:p(r[`schedule-tue`],`schedule-tue`,`text`),wed:p(r[`schedule-wed`],`schedule-wed`,`text`)},traffic:p(r.traffic,`traffic`,`text`)});u(await f(`Updating`,async()=>i.zeroTrust.gateway.rules.update({...m,account_id:o,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},Qp={command:`rules`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(zp).command(Vp).command(Up).command(qp).command(Gp).command(Yp).command(Zp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},$p={command:`gateway`,describe:`Operations for gateway`,builder:e=>e.command(Ff).command(Lf).command($d).command(sf).command(uf).command(Cf).command(Nf).command($f).command(up).command(hp).command(Ep).command(Lp).command(Qp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function em(e){return e.option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const tm={command:`create`,describe:`Creates a new Access group.`,builder:em,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/groups`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({name:p(e.name,`name`,`text`)}):c(e.body)});return}let n=await s(e),i=await r({zone:e.zone},n,{quiet:e.quiet});if(e.zoneId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.groups.create({...t,zone_id:i})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await t(`name`,`The name of the Access group.`));let a=l({name:p(e.name,`name`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.groups.create({...a,zone_id:i})),{successLabel:`Created`})}};function nm(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const rm={command:`delete <group-id>`,describe:`Deletes an Access group.`,builder:nm,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i({force:!!e.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>t.zeroTrust.groups.delete({zone_id:n,group_id:e[`group-id`]})),{successLabel:`Deleted`})}};function im(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const am={command:`get <group-id>`,describe:`Fetches a single Access group.`,builder:im,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.groups.get({zone_id:n,group_id:e[`group-id`]})),{successLabel:`Loaded`})}};function om(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sm={command:`list`,describe:`Lists all Access groups.`,builder:om,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/groups`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.groups.list({zone_id:n})),{successLabel:`Loaded`})}};function cm(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const lm={command:`update <group-id>`,describe:`Updates a configured Access group.`,builder:cm,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({name:p(e.name,`name`,`text`)}):c(e.body)});return}let n=await s(e),i=await r({zone:e.zone},n,{quiet:e.quiet});if(e.zoneId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.groups.update({...t,zone_id:i,group_id:e[`group-id`]})),{successLabel:`Updated`});return}e.name===void 0&&(e.name=await t(`name`,`The name of the Access group.`));let a=l({name:p(e.name,`name`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.groups.update({...a,zone_id:i,group_id:e[`group-id`]})),{successLabel:`Updated`})}},um={command:`groups`,describe:`Groups operations`,builder:e=>e.command(tm).command(rm).command(am).command(sm).command(lm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function dm(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const fm={command:`create`,describe:`Adds a new identity provider to Access.`,builder:dm,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust identity-providers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/identity_providers`,pathParams:{},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.identityProviders.create({body:e,account_id:r})),{successLabel:`Created`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function pm(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const mm={command:`delete <identity-provider-id>`,describe:`Deletes an identity provider from Access.`,builder:pm,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust identity-providers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/identity_providers/${t[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(t[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(t[`identity-provider-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.identityProviders.delete({account_id:r,identity_provider_id:t[`identity-provider-id`]})),{successLabel:`Deleted`})}};function hm(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gm={command:`get <identity-provider-id>`,describe:`Fetches a configured identity provider.`,builder:hm,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust identity-providers get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/identity_providers/${t[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(t[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(t[`identity-provider-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.identityProviders.get({account_id:r,identity_provider_id:t[`identity-provider-id`]})),{successLabel:`Loaded`})}};function _m(e){return e.option(`scim-enabled`,{type:`string`,description:`Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const vm={command:`list`,describe:`Lists all configured identity providers.`,builder:_m,handler:async t=>{let n={scim_enabled:t[`scim-enabled`],page:t.page,per_page:t[`per-page`]};if(t.dryRun){d({command:`cf zero-trust identity-providers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/identity_providers`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.identityProviders.list({account_id:i,...n})),{successLabel:`Loaded`})}};function ym(e){return e.option(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`cf-resource-id`,{type:`string`,description:'The unique Cloudflare-generated Id of the SCIM Group resource; also known as the "Id".\nPass once for a single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to look up multiple groups in one request,\nup to 50 values. Mutually exclusive with `idp_resource_id`, `name`,\n`search_contains`, and `search_starts_with`.'}).option(`idp-resource-id`,{type:`string`,description:'The IdP-generated Id of the SCIM Group resource; also known as the "external Id".\nPass once for a single lookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to look up multiple groups in one request,\nup to 50 values. Mutually exclusive with `cf_resource_id`, `name`,\n`search_contains`, and `search_starts_with`.'}).option(`name`,{type:`string`,description:`The display name of the SCIM Group resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const bm={command:`list`,describe:`Lists SCIM Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:ym,handler:async t=>{let n={cf_resource_id:t[`cf-resource-id`],idp_resource_id:t[`idp-resource-id`],name:t.name,page:t.page,per_page:t[`per-page`]};if(t.dryRun){d({command:`cf zero-trust identity-providers scim groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/identity_providers/${t[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(t[`identity-provider-id`]))}/scim/groups`,pathParams:{"identity-provider-id":String(t[`identity-provider-id`]??``)},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.identityProviders.scim.groups.list({account_id:i,identity_provider_id:t[`identity-provider-id`],...n})),{successLabel:`Loaded`})}},xm={command:`groups`,describe:`Identity provider integrations (Okta, Azure AD, etc.) used to authenticate users in Access`,builder:e=>e.command(bm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Sm(e){return e.option(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`cf-resource-id`,{type:`string`,description:'The unique Cloudflare-generated Id of the SCIM User resource; also known as the "Id".\nPass once for a single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to look up multiple users in one request,\nup to 50 values. Mutually exclusive with `idp_resource_id`, `username`, `email`,\n`name`, `search_contains`, and `search_starts_with`.'}).option(`idp-resource-id`,{type:`string`,description:'The IdP-generated Id of the SCIM User resource; also known as the "external Id".\nPass once for a single lookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to look up multiple users in one request,\nup to 50 values. Mutually exclusive with `cf_resource_id`, `username`, `email`,\n`name`, `search_contains`, and `search_starts_with`.'}).option(`username`,{type:`string`,description:`The username of the SCIM User resource.`}).option(`email`,{type:`string`,description:`The email address of the SCIM User resource.`}).option(`name`,{type:`string`,description:`The name of the SCIM User resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cm={command:`list`,describe:`Lists SCIM User resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:Sm,handler:async t=>{let n={cf_resource_id:t[`cf-resource-id`],idp_resource_id:t[`idp-resource-id`],username:t.username,email:t.email,name:t.name,page:t.page,per_page:t[`per-page`]};if(t.dryRun){d({command:`cf zero-trust identity-providers scim users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/identity_providers/${t[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(t[`identity-provider-id`]))}/scim/users`,pathParams:{"identity-provider-id":String(t[`identity-provider-id`]??``)},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.identityProviders.scim.users.list({account_id:i,identity_provider_id:t[`identity-provider-id`],...n})),{successLabel:`Loaded`})}},wm={command:`users`,describe:`Identity provider integrations (Okta, Azure AD, etc.) used to authenticate users in Access`,builder:e=>e.command(Cm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Tm={command:`scim`,describe:`Operations for identity-providers.scim`,builder:e=>e.command(xm).command(wm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Em(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Dm={command:`update <identity-provider-id>`,describe:`Updates a configured identity provider.`,builder:Em,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust identity-providers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/identity_providers/${t[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(t[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(t[`identity-provider-id`]??``)},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.identityProviders.update({body:e,account_id:r,identity_provider_id:t[`identity-provider-id`]})),{successLabel:`Updated`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Om={command:`identity-providers`,describe:`Identity provider integrations (Okta, Azure AD, etc.) used to authenticate users in Access`,builder:e=>e.command(fm).command(mm).command(gm).command(vm).command(Dm).command(Tm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function km(e){return e.option(`comment`,{type:`string`,description:`An optional description of the hostname route.`}).option(`hostname`,{type:`string`,description:`The hostname of the route.`}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Am={command:`create`,describe:`Create a hostname route.`,builder:km,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust networks hostname-routes create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zerotrust/routes/hostname`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({comment:p(t.comment,`comment`,`text`),hostname:p(t.hostname,`hostname`,`text`),tunnel_id:p(t[`tunnel-id`],`tunnel-id`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.networks.hostnameRoutes.create({...e,account_id:r})),{successLabel:`Created`});return}let i=l({comment:p(t.comment,`comment`,`text`),hostname:p(t.hostname,`hostname`,`text`),tunnel_id:p(t[`tunnel-id`],`tunnel-id`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.networks.hostnameRoutes.create({...i,account_id:r})),{successLabel:`Created`})}};function jm(e){return e.positional(`hostname-route-id`,{type:`string`,description:`The hostname route ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Mm={command:`delete <hostname-route-id>`,describe:`Delete a hostname route.`,builder:jm,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust networks hostname-routes delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zerotrust/routes/hostname/${t[`hostname-route-id`]==null?`<hostname-route-id>`:encodeURIComponent(String(t[`hostname-route-id`]))}`,pathParams:{"hostname-route-id":String(t[`hostname-route-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.networks.hostnameRoutes.delete({account_id:r,hostname_route_id:t[`hostname-route-id`]})),{successLabel:`Deleted`})}};function Nm(e){return e.positional(`hostname-route-id`,{type:`string`,description:`The hostname route ID.`,demandOption:!0}).option(`comment`,{type:`string`,description:`An optional description of the hostname route.`}).option(`hostname`,{type:`string`,description:`The hostname of the route.`}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Pm={command:`edit <hostname-route-id>`,describe:`Updates a hostname route.`,builder:Nm,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust networks hostname-routes edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zerotrust/routes/hostname/${t[`hostname-route-id`]==null?`<hostname-route-id>`:encodeURIComponent(String(t[`hostname-route-id`]))}`,pathParams:{"hostname-route-id":String(t[`hostname-route-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({comment:p(t.comment,`comment`,`text`),hostname:p(t.hostname,`hostname`,`text`),tunnel_id:p(t[`tunnel-id`],`tunnel-id`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.networks.hostnameRoutes.edit({...e,account_id:r,hostname_route_id:t[`hostname-route-id`]})),{successLabel:`Updated`});return}let i=l({comment:p(t.comment,`comment`,`text`),hostname:p(t.hostname,`hostname`,`text`),tunnel_id:p(t[`tunnel-id`],`tunnel-id`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.networks.hostnameRoutes.edit({...i,account_id:r,hostname_route_id:t[`hostname-route-id`]})),{successLabel:`Updated`})}};function Fm(e){return e.positional(`hostname-route-id`,{type:`string`,description:`The hostname route ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Im={command:`get <hostname-route-id>`,describe:`Get a hostname route.`,builder:Fm,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust networks hostname-routes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zerotrust/routes/hostname/${t[`hostname-route-id`]==null?`<hostname-route-id>`:encodeURIComponent(String(t[`hostname-route-id`]))}`,pathParams:{"hostname-route-id":String(t[`hostname-route-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.networks.hostnameRoutes.get({account_id:r,hostname_route_id:t[`hostname-route-id`]})),{successLabel:`Loaded`})}};function Lm(e){return e.option(`id`,{type:`string`,description:`The hostname route ID.`}).option(`hostname`,{type:`string`,description:`If set, only list hostname routes that contain a substring of the given value, the filter is case-insensitive.`}).option(`tunnel-id`,{type:`string`,description:`If set, only list hostname routes that point to a specific tunnel.`}).option(`comment`,{type:`string`,description:`If set, only list hostname routes with the given comment.`}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only return deleted hostname routes. If `false`, exclude deleted hostname routes."}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Rm={command:`list`,describe:`Lists and filters hostname routes in an account.`,builder:Lm,handler:async t=>{let n={id:t.id,hostname:t.hostname,tunnel_id:t[`tunnel-id`],comment:t.comment,existed_at:t[`existed-at`],is_deleted:t[`is-deleted`],per_page:t[`per-page`],page:t.page};if(t.dryRun){d({command:`cf zero-trust networks hostname-routes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zerotrust/routes/hostname`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.networks.hostnameRoutes.list({account_id:i,...n})),{successLabel:`Loaded`})}},zm={command:`hostname-routes`,describe:`Operations for networks.hostname-routes`,builder:e=>e.command(Am).command(Mm).command(Pm).command(Im).command(Rm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bm(e){return e.option(`comment`,{type:`string`,description:`Optional remark describing the route.`,default:``}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range connected by the route, in CIDR notation.`}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Vm={command:`create`,describe:`Routes a private network through a Cloudflare Tunnel.`,builder:Bm,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust networks routes create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/teamnet/routes`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({comment:p(n.comment,`comment`,`text`),network:p(n.network,`network`,`text`),virtual_network_id:p(n[`virtual-network-id`],`virtual-network-id`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.networks.routes.create({...e,account_id:i})),{successLabel:`Created`});return}n.network===void 0&&(n.network=await t(`network`,`The private IPv4 or IPv6 range connected by the route, in CIDR notation.`));let o=l({comment:p(n.comment,`comment`,`text`),network:p(n.network,`network`,`text`),virtual_network_id:p(n[`virtual-network-id`],`virtual-network-id`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.networks.routes.create({...o,account_id:i})),{successLabel:`Created`})}};function Hm(e){return e.positional(`route-id`,{type:`string`,description:`UUID of the route.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Um={command:`delete <route-id>`,describe:`Deletes a private network route from an account.`,builder:Hm,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust networks routes delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/teamnet/routes/${t[`route-id`]==null?`<route-id>`:encodeURIComponent(String(t[`route-id`]))}`,pathParams:{"route-id":String(t[`route-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.networks.routes.delete({account_id:r,route_id:t[`route-id`]})),{successLabel:`Deleted`})}};function Wm(e){return e.positional(`route-id`,{type:`string`,description:`UUID of the route.`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the route.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range connected by the route, in CIDR notation.`}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Gm={command:`edit <route-id>`,describe:`Updates an existing private network route in an account. The fields that are meant to be updated should be provided in the body of the request.`,builder:Wm,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust networks routes edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/teamnet/routes/${t[`route-id`]==null?`<route-id>`:encodeURIComponent(String(t[`route-id`]))}`,pathParams:{"route-id":String(t[`route-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({comment:p(t.comment,`comment`,`text`),network:p(t.network,`network`,`text`),virtual_network_id:p(t[`virtual-network-id`],`virtual-network-id`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.networks.routes.edit({...e,account_id:r,route_id:t[`route-id`]})),{successLabel:`Updated`});return}let i=l({comment:p(t.comment,`comment`,`text`),network:p(t.network,`network`,`text`),virtual_network_id:p(t[`virtual-network-id`],`virtual-network-id`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.networks.routes.edit({...i,account_id:r,route_id:t[`route-id`]})),{successLabel:`Updated`})}};function Km(e){return e.positional(`route-id`,{type:`string`,description:`UUID of the route.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qm={command:`get <route-id>`,describe:`Get a private network route in an account.`,builder:Km,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust networks routes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/teamnet/routes/${t[`route-id`]==null?`<route-id>`:encodeURIComponent(String(t[`route-id`]))}`,pathParams:{"route-id":String(t[`route-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.networks.routes.get({account_id:r,route_id:t[`route-id`]})),{successLabel:`Loaded`})}};function Jm(e){return e.positional(`ip`,{type:`string`,description:`Ip`,demandOption:!0}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`default-virtual-network-fallback`,{type:`boolean`,description:`When the virtual_network_id parameter is not provided the request filter will default search routes that are in the default virtual network for the account. If this parameter is set to false, the search will include routes that do not have a virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ym={command:`get <ip>`,describe:`Fetches routes that contain the given IP address.`,builder:Jm,handler:async t=>{let n={virtual_network_id:t[`virtual-network-id`],default_virtual_network_fallback:t[`default-virtual-network-fallback`]};if(t.dryRun){d({command:`cf zero-trust networks routes ips get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/teamnet/routes/ip/${t.ip==null?`<ip>`:encodeURIComponent(String(t.ip))}`,pathParams:{ip:String(t.ip??``)},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.networks.routes.ips.get({account_id:i,ip:t.ip,...n})),{successLabel:`Loaded`})}},Xm={command:`ips`,describe:`Operations for networks.routes.ips`,builder:e=>e.command(Ym).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Zm(e){return e.option(`comment`,{type:`string`,description:`Optional remark describing the route.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted routes. If `false`, exclude deleted routes. If empty, all routes will be included."}).option(`network-subset`,{type:`string`,description:`If set, only list routes that are contained within this IP range.`}).option(`network-superset`,{type:`string`,description:`If set, only list routes that contain this IP range.`}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`route-id`,{type:`string`,description:`UUID of the route.`}).option(`tun-types`,{type:`string`,description:`The types of tunnels to filter by, separated by commas.`}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qm={command:`list`,describe:`Lists and filters private network routes in an account.`,builder:g(Zm),handler:async t=>{let n={comment:t.comment,is_deleted:t[`is-deleted`],network_subset:t[`network-subset`],network_superset:t[`network-superset`],existed_at:t[`existed-at`],tunnel_id:t[`tunnel-id`],route_id:t[`route-id`],tun_types:t[`tun-types`],virtual_network_id:t[`virtual-network-id`],per_page:t[`per-page`],page:t.page};if(t.dryRun){d({command:`cf zero-trust networks routes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/teamnet/routes`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.networks.routes.list({account_id:i,...n})),{successLabel:`Loaded`})}};function $m(e){return e.positional(`ip-network-encoded`,{type:`string`,description:`IP/CIDR range in URL-encoded format`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the route.`,default:``}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const eh={command:`create <ip-network-encoded>`,describe:"Routes a private network through a Cloudflare Tunnel. The CIDR in `ip_network_encoded` must be written in URL-encoded format.",builder:$m,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust networks routes networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/teamnet/routes/network/${t[`ip-network-encoded`]==null?`<ip-network-encoded>`:encodeURIComponent(String(t[`ip-network-encoded`]))}`,pathParams:{"ip-network-encoded":String(t[`ip-network-encoded`]??``)},bodyKind:`json`,body:t.body===void 0?l({comment:p(t.comment,`comment`,`text`),virtual_network_id:p(t[`virtual-network-id`],`virtual-network-id`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.networks.routes.networks.create({...e,account_id:r,ip_network_encoded:t[`ip-network-encoded`]})),{successLabel:`Created`});return}let i=l({comment:p(t.comment,`comment`,`text`),virtual_network_id:p(t[`virtual-network-id`],`virtual-network-id`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.networks.routes.networks.create({...i,account_id:r,ip_network_encoded:t[`ip-network-encoded`]})),{successLabel:`Created`})}};function th(e){return e.positional(`ip-network-encoded`,{type:`string`,description:`IP/CIDR range in URL-encoded format`,demandOption:!0}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`tun-type`,{type:`string`,description:`The type of tunnel.`,choices:[`cfd_tunnel`,`warp_connector`,`warp`,`magic`,`ip_sec`,`gre`,`cni`]}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const nh={command:`delete <ip-network-encoded>`,describe:"Deletes a private network route from an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format. If no virtual_network_id is provided it will delete the route from the default vnet. If no tun_type is provided it will fetch the type from the tunnel_id or if that is missing it will assume Cloudflare Tunnel as default. If tunnel_id is provided it will delete the route from that tunnel, otherwise it will delete the route based on the vnet and tun_type.",builder:g(th),handler:async t=>{let n={virtual_network_id:t[`virtual-network-id`],tun_type:t[`tun-type`],tunnel_id:t[`tunnel-id`]};if(t.dryRun){d({command:`cf zero-trust networks routes networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/teamnet/routes/network/${t[`ip-network-encoded`]==null?`<ip-network-encoded>`:encodeURIComponent(String(t[`ip-network-encoded`]))}`,pathParams:{"ip-network-encoded":String(t[`ip-network-encoded`]??``)},query:n,bodyKind:`none`});return}let r=await s(t),o=t.local?h:await a(r);if(t.accountId=o,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>r.zeroTrust.networks.routes.networks.delete({account_id:o,ip_network_encoded:t[`ip-network-encoded`],...n})),{successLabel:`Deleted`})}};function rh(e){return e.positional(`ip-network-encoded`,{type:`string`,description:`IP/CIDR range in URL-encoded format`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ih={command:`edit <ip-network-encoded>`,describe:"Updates an existing private network route in an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format.",builder:rh,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust networks routes networks edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/teamnet/routes/network/${t[`ip-network-encoded`]==null?`<ip-network-encoded>`:encodeURIComponent(String(t[`ip-network-encoded`]))}`,pathParams:{"ip-network-encoded":String(t[`ip-network-encoded`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Updating`,async()=>n.zeroTrust.networks.routes.networks.edit({account_id:r,ip_network_encoded:t[`ip-network-encoded`]})),{successLabel:`Updated`})}},ah={command:`networks`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(eh).command(nh).command(ih).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},oh={command:`routes`,describe:`Operations for networks.routes`,builder:e=>e.command(Vm).command(Um).command(Gm).command(qm).command(Qm).command(Xm).command(ah).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function sh(e){return e.positional(`address-family`,{type:`string`,description:"IP address family, either `v4` (IPv4) or `v6` (IPv6)",demandOption:!0}).option(`comment`,{type:`string`,description:`An optional description of the subnet.`}).option(`name`,{type:`string`,description:`A user-friendly name for the subnet.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ch={command:`update <address-family>`,describe:`Updates the Cloudflare Source subnet of the given address family`,builder:g(sh),handler:async t=>{if(t.dryRun){d({command:`cf zero-trust networks subnets cloudflare-source update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zerotrust/subnets/cloudflare_source/${t[`address-family`]==null?`<address-family>`:encodeURIComponent(String(t[`address-family`]))}`,pathParams:{"address-family":String(t[`address-family`]??``)},bodyKind:`json`,body:t.body===void 0?l({comment:p(t.comment,`comment`,`text`),name:p(t.name,`name`,`text`),network:p(t.network,`network`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.networks.subnets.cloudflareSource.update({...e,account_id:r,address_family:t[`address-family`]})),{successLabel:`Updated`});return}let i=l({comment:p(t.comment,`comment`,`text`),name:p(t.name,`name`,`text`),network:p(t.network,`network`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.networks.subnets.cloudflareSource.update({...i,account_id:r,address_family:t[`address-family`]})),{successLabel:`Updated`})}},lh={command:`cloudflare-source`,describe:`Operations for networks.subnets.cloudflare-source`,builder:e=>e.command(ch).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function uh(e){return e.option(`name`,{type:`string`,description:`If set, only list subnets with the given name`}).option(`comment`,{type:`string`,description:`If set, only list subnets with the given comment.`}).option(`network`,{type:`string`,description:`If set, only list the subnet whose network exactly matches the given CIDR.`}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`address-family`,{type:`string`,description:"If set, only include subnets in the given address family - `v4` or `v6`",choices:[`v4`,`v6`]}).option(`is-default-network`,{type:`boolean`,description:"If `true`, only include default subnets. If `false`, exclude default subnets subnets. If not set, all subnets will be included."}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted subnets. If `false`, exclude deleted subnets. If not set, all subnets will be included."}).option(`sort-order`,{type:`string`,description:"Sort order of the results. `asc` means oldest to newest, `desc` means newest to oldest. If not set, they will not be in any particular order.",choices:[`asc`,`desc`]}).option(`subnet-types`,{type:`string`,description:`If set, the types of subnets to include, separated by comma.`,choices:[`cloudflare_source`,`warp`]}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dh={command:`list`,describe:`Lists and filters subnets in an account.`,builder:g(uh),handler:async t=>{let n={name:t.name,comment:t.comment,network:t.network,existed_at:t[`existed-at`],address_family:t[`address-family`],is_default_network:t[`is-default-network`],is_deleted:t[`is-deleted`],sort_order:t[`sort-order`],subnet_types:t[`subnet-types`],per_page:t[`per-page`],page:t.page};if(t.dryRun){d({command:`cf zero-trust networks subnets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zerotrust/subnets`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.networks.subnets.list({account_id:i,...n})),{successLabel:`Loaded`})}};function fh(e){return e.option(`comment`,{type:`string`,description:`An optional description of the subnet.`,default:``}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this is the default subnet for the account. There can only be one default subnet per account.",default:!1}).option(`name`,{type:`string`,description:`A user-friendly name for the subnet.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ph={command:`create`,describe:"Create a WARP IP assignment subnet. Currently, only IPv4 subnets can be created. **Network constraints:** - The network must be within one of the following private IP ranges: - `10.0.0.0/8` (RFC 1918) - `172.16.0.0/12` (RFC 1918) - `192.168.0.0/16` (RFC 1918) - `100.64.0.0/10` (RFC 6598 - CGNAT) - The subnet must have a prefix length of `/24` or larger (e.g., `/16`, `/20`, `/24` are valid; `/25`, `/28` are not)",builder:fh,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust networks subnets warp create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zerotrust/subnets/warp`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({comment:p(n.comment,`comment`,`text`),is_default_network:n[`is-default-network`],name:p(n.name,`name`,`text`),network:p(n.network,`network`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.networks.subnets.warp.create({...e,account_id:i})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await t(`name`,`A user-friendly name for the subnet.`)),n.network===void 0&&(n.network=await t(`network`,`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`));let o=l({comment:p(n.comment,`comment`,`text`),is_default_network:n[`is-default-network`],name:p(n.name,`name`,`text`),network:p(n.network,`network`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.networks.subnets.warp.create({...o,account_id:i})),{successLabel:`Created`})}};function mh(e){return e.positional(`subnet-id`,{type:`string`,description:`The UUID of the subnet.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const hh={command:`delete <subnet-id>`,describe:`Delete a WARP IP assignment subnet. This operation is idempotent - deleting an already-deleted or non-existent subnet will return success with a null result.`,builder:mh,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust networks subnets warp delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zerotrust/subnets/warp/${t[`subnet-id`]==null?`<subnet-id>`:encodeURIComponent(String(t[`subnet-id`]))}`,pathParams:{"subnet-id":String(t[`subnet-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.networks.subnets.warp.delete({account_id:r,subnet_id:t[`subnet-id`]})),{successLabel:`Deleted`})}};function gh(e){return e.positional(`subnet-id`,{type:`string`,description:`The UUID of the subnet.`,demandOption:!0}).option(`comment`,{type:`string`,description:`An optional description of the subnet.`}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this is the default subnet for the account. There can only be one default subnet per account."}).option(`name`,{type:`string`,description:`A user-friendly name for the subnet.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _h={command:`edit <subnet-id>`,describe:"Updates a WARP IP assignment subnet. **Update constraints:** - The `network` field cannot be modified for WARP subnets. Only `name`, `comment`, and `is_default_network` can be updated. - IPv6 subnets cannot be updated",builder:gh,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust networks subnets warp edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zerotrust/subnets/warp/${t[`subnet-id`]==null?`<subnet-id>`:encodeURIComponent(String(t[`subnet-id`]))}`,pathParams:{"subnet-id":String(t[`subnet-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({comment:p(t.comment,`comment`,`text`),is_default_network:t[`is-default-network`],name:p(t.name,`name`,`text`),network:p(t.network,`network`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.networks.subnets.warp.edit({...e,account_id:r,subnet_id:t[`subnet-id`]})),{successLabel:`Updated`});return}let i=l({comment:p(t.comment,`comment`,`text`),is_default_network:t[`is-default-network`],name:p(t.name,`name`,`text`),network:p(t.network,`network`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.networks.subnets.warp.edit({...i,account_id:r,subnet_id:t[`subnet-id`]})),{successLabel:`Updated`})}};function vh(e){return e.positional(`subnet-id`,{type:`string`,description:`The UUID of the subnet.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yh={command:`get <subnet-id>`,describe:`Get a WARP IP assignment subnet.`,builder:vh,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust networks subnets warp get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zerotrust/subnets/warp/${t[`subnet-id`]==null?`<subnet-id>`:encodeURIComponent(String(t[`subnet-id`]))}`,pathParams:{"subnet-id":String(t[`subnet-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.networks.subnets.warp.get({account_id:r,subnet_id:t[`subnet-id`]})),{successLabel:`Loaded`})}},bh={command:`warp`,describe:`Operations for networks.subnets.warp`,builder:e=>e.command(ph).command(hh).command(_h).command(yh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},xh={command:`subnets`,describe:`Operations for networks.subnets`,builder:e=>e.command(dh).command(lh).command(bh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Sh(e){return e.option(`comment`,{type:`string`,description:`Optional remark describing the virtual network.`,default:``}).option(`is-default`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account."}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account.",default:!1}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ch={command:`create`,describe:`Adds a new virtual network to an account.`,builder:Sh,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust networks virtual-networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/teamnet/virtual_networks`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({comment:p(n.comment,`comment`,`text`),is_default:n[`is-default`],is_default_network:n[`is-default-network`],name:p(n.name,`name`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.networks.virtualNetworks.create({...e,account_id:i})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await t(`name`,`A user-friendly name for the virtual network.`));let o=l({comment:p(n.comment,`comment`,`text`),is_default:n[`is-default`],is_default_network:n[`is-default-network`],name:p(n.name,`name`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.networks.virtualNetworks.create({...o,account_id:i})),{successLabel:`Created`})}};function wh(e){return e.positional(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Th={command:`delete <virtual-network-id>`,describe:`Deletes an existing virtual network.`,builder:wh,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust networks virtual-networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/teamnet/virtual_networks/${t[`virtual-network-id`]==null?`<virtual-network-id>`:encodeURIComponent(String(t[`virtual-network-id`]))}`,pathParams:{"virtual-network-id":String(t[`virtual-network-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.networks.virtualNetworks.delete({account_id:r,virtual_network_id:t[`virtual-network-id`]})),{successLabel:`Deleted`})}};function Eh(e){return e.positional(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the virtual network.`}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account."}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Dh={command:`edit <virtual-network-id>`,describe:`Updates an existing virtual network.`,builder:Eh,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust networks virtual-networks edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/teamnet/virtual_networks/${t[`virtual-network-id`]==null?`<virtual-network-id>`:encodeURIComponent(String(t[`virtual-network-id`]))}`,pathParams:{"virtual-network-id":String(t[`virtual-network-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({comment:p(t.comment,`comment`,`text`),is_default_network:t[`is-default-network`],name:p(t.name,`name`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.networks.virtualNetworks.edit({...e,account_id:r,virtual_network_id:t[`virtual-network-id`]})),{successLabel:`Updated`});return}let i=l({comment:p(t.comment,`comment`,`text`),is_default_network:t[`is-default-network`],name:p(t.name,`name`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.networks.virtualNetworks.edit({...i,account_id:r,virtual_network_id:t[`virtual-network-id`]})),{successLabel:`Updated`})}};function Oh(e){return e.positional(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the virtual network.`,default:``}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account."}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const kh={command:`get <virtual-network-id>`,describe:`Get a virtual network.`,builder:Oh,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust networks virtual-networks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/teamnet/virtual_networks/${t[`virtual-network-id`]==null?`<virtual-network-id>`:encodeURIComponent(String(t[`virtual-network-id`]))}`,pathParams:{"virtual-network-id":String(t[`virtual-network-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.networks.virtualNetworks.get({account_id:r,virtual_network_id:t[`virtual-network-id`]})),{successLabel:`Loaded`})}};function Ah(e){return e.option(`id`,{type:`string`,description:`UUID of the virtual network.`}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`is-default`,{type:`boolean`,description:"If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included."}).option(`is-default-network`,{type:`boolean`,description:"If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included."}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted virtual networks. If `false`, exclude deleted virtual networks. If empty, all virtual networks will be included."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const jh={command:`list`,describe:`Lists and filters virtual networks in an account.`,builder:Ah,handler:async t=>{let n={id:t.id,name:t.name,is_default:t[`is-default`],is_default_network:t[`is-default-network`],is_deleted:t[`is-deleted`]};if(t.dryRun){d({command:`cf zero-trust networks virtual-networks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/teamnet/virtual_networks`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.networks.virtualNetworks.list({account_id:i,...n})),{successLabel:`Loaded`})}},Mh={command:`virtual-networks`,describe:`Operations for networks.virtual-networks`,builder:e=>e.command(Ch).command(Th).command(Dh).command(kh).command(jh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Nh={command:`networks`,describe:`Operations for networks`,builder:e=>e.command(zm).command(oh).command(xh).command(Mh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ph(e){return e.option(`allow-authenticate-via-warp`,{type:`boolean`,description:`When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.`,default:!1}).option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`auto-redirect-to-identity`,{type:`boolean`,description:"When set to `true`, users skip the identity provider selection step during login.",default:!1}).option(`deny-unmatched-requests`,{type:`boolean`,description:"Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names` array."}).option(`deny-unmatched-requests-exempted-zone-names`,{type:`string`,array:!0,description:"Contains zone names to exempt from the `deny_unmatched_requests` feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request."}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`,default:!1}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:`Lists the MFA methods that users can authenticate with.`}).option(`mfa-config-amr-matching-session-duration`,{type:`string`,description:`Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).`}).option(`mfa-config-required-aaguids`,{type:`string`,description:`Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`mfa-piv-key-requirements-pin-policy`,{type:`string`,description:"Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN required), `once` (PIN required once per session), `always` (PIN required for each use).",choices:[`never`,`once`,`always`]}).option(`mfa-piv-key-requirements-require-fips-device`,{type:`boolean`,description:`Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.`}).option(`mfa-piv-key-requirements-ssh-key-size`,{type:`string`,array:!0,description:`Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.`}).option(`mfa-piv-key-requirements-ssh-key-type`,{type:`string`,array:!0,description:"Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and `rsa`."}).option(`mfa-piv-key-requirements-touch-policy`,{type:`string`,description:"Defines when physical touch is required to use the SSH key. Valid values: `never` (no touch required), `always` (touch required for each use), `cached` (touch cached for 15 seconds).",choices:[`never`,`always`,`cached`]}).option(`mfa-required-for-all-apps`,{type:`boolean`,description:`Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: 'allowed_authenticators' cannot only contain 'piv_key' if the organization has any non-infrastructure applications because PIV keys are only compatible with infrastructure apps.`,default:!1}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`warp-auth-session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Fh={command:`create`,describe:`Sets up a Zero Trust organization for your account.`,builder:Ph,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust organizations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/organizations`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({allow_authenticate_via_warp:n[`allow-authenticate-via-warp`],auth_domain:p(n[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:n[`auto-redirect-to-identity`],deny_unmatched_requests:n[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:n[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:n[`is-ui-read-only`],login_design:{background_color:p(n[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(n[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(n[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(n[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(n[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:n[`mfa-config-allowed-authenticators`],amr_matching_session_duration:p(n[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:p(n[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:p(n[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:p(n[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:n[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:n[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:n[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:p(n[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:n[`mfa-required-for-all-apps`],name:p(n.name,`name`,`text`),session_duration:p(n[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:p(n[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(n[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_session_duration:p(n[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.organizations.create({...e,account_id:i})),{successLabel:`Created`});return}n[`auth-domain`]===void 0&&(n[`auth-domain`]=await t(`auth-domain`,`The unique subdomain assigned to your Zero Trust organization.`)),n.name===void 0&&(n.name=await t(`name`,`The name of your Zero Trust organization.`));let o=l({allow_authenticate_via_warp:n[`allow-authenticate-via-warp`],auth_domain:p(n[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:n[`auto-redirect-to-identity`],deny_unmatched_requests:n[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:n[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:n[`is-ui-read-only`],login_design:{background_color:p(n[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(n[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(n[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(n[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(n[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:n[`mfa-config-allowed-authenticators`],amr_matching_session_duration:p(n[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:p(n[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:p(n[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:p(n[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:n[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:n[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:n[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:p(n[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:n[`mfa-required-for-all-apps`],name:p(n.name,`name`,`text`),session_duration:p(n[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:p(n[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(n[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_session_duration:p(n[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.organizations.create({...o,account_id:i})),{successLabel:`Created`})}};function Ih(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Lh={command:`get`,describe:`Returns the DoH settings for your Zero Trust organization.`,builder:Ih,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust organizations doh get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/organizations/doh`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.organizations.doh.get({account_id:r})),{successLabel:`Loaded`})}};function Rh(e){return e.option(`doh-jwt-duration`,{type:`string`,description:"The duration the DoH JWT is valid for. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.  Note that the maximum duration for this setting is the same as the key rotation period on the account. Default expiration is 24h"}).option(`service-token-id`,{type:`string`,description:`The uuid of the service token you want to use for DoH authentication`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const zh={command:`update`,describe:`Updates the DoH settings for your Zero Trust organization.`,builder:Rh,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust organizations doh update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/organizations/doh`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({doh_jwt_duration:p(t[`doh-jwt-duration`],`doh-jwt-duration`,`text`),service_token_id:p(t[`service-token-id`],`service-token-id`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.organizations.doh.update({...e,account_id:r})),{successLabel:`Updated`});return}let i=l({doh_jwt_duration:p(t[`doh-jwt-duration`],`doh-jwt-duration`,`text`),service_token_id:p(t[`service-token-id`],`service-token-id`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.organizations.doh.update({...i,account_id:r})),{successLabel:`Updated`})}},Bh={command:`doh`,describe:`Zero Trust organization settings including login page, session duration, and user seat management`,builder:e=>e.command(Lh).command(zh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Vh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Hh={command:`list`,describe:`Returns the configuration for your Zero Trust organization.`,builder:Vh,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust organizations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/organizations`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.organizations.list({account_id:r})),{successLabel:`Loaded`})}};function Uh(e){return e.option(`devices`,{type:`boolean`,description:"When set to `true`, all devices associated with the user will be revoked."}).option(`email`,{type:`string`,description:`The email of the user to revoke.`}).option(`user-uid`,{type:`string`,description:`The uuid of the user to revoke.`}).option(`warp-session-reauth`,{type:`boolean`,description:"When set to `true`, the user will be required to re-authenticate to WARP for all Gateway policies that enforce a WARP client session duration. When `false`, the user’s WARP session will remain active"}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wh={command:`revoke-users`,describe:`Revokes a user's access across all applications.`,builder:Uh,handler:async n=>{let r={devices:n.devices};if(n.dryRun){d({command:`cf zero-trust organizations revoke-users`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/organizations/revoke_user`,pathParams:{},query:r,bodyKind:`json`,body:n.body===void 0?l({email:p(n.email,`email`,`text`),user_uid:p(n[`user-uid`],`user-uid`,`text`),warp_session_reauth:n[`warp-session-reauth`]}):c(n.body)});return}let o=await s(n),m=n.local?h:await a(o);if(n.accountId=m,!await i({force:!!n.force,message:`This operation revokes all access tokens for a user destructively.`})){process.stderr.write(`Aborted.
-`);return}if(n.body){let e=c(n.body);new URLSearchParams(Object.entries(r).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString(),u(await f(`Deleting`,async()=>o.zeroTrust.organizations.revokeUsers({...e,account_id:m,...r})),{successLabel:`Deleted`});return}n.email===void 0&&(n.email=await t(`email`,`The email of the user to revoke.`));let g=l({email:p(n.email,`email`,`text`),user_uid:p(n[`user-uid`],`user-uid`,`text`),warp_session_reauth:n[`warp-session-reauth`]});new URLSearchParams(Object.entries(r).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString(),u(await f(`Deleting`,async()=>o.zeroTrust.organizations.revokeUsers({...g,account_id:m,...r})),{successLabel:`Deleted`})}};function Gh(e){return e.option(`allow-authenticate-via-warp`,{type:`boolean`,description:`When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.`}).option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`auto-redirect-to-identity`,{type:`boolean`,description:"When set to `true`, users skip the identity provider selection step during login."}).option(`custom-pages-forbidden`,{type:`string`,description:`The uid of the custom page to use when a user is denied access after failing a non-identity rule.`}).option(`custom-pages-identity-denied`,{type:`string`,description:`The uid of the custom page to use when a user is denied access.`}).option(`deny-unmatched-requests`,{type:`boolean`,description:"Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names` array."}).option(`deny-unmatched-requests-exempted-zone-names`,{type:`string`,array:!0,description:"Contains zone names to exempt from the `deny_unmatched_requests` feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request."}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:`Lists the MFA methods that users can authenticate with.`}).option(`mfa-config-amr-matching-session-duration`,{type:`string`,description:`Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).`}).option(`mfa-config-required-aaguids`,{type:`string`,description:`Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`mfa-piv-key-requirements-pin-policy`,{type:`string`,description:"Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN required), `once` (PIN required once per session), `always` (PIN required for each use).",choices:[`never`,`once`,`always`]}).option(`mfa-piv-key-requirements-require-fips-device`,{type:`boolean`,description:`Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.`}).option(`mfa-piv-key-requirements-ssh-key-size`,{type:`string`,array:!0,description:`Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.`}).option(`mfa-piv-key-requirements-ssh-key-type`,{type:`string`,array:!0,description:"Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and `rsa`."}).option(`mfa-piv-key-requirements-touch-policy`,{type:`string`,description:"Defines when physical touch is required to use the SSH key. Valid values: `never` (no touch required), `always` (touch required for each use), `cached` (touch cached for 15 seconds).",choices:[`never`,`always`,`cached`]}).option(`mfa-required-for-all-apps`,{type:`boolean`,description:`Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: 'allowed_authenticators' cannot only contain 'piv_key' if the organization has any non-infrastructure applications because PIV keys are only compatible with infrastructure apps.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`warp-auth-session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Kh={command:`update`,describe:`Updates the configuration for your Zero Trust organization.`,builder:Gh,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust organizations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/organizations`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({allow_authenticate_via_warp:t[`allow-authenticate-via-warp`],auth_domain:p(t[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:t[`auto-redirect-to-identity`],custom_pages:{forbidden:p(t[`custom-pages-forbidden`],`custom-pages-forbidden`,`text`),identity_denied:p(t[`custom-pages-identity-denied`],`custom-pages-identity-denied`,`text`)},deny_unmatched_requests:t[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:t[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:t[`is-ui-read-only`],login_design:{background_color:p(t[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(t[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(t[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(t[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(t[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:t[`mfa-config-allowed-authenticators`],amr_matching_session_duration:p(t[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:p(t[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:p(t[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:p(t[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:t[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:t[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:t[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:p(t[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:t[`mfa-required-for-all-apps`],name:p(t.name,`name`,`text`),session_duration:p(t[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:p(t[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(t[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_session_duration:p(t[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.organizations.update({...e,account_id:r})),{successLabel:`Updated`});return}let i=l({allow_authenticate_via_warp:t[`allow-authenticate-via-warp`],auth_domain:p(t[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:t[`auto-redirect-to-identity`],custom_pages:{forbidden:p(t[`custom-pages-forbidden`],`custom-pages-forbidden`,`text`),identity_denied:p(t[`custom-pages-identity-denied`],`custom-pages-identity-denied`,`text`)},deny_unmatched_requests:t[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:t[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:t[`is-ui-read-only`],login_design:{background_color:p(t[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(t[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(t[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(t[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(t[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:t[`mfa-config-allowed-authenticators`],amr_matching_session_duration:p(t[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:p(t[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:p(t[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:p(t[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:t[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:t[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:t[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:p(t[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:t[`mfa-required-for-all-apps`],name:p(t.name,`name`,`text`),session_duration:p(t[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:p(t[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(t[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_session_duration:p(t[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.organizations.update({...i,account_id:r})),{successLabel:`Updated`})}},qh={command:`organizations`,describe:`Zero Trust organization settings including login page, session duration, and user seat management`,builder:e=>e.command(Fh).command(Hh).command(Wh).command(Kh).command(Bh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Jh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yh={command:`list`,describe:`Lists all DLP custom profiles in an account.`,builder:Jh,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust profiles custom list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/profiles/custom`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.profiles.custom.list({account_id:r})),{successLabel:`Loaded`})}},Xh={command:`custom`,describe:`Profiles operations`,builder:e=>e.command(Yh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Zh(e){return e.option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Predefined profiles can not be created. This endpoint will only update an existing predefined profiles settings.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const Qh={command:`create`,describe:`Creates a DLP predefined profile. Only supports enabling/disabling entries.`,builder:Zh,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust profiles predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/profiles/predefined`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({ai_context_enabled:n[`ai-context-enabled`],allowed_match_count:n[`allowed-match-count`],confidence_threshold:p(n[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:n[`context-awareness-enabled`],skip:{files:n[`context-awareness-skip-files`]}},ocr_enabled:n[`ocr-enabled`],profile_id:p(n[`profile-id`],`profile-id`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.profiles.predefined.create({...e,account_id:i})),{successLabel:`Created`});return}n[`profile-id`]===void 0&&(n[`profile-id`]=await t(`profile-id`,`The profile_id field`));let o=l({ai_context_enabled:n[`ai-context-enabled`],allowed_match_count:n[`allowed-match-count`],confidence_threshold:p(n[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:n[`context-awareness-enabled`],skip:{files:n[`context-awareness-skip-files`]}},ocr_enabled:n[`ocr-enabled`],profile_id:p(n[`profile-id`],`profile-id`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.profiles.predefined.create({...o,account_id:i})),{successLabel:`Created`})}};function $h(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const eg={command:`get <profile-id>`,describe:`Fetches a predefined DLP profile by id.`,builder:$h,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust profiles predefined get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/profiles/predefined/${t[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(t[`profile-id`]))}`,pathParams:{"profile-id":String(t[`profile-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.profiles.predefined.get({account_id:r,profile_id:t[`profile-id`]})),{successLabel:`Loaded`})}};function tg(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the predefined profile.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const ng={command:`update <profile-id>`,describe:`Updates a DLP predefined profile. Only supports enabling/disabling entries.`,builder:tg,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust profiles predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/profiles/predefined/${t[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(t[`profile-id`]))}`,pathParams:{"profile-id":String(t[`profile-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({ai_context_enabled:t[`ai-context-enabled`],allowed_match_count:t[`allowed-match-count`],confidence_threshold:p(t[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:t[`context-awareness-enabled`],skip:{files:t[`context-awareness-skip-files`]}},ocr_enabled:t[`ocr-enabled`]}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.profiles.predefined.update({...e,account_id:r,profile_id:t[`profile-id`]})),{successLabel:`Updated`});return}let i=l({ai_context_enabled:t[`ai-context-enabled`],allowed_match_count:t[`allowed-match-count`],confidence_threshold:p(t[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:t[`context-awareness-enabled`],skip:{files:t[`context-awareness-skip-files`]}},ocr_enabled:t[`ocr-enabled`]});u(await f(`Updating`,async()=>n.zeroTrust.profiles.predefined.update({...i,account_id:r,profile_id:t[`profile-id`]})),{successLabel:`Updated`})}},rg={command:`predefined`,describe:`Profiles operations`,builder:e=>e.command(Qh).command(eg).command(ng).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ig={command:`profiles`,describe:`Operations for profiles`,builder:e=>e.command(Xh).command(rg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ag(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const og={command:`get`,describe:`Retrieves configured risk score behaviors that define how user actions affect their overall risk score.`,builder:ag,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust risk-scoring behaviours get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zt_risk_scoring/behaviors`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.riskScoring.behaviours.get({account_id:r})),{successLabel:`Loaded`})}};function sg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Behaviors.`})}const cg={command:`update`,describe:`Updates risk score behavior configurations, defining weights and thresholds for risk calculation.`,builder:sg,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust risk-scoring behaviours update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zt_risk_scoring/behaviors`,pathParams:{},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.riskScoring.behaviours.update({body:e,account_id:r})),{successLabel:`Updated`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},lg={command:`behaviours`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(og).command(cg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ug(e){return e.positional(`user-id`,{type:`string`,description:`User ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dg={command:`get <user-id>`,describe:`Retrieves the detailed risk score breakdown for a specific user, including contributing factors.`,builder:ug,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust risk-scoring get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zt_risk_scoring/${t[`user-id`]==null?`<user-id>`:encodeURIComponent(String(t[`user-id`]))}`,pathParams:{"user-id":String(t[`user-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.riskScoring.get({account_id:r,user_id:t[`user-id`]})),{successLabel:`Loaded`})}};function fg(e){return e.option(`integration-type`,{type:`string`,description:`The integration_type field`,choices:[`Okta`]}).option(`reference-id`,{type:`string`,description:`A reference id that can be supplied by the client. Currently this should be set to the Access-Okta IDP ID (a UUIDv4).
-https://developers.cloudflare.com/api/operations/access-identity-providers-get-an-access-identity-provider`}).option(`tenant-url`,{type:`string`,description:`The base url of the tenant, e.g. "https://tenant.okta.com".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pg={command:`create`,describe:`Creates a new Zero Trust risk score integration, connecting external risk signals to Cloudflare's risk scoring system.`,builder:fg,handler:async r=>{if(r.dryRun){d({command:`cf zero-trust risk-scoring integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zt_risk_scoring/integrations`,pathParams:{},bodyKind:`json`,body:r.body===void 0?l({integration_type:p(r[`integration-type`],`integration-type`,`text`),reference_id:p(r[`reference-id`],`reference-id`,`text`),tenant_url:p(r[`tenant-url`],`tenant-url`,`text`)}):c(r.body)});return}let i=await s(r),o=r.local?h:await a(i);if(r.accountId=o,r.body){let e=c(r.body);u(await f(`Creating`,async()=>i.zeroTrust.riskScoring.integrations.create({...e,account_id:o})),{successLabel:`Created`});return}r[`integration-type`]===void 0&&(r[`integration-type`]=await n(`integration-type`,`The integration_type field`,[`Okta`])),r[`tenant-url`]===void 0&&(r[`tenant-url`]=await t(`tenant-url`,`The base url of the tenant, e.g. "https://tenant.okta.com".`));let m=l({integration_type:p(r[`integration-type`],`integration-type`,`text`),reference_id:p(r[`reference-id`],`reference-id`,`text`),tenant_url:p(r[`tenant-url`],`tenant-url`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.riskScoring.integrations.create({...m,account_id:o})),{successLabel:`Created`})}};function mg(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const hg={command:`delete <integration-id>`,describe:`Removes a Zero Trust risk score integration, disconnecting the external risk signal source.`,builder:mg,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust risk-scoring integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zt_risk_scoring/integrations/${t[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(t[`integration-id`]))}`,pathParams:{"integration-id":String(t[`integration-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.riskScoring.integrations.delete({account_id:r,integration_id:t[`integration-id`]})),{successLabel:`Deleted`})}};function gg(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _g={command:`get <integration-id>`,describe:`Gets a Zero Trust risk score integration by ID.`,builder:gg,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust risk-scoring integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zt_risk_scoring/integrations/${t[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(t[`integration-id`]))}`,pathParams:{"integration-id":String(t[`integration-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.riskScoring.integrations.get({account_id:r,integration_id:t[`integration-id`]})),{successLabel:`Loaded`})}};function vg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yg={command:`list`,describe:`Lists all configured Zero Trust risk score integrations for the account.`,builder:vg,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust risk-scoring integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zt_risk_scoring/integrations`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.riskScoring.integrations.list({account_id:r})),{successLabel:`Loaded`})}};function bg(e){return e.positional(`reference-id`,{type:`string`,description:`Reference ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xg={command:`get <reference-id>`,describe:`Retrieves a Zero Trust risk score integration using its external reference ID.`,builder:bg,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust risk-scoring integrations references get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zt_risk_scoring/integrations/reference_id/${t[`reference-id`]==null?`<reference-id>`:encodeURIComponent(String(t[`reference-id`]))}`,pathParams:{"reference-id":String(t[`reference-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.riskScoring.integrations.references.get({account_id:r,reference_id:t[`reference-id`]})),{successLabel:`Loaded`})}},Sg={command:`references`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(xg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Cg(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`active`,{type:`boolean`,description:`Whether this integration is enabled. If disabled, no risk changes will be exported to the third-party.`}).option(`reference-id`,{type:`string`,description:`A reference id that can be supplied by the client. Currently this should be set to the Access-Okta IDP ID (a UUIDv4).
-https://developers.cloudflare.com/api/operations/access-identity-providers-get-an-access-identity-provider`}).option(`tenant-url`,{type:`string`,description:`The base url of the tenant, e.g. "https://tenant.okta.com".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const wg={command:`update <integration-id>`,describe:`Overwrite the reference_id, tenant_url, and active values with the ones provided.`,builder:Cg,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust risk-scoring integrations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zt_risk_scoring/integrations/${n[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(n[`integration-id`]))}`,pathParams:{"integration-id":String(n[`integration-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({active:n.active,reference_id:p(n[`reference-id`],`reference-id`,`text`),tenant_url:p(n[`tenant-url`],`tenant-url`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Updating`,async()=>r.zeroTrust.riskScoring.integrations.update({...e,account_id:i,integration_id:n[`integration-id`]})),{successLabel:`Updated`});return}if(n.active===void 0)throw Error(`--active is required (or pass --body with this field set).`);n[`tenant-url`]===void 0&&(n[`tenant-url`]=await t(`tenant-url`,`The base url of the tenant, e.g. "https://tenant.okta.com".`));let o=l({active:n.active,reference_id:p(n[`reference-id`],`reference-id`,`text`),tenant_url:p(n[`tenant-url`],`tenant-url`,`text`)});u(await f(`Updating`,async()=>r.zeroTrust.riskScoring.integrations.update({...o,account_id:i,integration_id:n[`integration-id`]})),{successLabel:`Updated`})}},Tg={command:`integrations`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(pg).command(hg).command(_g).command(yg).command(wg).command(Sg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Eg(e){return e.positional(`user-id`,{type:`string`,description:`User ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Dg={command:`reset <user-id>`,describe:`Resets risk scores for specified users, clearing their accumulated risk history.`,builder:Eg,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust risk-scoring reset`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zt_risk_scoring/${t[`user-id`]==null?`<user-id>`:encodeURIComponent(String(t[`user-id`]))}/reset`,pathParams:{"user-id":String(t[`user-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force,message:`This operation wipes risk-scoring history.`})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.riskScoring.reset({account_id:r,user_id:t[`user-id`]})),{successLabel:`Deleted`})}};function Og(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const kg={command:`get`,describe:`Gets an aggregate summary of risk scores across the account, including distribution and trends.`,builder:Og,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust risk-scoring summary get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/zt_risk_scoring/summary`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.riskScoring.summary.get({account_id:r})),{successLabel:`Loaded`})}},Ag={command:`summary`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(kg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},jg={command:`risk-scoring`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(dg).command(Dg).command(lg).command(Tg).command(Ag).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Mg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ng={command:`edit`,describe:"Removes a user from a Zero Trust seat when both `access_seat` and `gateway_seat` are set to false.",builder:Mg,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust seats edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/seats`,pathParams:{},bodyKind:`json`,body:t.body===void 0?void 0:c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.seats.edit({body:e,account_id:r})),{successLabel:`Updated`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Pg={command:`seats`,describe:`View and manage user seat allocations for your Zero Trust subscription`,builder:e=>e.command(Ng).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Fg(e){return e.option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.",default:1}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).",default:`8760h`}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ig={command:`create`,describe:`Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to create a new service token.`,builder:Fg,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust service-tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({client_secret_version:e[`client-secret-version`],duration:p(e.duration,`duration`,`text`),name:p(e.name,`name`,`text`),previous_client_secret_expires_at:p(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):c(e.body)});return}let n=await s(e),i=await r({zone:e.zone},n,{quiet:e.quiet});if(e.zoneId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.serviceTokens.create({...t,zone_id:i})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await t(`name`,`The name of the service token.`));let a=l({client_secret_version:e[`client-secret-version`],duration:p(e.duration,`duration`,`text`),name:p(e.name,`name`,`text`),previous_client_secret_expires_at:p(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.serviceTokens.create({...a,zone_id:i})),{successLabel:`Created`})}};function Lg(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Rg={command:`delete <service-token-id>`,describe:`Deletes a service token.`,builder:Lg,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust service-tokens delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i({force:!!e.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>t.zeroTrust.serviceTokens.delete({zone_id:n,service_token_id:e[`service-token-id`]})),{successLabel:`Deleted`})}};function zg(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bg={command:`get <service-token-id>`,describe:`Fetches a single service token.`,builder:zg,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust service-tokens get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.serviceTokens.get({zone_id:n,service_token_id:e[`service-token-id`]})),{successLabel:`Loaded`})}};function Vg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Hg={command:`list`,describe:`Lists all service tokens.`,builder:Vg,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust service-tokens list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.serviceTokens.list({zone_id:n})),{successLabel:`Loaded`})}};function Ug(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`."}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h)."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wg={command:`update <service-token-id>`,describe:`Updates a configured service token.`,builder:Ug,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust service-tokens update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({client_secret_version:e[`client-secret-version`],duration:p(e.duration,`duration`,`text`),name:p(e.name,`name`,`text`),previous_client_secret_expires_at:p(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):c(e.body)});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.serviceTokens.update({...r,zone_id:n,service_token_id:e[`service-token-id`]})),{successLabel:`Updated`});return}let i=l({client_secret_version:e[`client-secret-version`],duration:p(e.duration,`duration`,`text`),name:p(e.name,`name`,`text`),previous_client_secret_expires_at:p(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});u(await f(`Updating`,async()=>t.zeroTrust.serviceTokens.update({...i,zone_id:n,service_token_id:e[`service-token-id`]})),{successLabel:`Updated`})}},Gg={command:`service-tokens`,describe:`Service Tokens operations`,builder:e=>e.command(Ig).command(Rg).command(Bg).command(Hg).command(Wg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Kg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const qg={command:`delete`,describe:`Deletes account-level DLP settings and returns the initial values.`,builder:Kg,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust settings delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.settings.delete({account_id:r})),{successLabel:`Deleted`})}};function Jg(e){return e.option(`ai-context-analysis`,{type:`boolean`,description:`Whether AI context analysis is enabled at the account level.`}).option(`ocr`,{type:`boolean`,description:`Whether OCR is enabled at the account level.`}).option(`payload-logging-public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
+- If the field is missing, the existing setting will be cleared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`New payload log settings.`})}const sd={command:`update`,describe:`Enables or disables payload logging for DLP matches. When enabled, matched content is stored for review.`,builder:od,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp payload-logs update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/payload_log`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({public_key:p(e[`public-key`],`public-key`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.dlp.payloadLogs.update({...t,account_id:i})),{successLabel:`Updated`});return}let a=l({public_key:p(e[`public-key`],`public-key`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.dlp.payloadLogs.update({...a,account_id:i})),{successLabel:`Updated`})}},cd={command:`payload-logs`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(ad).command(sd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ld(e){return e.option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`Related DLP policies will trigger when the match count exceeds the number set.`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`data-classes`,{type:`string`,array:!0,description:`Data class IDs to associate with the profile.`}).option(`data-tags`,{type:`string`,array:!0,description:`Data tag IDs to associate with the profile.`}).option(`description`,{type:`string`,description:`The description of the profile.`}).option(`name`,{type:`string`,description:`The name field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new profile to create.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const ud={command:`create`,describe:`Creates a DLP custom profile.`,builder:ld,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dlp profiles custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/profiles/custom`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({ai_context_enabled:n[`ai-context-enabled`],allowed_match_count:n[`allowed-match-count`],confidence_threshold:p(n[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:n[`context-awareness-enabled`],skip:{files:n[`context-awareness-skip-files`]}},data_classes:n[`data-classes`],data_tags:n[`data-tags`],description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`),ocr_enabled:n[`ocr-enabled`]}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.dlp.profiles.custom.create({...e,account_id:a})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await e(`name`,`The name field`));let o=l({ai_context_enabled:n[`ai-context-enabled`],allowed_match_count:n[`allowed-match-count`],confidence_threshold:p(n[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:n[`context-awareness-enabled`],skip:{files:n[`context-awareness-skip-files`]}},data_classes:n[`data-classes`],data_tags:n[`data-tags`],description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`),ocr_enabled:n[`ocr-enabled`]});u(await f(`Creating`,async()=>i.zeroTrust.dlp.profiles.custom.create({...o,account_id:a})),{successLabel:`Created`})}};function dd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const fd={command:`delete <profile-id>`,describe:`Deletes a DLP custom profile.`,builder:dd,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp profiles custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/profiles/custom/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dlp.profiles.custom.delete({account_id:a,profile_id:e[`profile-id`]})),{successLabel:`Deleted`})}};function pd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const md={command:`get <profile-id>`,describe:`Fetches a custom DLP profile by id.`,builder:pd,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp profiles custom get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/profiles/custom/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.dlp.profiles.custom.get({account_id:i,profile_id:e[`profile-id`]})),{successLabel:`Loaded`})}};function hd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`data-classes`,{type:`string`,array:!0,description:`Data class IDs to associate with the profile. If omitted, existing associations are unchanged.`}).option(`data-tags`,{type:`string`,array:!0,description:`Data tag IDs to associate with the profile. If omitted, existing associations are unchanged.`}).option(`description`,{type:`string`,description:`The description of the profile.`}).option(`name`,{type:`string`,description:`The name field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the profile.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const gd={command:`update <profile-id>`,describe:`Updates a DLP custom profile.`,builder:hd,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust dlp profiles custom update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/profiles/custom/${n[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(n[`profile-id`]))}`,pathParams:{"profile-id":String(n[`profile-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({ai_context_enabled:n[`ai-context-enabled`],allowed_match_count:n[`allowed-match-count`],confidence_threshold:p(n[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:n[`context-awareness-enabled`],skip:{files:n[`context-awareness-skip-files`]}},data_classes:n[`data-classes`],data_tags:n[`data-tags`],description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`),ocr_enabled:n[`ocr-enabled`]}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Updating`,async()=>i.zeroTrust.dlp.profiles.custom.update({...e,account_id:a,profile_id:n[`profile-id`]})),{successLabel:`Updated`});return}n.name===void 0&&(n.name=await e(`name`,`The name field`));let o=l({ai_context_enabled:n[`ai-context-enabled`],allowed_match_count:n[`allowed-match-count`],confidence_threshold:p(n[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:n[`context-awareness-enabled`],skip:{files:n[`context-awareness-skip-files`]}},data_classes:n[`data-classes`],data_tags:n[`data-tags`],description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`),ocr_enabled:n[`ocr-enabled`]});u(await f(`Updating`,async()=>i.zeroTrust.dlp.profiles.custom.update({...o,account_id:a,profile_id:n[`profile-id`]})),{successLabel:`Updated`})}},_d={command:`custom`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(ud).command(fd).command(md).command(gd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function vd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yd={command:`get <profile-id>`,describe:`Fetches a DLP profile by ID.`,builder:vd,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp profiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/profiles/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.dlp.profiles.get({account_id:i,profile_id:e[`profile-id`]})),{successLabel:`Loaded`})}};function bd(e){return e.option(`all`,{type:`boolean`,description:`Return all profiles, including those that current account does not have access to.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xd={command:`list`,describe:`Lists all DLP profiles in an account.`,builder:bd,handler:async e=>{let n={all:e.all};if(e.dryRun){d({command:`cf zero-trust dlp profiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/profiles`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.dlp.profiles.list({account_id:a,...n})),{successLabel:`Loaded`})}};function Sd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`enabled-entries`,{type:`string`,array:!0,description:`The enabled_entries field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Predefined profiles can not be created. This endpoint will only update an existing predefined profiles settings.`})}const Cd={command:`create <profile-id>`,describe:"This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Creates a DLP predefined profile. Only supports enabling/disabling entries.",builder:Sd,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp profiles predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/profiles/predefined/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}/config`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:p(e[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:e[`enabled-entries`],ocr_enabled:e[`ocr-enabled`]}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.dlp.profiles.predefined.create({body:t,account_id:i,profile_id:e[`profile-id`]})),{successLabel:`Created`});return}let a=l({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:p(e[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:e[`enabled-entries`],ocr_enabled:e[`ocr-enabled`]});u(await f(`Creating`,async()=>n.zeroTrust.dlp.profiles.predefined.create({body:a,account_id:i,profile_id:e[`profile-id`]})),{successLabel:`Created`})}};function wd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Td={command:`delete <profile-id>`,describe:`This is a no-op as predefined profiles can't be deleted but is needed for our generated terraform API.`,builder:wd,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp profiles predefined delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/profiles/predefined/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.dlp.profiles.predefined.delete({account_id:a,profile_id:e[`profile-id`]})),{successLabel:`Deleted`})}};function Ed(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dd={command:`get <profile-id>`,describe:"This is similar to `get_predefined` but only returns entries that are enabled. This is needed for our terraform API Fetches a predefined DLP profile by id.",builder:Ed,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp profiles predefined get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/profiles/predefined/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}/config`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.dlp.profiles.predefined.get({account_id:i,profile_id:e[`profile-id`]})),{successLabel:`Loaded`})}};function Od(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`enabled-entries`,{type:`string`,array:!0,description:`The enabled_entries field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the predefined profile.`})}const kd={command:`update <profile-id>`,describe:"This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Updates a DLP predefined profile. Only supports enabling/disabling entries.",builder:Od,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust dlp profiles predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/profiles/predefined/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}/config`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:p(e[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:e[`enabled-entries`],ocr_enabled:e[`ocr-enabled`]}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.dlp.profiles.predefined.update({body:t,account_id:i,profile_id:e[`profile-id`]})),{successLabel:`Updated`});return}let a=l({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:p(e[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:e[`enabled-entries`],ocr_enabled:e[`ocr-enabled`]});u(await f(`Updating`,async()=>n.zeroTrust.dlp.profiles.predefined.update({body:a,account_id:i,profile_id:e[`profile-id`]})),{successLabel:`Updated`})}},Ad={command:`predefined`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Cd).command(Td).command(Dd).command(kd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},jd={command:`profiles`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(yd).command(xd).command(_d).command(Ad).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Md={command:`dlp`,describe:`Operations for dlp`,builder:e=>e.command(au).command(Cu).command(Zu).command(ed).command(rd).command(cd).command(jd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Nd(e){return e.option(`description`,{type:`string`,description:`The description field`,default:``}).option(`match-percent`,{type:`number`,description:`The match_percent field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new document fingerprint.`})}const Pd={command:`fingerprints`,describe:`Creates a new document fingerprint for DLP scanning. Document fingerprints detect documents that are structurally similar to the uploaded sample.`,builder:Nd,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust document-fingerprints create document fingerprints`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/document_fingerprints`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({description:p(n.description,`description`,`text`),match_percent:n[`match-percent`],name:p(n.name,`name`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.documentFingerprints.create.document.fingerprints({...e,account_id:a})),{successLabel:`Created`});return}if(n[`match-percent`]===void 0)throw Error(`--match-percent is required (or pass --body with this field set).`);n.name===void 0&&(n.name=await e(`name`,`The name field`));let o=l({description:p(n.description,`description`,`text`),match_percent:n[`match-percent`],name:p(n.name,`name`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.documentFingerprints.create.document.fingerprints({...o,account_id:a})),{successLabel:`Created`})}},Fd={command:`document`,describe:`Document Fingerprints operations`,builder:e=>e.command(Pd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Id(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`match-percent`,{type:`number`,description:`The match_percent field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the document fingerprint to update.`})}const Ld={command:`v2 <document-fingerprint-id>`,describe:`Updates metadata for an existing document fingerprint, such as its name or description.`,builder:Id,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust document-fingerprints create v2`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/document_fingerprints/${e[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(e[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(e[`document-fingerprint-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({description:p(e.description,`description`,`text`),match_percent:e[`match-percent`],name:p(e.name,`name`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.documentFingerprints.create.v2({...t,account_id:i,document_fingerprint_id:e[`document-fingerprint-id`]})),{successLabel:`Created`});return}let a=l({description:p(e.description,`description`,`text`),match_percent:e[`match-percent`],name:p(e.name,`name`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.documentFingerprints.create.v2({...a,account_id:i,document_fingerprint_id:e[`document-fingerprint-id`]})),{successLabel:`Created`})}},Rd={command:`create`,describe:`Document Fingerprints operations`,builder:e=>e.command(Ld).command(Fd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function zd(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Bd={command:`delete <document-fingerprint-id>`,describe:`Removes a document fingerprint from DLP configuration. Documents matching this fingerprint will no longer be detected.`,builder:zd,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust document-fingerprints delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/document_fingerprints/${e[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(e[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(e[`document-fingerprint-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.documentFingerprints.delete({account_id:a,document_fingerprint_id:e[`document-fingerprint-id`]})),{successLabel:`Deleted`})}};function Vd(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Hd={command:`fingerprints <document-fingerprint-id>`,describe:`Gets a document fingerprint and its latest upload status.`,builder:Vd,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust document-fingerprints get document fingerprints`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/document_fingerprints/${e[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(e[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(e[`document-fingerprint-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.documentFingerprints.get.document.fingerprints({account_id:i,document_fingerprint_id:e[`document-fingerprint-id`]})),{successLabel:`Loaded`})}},Ud={command:`document`,describe:`Document Fingerprints operations`,builder:e=>e.command(Hd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Wd(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gd={command:`all`,describe:`Lists all document fingerprints configured for DLP scanning in the account.`,builder:Wd,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust document-fingerprints get fingerprints all`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/document_fingerprints`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.documentFingerprints.get.fingerprints.all({account_id:i})),{successLabel:`Loaded`})}},Kd={command:`fingerprints`,describe:`Document Fingerprints operations`,builder:e=>e.command(Gd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},qd={command:`get`,describe:`Operations for document-fingerprints.get`,builder:e=>e.command(Ud).command(Kd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Jd(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`File used for document fingerprinting.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Yd={command:`update <document-fingerprint-id>`,describe:`Uploads a new document to create or update a fingerprint. The document structure is analyzed to enable detection of similar documents.`,builder:Jd,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust document-fingerprints update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/document_fingerprints/${e[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(e[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(e[`document-fingerprint-id`]??``)},bodyKind:`multipart`,body:{body:e.body,file:e.file}});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.file!==void 0||e.body!==void 0){let t=new FormData;if(e.file){let n=m(e.file);t.append(`file`,new Blob([n]),e.file.split(/[\\/]/).filter(Boolean).pop())}else e.body!==void 0&&t.append(`file`,e.body);u(await f(`Updating`,async()=>o(n,`PUT`,`/accounts/${i}/dlp/document_fingerprints/${encodeURIComponent(String(e[`document-fingerprint-id`]))}`,{body:t})),{successLabel:`Updated`});return}if(e.body){let t=p(e.body,`body`,`binary`);u(await f(`Updating`,async()=>o(n,`PUT`,`/accounts/${i}/dlp/document_fingerprints/${encodeURIComponent(String(e[`document-fingerprint-id`]))}`,{body:t,headers:{"Content-Type":`multipart/form-data`}})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Xd={command:`document-fingerprints`,describe:`Document Fingerprints operations`,builder:e=>e.command(Bd).command(Yd).command(Rd).command(qd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Zd(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qd={command:`list`,describe:`List all application and application type mappings.`,builder:Zd,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway app-types list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/app_types`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.appTypes.list({account_id:i})),{successLabel:`Loaded`})}},$d={command:`app-types`,describe:`Operations for gateway.app-types`,builder:e=>e.command(Qd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ef(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const tf={command:`get`,describe:`Retrieve all Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.`,builder:ef,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway audit-ssh-settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/audit_ssh_settings`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.auditSshSettings.get({account_id:i})),{successLabel:`Loaded`})}};function nf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const rf={command:`rotate-seed`,describe:`Rotate the SSH account seed that generates the host key identity when connecting through the Cloudflare SSH Proxy.`,builder:nf,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway audit-ssh-settings rotate-seed`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/audit_ssh_settings/rotate_seed`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Creating`,async()=>n.zeroTrust.gateway.auditSshSettings.rotateSeed({account_id:i})),{successLabel:`Created`})}};function af(e){return e.option(`public-key`,{type:`string`,description:`Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const of={command:`update`,describe:`Update Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.`,builder:af,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust gateway audit-ssh-settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/audit_ssh_settings`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({public_key:p(n[`public-key`],`public-key`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Updating`,async()=>i.zeroTrust.gateway.auditSshSettings.update({...e,account_id:a})),{successLabel:`Updated`});return}n[`public-key`]===void 0&&(n[`public-key`]=await e(`public-key`,`Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging.`));let o=l({public_key:p(n[`public-key`],`public-key`,`text`)});u(await f(`Updating`,async()=>i.zeroTrust.gateway.auditSshSettings.update({...o,account_id:a})),{successLabel:`Updated`})}},sf={command:`audit-ssh-settings`,describe:`Operations for gateway.audit-ssh-settings`,builder:e=>e.command(tf).command(rf).command(of).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lf={command:`list`,describe:`List all categories.`,builder:cf,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway categories list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/categories`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.categories.list({account_id:i})),{successLabel:`Loaded`})}},uf={command:`categories`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(lf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function df(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ff={command:`activate <certificate-id>`,describe:`Bind a single Zero Trust certificate to the edge.`,builder:df,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway certificates activate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}/activate`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Creating`,async()=>n.zeroTrust.gateway.certificates.activate({account_id:i,certificate_id:e[`certificate-id`]})),{successLabel:`Created`})}};function pf(e){return e.option(`validity-period-days`,{type:`number`,description:"Sets the certificate validity period in days (range: 1-10,950 days / ~30 years). Defaults to 1,825 days (5 years). **Important**: This field is only settable during the certificate creation.  Certificates becomes immutable after creation - use the `/activate` and `/deactivate` endpoints to manage certificate lifecycle."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const mf={command:`create`,describe:`Create a new Zero Trust certificate.`,builder:pf,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/certificates`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({validity_period_days:e[`validity-period-days`]}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.gateway.certificates.create({...t,account_id:i})),{successLabel:`Created`});return}let a=l({validity_period_days:e[`validity-period-days`]});u(await f(`Creating`,async()=>n.zeroTrust.gateway.certificates.create({...a,account_id:i})),{successLabel:`Created`})}};function hf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gf={command:`deactivate <certificate-id>`,describe:`Unbind a single Zero Trust certificate from the edge.`,builder:hf,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway certificates deactivate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}/deactivate`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Creating`,async()=>n.zeroTrust.gateway.certificates.deactivate({account_id:i,certificate_id:e[`certificate-id`]})),{successLabel:`Created`})}};function _f(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const vf={command:`delete <certificate-id>`,describe:`Delete a gateway-managed Zero Trust certificate. You must deactivate the certificate from the edge (inactive) before deleting it.`,builder:_f,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.gateway.certificates.delete({account_id:a,certificate_id:e[`certificate-id`]})),{successLabel:`Deleted`})}};function yf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const bf={command:`get <certificate-id>`,describe:`Get a single Zero Trust certificate.`,builder:yf,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.certificates.get({account_id:i,certificate_id:e[`certificate-id`]})),{successLabel:`Loaded`})}};function xf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sf={command:`list`,describe:`List all Zero Trust certificates for an account.`,builder:xf,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/certificates`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.certificates.list({account_id:i})),{successLabel:`Loaded`})}},Cf={command:`certificates`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(ff).command(mf).command(gf).command(vf).command(bf).command(Sf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function wf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Tf={command:`get`,describe:`Retrieve the current Zero Trust certificate configuration.`,builder:wf,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway configurations custom-certificate get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/configuration/custom_certificate`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.configurations.customCertificate.get({account_id:i})),{successLabel:`Loaded`})}},Ef={command:`custom-certificate`,describe:`Operations for gateway.configurations.custom-certificate`,builder:e=>e.command(Tf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Df(e){return e.option(`settings-activity-log-enabled`,{type:`boolean`,description:`Specify whether to log activity.`}).option(`settings-antivirus-enabled-download-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on downloads.`}).option(`settings-antivirus-enabled-upload-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on uploads.`}).option(`settings-antivirus-fail-closed`,{type:`boolean`,description:`Specify whether to block requests for unscannable files.`}).option(`settings-antivirus-notification-settings-enabled`,{type:`boolean`,description:`Specify whether to enable notifications.`}).option(`settings-antivirus-notification-settings-include-context`,{type:`boolean`,description:`Specify whether to include context information as query parameters.`}).option(`settings-antivirus-notification-settings-msg`,{type:`string`,description:`Specify the message to show in the notification.`}).option(`settings-antivirus-notification-settings-support-url`,{type:`string`,description:`Specify a URL that directs users to more information. If unset, the notification opens a block page.`}).option(`settings-block-page-background-color`,{type:`string`,description:"Specify the block page background color in `#rrggbb` format when the mode is customized_block_page."}).option(`settings-block-page-enabled`,{type:`boolean`,description:`Specify whether to enable the custom block page.`}).option(`settings-block-page-footer-text`,{type:`string`,description:`Specify the block page footer text when the mode is customized_block_page.`}).option(`settings-block-page-header-text`,{type:`string`,description:`Specify the block page header text when the mode is customized_block_page.`}).option(`settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to append context to target_uri as query parameters. This applies only when the mode is redirect_uri.`}).option(`settings-block-page-logo-path`,{type:`string`,description:`Specify the full URL to the logo file when the mode is customized_block_page.`}).option(`settings-block-page-mailto-address`,{type:`string`,description:`Specify the admin email for users to contact when the mode is customized_block_page.`}).option(`settings-block-page-mailto-subject`,{type:`string`,description:`Specify the subject line for emails created from the block page when the mode is customized_block_page.`}).option(`settings-block-page-mode`,{type:`string`,description:`Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.`,choices:[`customized_block_page`,`redirect_uri`]}).option(`settings-block-page-name`,{type:`string`,description:`Specify the block page title when the mode is customized_block_page.`}).option(`settings-block-page-suppress-footer`,{type:`boolean`,description:`Specify whether to suppress detailed information at the bottom of the block page when the mode is customized_block_page.`}).option(`settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to redirect users to when the mode is redirect_uri.`}).option(`settings-body-scanning-inspection-mode`,{type:`string`,description:"Specify the inspection mode as either `deep` or `shallow`.",choices:[`deep`,`shallow`]}).option(`settings-browser-isolation-non-identity-enabled`,{type:`boolean`,description:`Specify whether to enable non-identity onramp support for Browser Isolation.`}).option(`settings-browser-isolation-url-browser-isolation-enabled`,{type:`boolean`,description:`Specify whether to enable Clientless Browser Isolation.`}).option(`settings-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.`}).option(`settings-custom-certificate-enabled`,{type:`boolean`,description:`Specify whether to enable a custom certificate authority for signing Gateway traffic.`}).option(`settings-custom-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate (ID from MTLS certificate store).`}).option(`settings-extended-email-matching-enabled`,{type:`boolean`,description:`Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.`}).option(`settings-fips-tls`,{type:`boolean`,description:`Enforce cipher suites and TLS versions compliant with FIPS 140-2.`}).option(`settings-host-selector-enabled`,{type:`boolean`,description:`Specify whether to enable filtering via hosts for egress policies.`}).option(`settings-inspection-mode`,{type:`string`,description:`Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.`,choices:[`static`,`dynamic`]}).option(`settings-max-ttl-secs`,{type:`number`,description:"Account-level cap on DNS response TTLs, in seconds. Gateway rewrites DNS responses so returned record TTLs do not exceed this value. Null means no cap. Each DNS location can inherit, override, or disable it through the location `max_ttl` setting."}).option(`settings-protocol-detection-enabled`,{type:`boolean`,description:`Specify whether to detect protocols from the initial bytes of client traffic.`}).option(`settings-sandbox-enabled`,{type:`boolean`,description:`Specify whether to enable the sandbox.`}).option(`settings-sandbox-fallback-action`,{type:`string`,description:`Specify the action to take when the system cannot scan the file.`,choices:[`allow`,`block`]}).option(`settings-tls-decrypt-enabled`,{type:`boolean`,description:`Specify whether to inspect encrypted HTTP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Specify account settings.`}).check(e=>{if(`settings-activity-log-enabled.settings-antivirus-enabled-download-phase.settings-antivirus-enabled-upload-phase.settings-antivirus-fail-closed.settings-antivirus-notification-settings-enabled.settings-antivirus-notification-settings-include-context.settings-antivirus-notification-settings-msg.settings-antivirus-notification-settings-support-url.settings-block-page-background-color.settings-block-page-enabled.settings-block-page-footer-text.settings-block-page-header-text.settings-block-page-include-context.settings-block-page-logo-path.settings-block-page-mailto-address.settings-block-page-mailto-subject.settings-block-page-name.settings-block-page-suppress-footer.settings-block-page-target-uri.settings-body-scanning-inspection-mode.settings-browser-isolation-non-identity-enabled.settings-browser-isolation-url-browser-isolation-enabled.settings-certificate-id.settings-custom-certificate-enabled.settings-custom-certificate-id.settings-extended-email-matching-enabled.settings-fips-tls.settings-host-selector-enabled.settings-inspection-mode.settings-max-ttl-secs.settings-protocol-detection-enabled.settings-sandbox-enabled.settings-sandbox-fallback-action.settings-tls-decrypt-enabled`.split(`.`).some(t=>e[t]!==void 0)){let t=[`settings-certificate-id`,`settings-custom-certificate-enabled`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --settings-* flag is set`)}return!0})}const Of={command:`edit`,describe:"Update (PATCH) a single subcollection of settings such as `antivirus`, `tls_decrypt`, `activity_log`, `block_page`, `browser_isolation`, `fips`, `body_scanning`, `certificate`, or `max_ttl_secs` without updating the entire configuration object. This endpoint returns an error if any settings collection lacks proper configuration.",builder:Df,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway configurations edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({settings:{activity_log:{enabled:e[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:e[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:e[`settings-antivirus-enabled-upload-phase`],fail_closed:e[`settings-antivirus-fail-closed`],notification_settings:{enabled:e[`settings-antivirus-notification-settings-enabled`],include_context:e[`settings-antivirus-notification-settings-include-context`],msg:p(e[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:p(e[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:p(e[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:e[`settings-block-page-enabled`],footer_text:p(e[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:p(e[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:e[`settings-block-page-include-context`],logo_path:p(e[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:p(e[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:p(e[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:p(e[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:p(e[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:e[`settings-block-page-suppress-footer`],target_uri:p(e[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:p(e[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:e[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:e[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:p(e[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:e[`settings-custom-certificate-enabled`],id:p(e[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:e[`settings-extended-email-matching-enabled`]},fips:{tls:e[`settings-fips-tls`]},host_selector:{enabled:e[`settings-host-selector-enabled`]},inspection:{mode:p(e[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:e[`settings-max-ttl-secs`],protocol_detection:{enabled:e[`settings-protocol-detection-enabled`]},sandbox:{enabled:e[`settings-sandbox-enabled`],fallback_action:p(e[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:e[`settings-tls-decrypt-enabled`]}}}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.gateway.configurations.edit({body:t,account_id:i})),{successLabel:`Updated`});return}let a=l({settings:{activity_log:{enabled:e[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:e[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:e[`settings-antivirus-enabled-upload-phase`],fail_closed:e[`settings-antivirus-fail-closed`],notification_settings:{enabled:e[`settings-antivirus-notification-settings-enabled`],include_context:e[`settings-antivirus-notification-settings-include-context`],msg:p(e[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:p(e[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:p(e[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:e[`settings-block-page-enabled`],footer_text:p(e[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:p(e[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:e[`settings-block-page-include-context`],logo_path:p(e[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:p(e[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:p(e[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:p(e[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:p(e[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:e[`settings-block-page-suppress-footer`],target_uri:p(e[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:p(e[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:e[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:e[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:p(e[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:e[`settings-custom-certificate-enabled`],id:p(e[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:e[`settings-extended-email-matching-enabled`]},fips:{tls:e[`settings-fips-tls`]},host_selector:{enabled:e[`settings-host-selector-enabled`]},inspection:{mode:p(e[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:e[`settings-max-ttl-secs`],protocol_detection:{enabled:e[`settings-protocol-detection-enabled`]},sandbox:{enabled:e[`settings-sandbox-enabled`],fallback_action:p(e[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:e[`settings-tls-decrypt-enabled`]}}});u(await f(`Updating`,async()=>n.zeroTrust.gateway.configurations.edit({body:a,account_id:i})),{successLabel:`Updated`})}};function kf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Af={command:`get`,describe:`Retrieve the current Zero Trust account configuration.`,builder:kf,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway configurations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.configurations.get({account_id:i})),{successLabel:`Loaded`})}};function jf(e){return e.option(`settings-activity-log-enabled`,{type:`boolean`,description:`Specify whether to log activity.`}).option(`settings-antivirus-enabled-download-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on downloads.`}).option(`settings-antivirus-enabled-upload-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on uploads.`}).option(`settings-antivirus-fail-closed`,{type:`boolean`,description:`Specify whether to block requests for unscannable files.`}).option(`settings-antivirus-notification-settings-enabled`,{type:`boolean`,description:`Specify whether to enable notifications.`}).option(`settings-antivirus-notification-settings-include-context`,{type:`boolean`,description:`Specify whether to include context information as query parameters.`}).option(`settings-antivirus-notification-settings-msg`,{type:`string`,description:`Specify the message to show in the notification.`}).option(`settings-antivirus-notification-settings-support-url`,{type:`string`,description:`Specify a URL that directs users to more information. If unset, the notification opens a block page.`}).option(`settings-block-page-background-color`,{type:`string`,description:"Specify the block page background color in `#rrggbb` format when the mode is customized_block_page."}).option(`settings-block-page-enabled`,{type:`boolean`,description:`Specify whether to enable the custom block page.`}).option(`settings-block-page-footer-text`,{type:`string`,description:`Specify the block page footer text when the mode is customized_block_page.`}).option(`settings-block-page-header-text`,{type:`string`,description:`Specify the block page header text when the mode is customized_block_page.`}).option(`settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to append context to target_uri as query parameters. This applies only when the mode is redirect_uri.`}).option(`settings-block-page-logo-path`,{type:`string`,description:`Specify the full URL to the logo file when the mode is customized_block_page.`}).option(`settings-block-page-mailto-address`,{type:`string`,description:`Specify the admin email for users to contact when the mode is customized_block_page.`}).option(`settings-block-page-mailto-subject`,{type:`string`,description:`Specify the subject line for emails created from the block page when the mode is customized_block_page.`}).option(`settings-block-page-mode`,{type:`string`,description:`Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.`,choices:[`customized_block_page`,`redirect_uri`]}).option(`settings-block-page-name`,{type:`string`,description:`Specify the block page title when the mode is customized_block_page.`}).option(`settings-block-page-suppress-footer`,{type:`boolean`,description:`Specify whether to suppress detailed information at the bottom of the block page when the mode is customized_block_page.`}).option(`settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to redirect users to when the mode is redirect_uri.`}).option(`settings-body-scanning-inspection-mode`,{type:`string`,description:"Specify the inspection mode as either `deep` or `shallow`.",choices:[`deep`,`shallow`]}).option(`settings-browser-isolation-non-identity-enabled`,{type:`boolean`,description:`Specify whether to enable non-identity onramp support for Browser Isolation.`}).option(`settings-browser-isolation-url-browser-isolation-enabled`,{type:`boolean`,description:`Specify whether to enable Clientless Browser Isolation.`}).option(`settings-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.`}).option(`settings-custom-certificate-enabled`,{type:`boolean`,description:`Specify whether to enable a custom certificate authority for signing Gateway traffic.`}).option(`settings-custom-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate (ID from MTLS certificate store).`}).option(`settings-extended-email-matching-enabled`,{type:`boolean`,description:`Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.`}).option(`settings-fips-tls`,{type:`boolean`,description:`Enforce cipher suites and TLS versions compliant with FIPS 140-2.`}).option(`settings-host-selector-enabled`,{type:`boolean`,description:`Specify whether to enable filtering via hosts for egress policies.`}).option(`settings-inspection-mode`,{type:`string`,description:`Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.`,choices:[`static`,`dynamic`]}).option(`settings-max-ttl-secs`,{type:`number`,description:"Account-level cap on DNS response TTLs, in seconds. Gateway rewrites DNS responses so returned record TTLs do not exceed this value. Null means no cap. Each DNS location can inherit, override, or disable it through the location `max_ttl` setting."}).option(`settings-protocol-detection-enabled`,{type:`boolean`,description:`Specify whether to detect protocols from the initial bytes of client traffic.`}).option(`settings-sandbox-enabled`,{type:`boolean`,description:`Specify whether to enable the sandbox.`}).option(`settings-sandbox-fallback-action`,{type:`string`,description:`Specify the action to take when the system cannot scan the file.`,choices:[`allow`,`block`]}).option(`settings-tls-decrypt-enabled`,{type:`boolean`,description:`Specify whether to inspect encrypted HTTP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Specify account settings.`}).check(e=>{if(`settings-activity-log-enabled.settings-antivirus-enabled-download-phase.settings-antivirus-enabled-upload-phase.settings-antivirus-fail-closed.settings-antivirus-notification-settings-enabled.settings-antivirus-notification-settings-include-context.settings-antivirus-notification-settings-msg.settings-antivirus-notification-settings-support-url.settings-block-page-background-color.settings-block-page-enabled.settings-block-page-footer-text.settings-block-page-header-text.settings-block-page-include-context.settings-block-page-logo-path.settings-block-page-mailto-address.settings-block-page-mailto-subject.settings-block-page-name.settings-block-page-suppress-footer.settings-block-page-target-uri.settings-body-scanning-inspection-mode.settings-browser-isolation-non-identity-enabled.settings-browser-isolation-url-browser-isolation-enabled.settings-certificate-id.settings-custom-certificate-enabled.settings-custom-certificate-id.settings-extended-email-matching-enabled.settings-fips-tls.settings-host-selector-enabled.settings-inspection-mode.settings-max-ttl-secs.settings-protocol-detection-enabled.settings-sandbox-enabled.settings-sandbox-fallback-action.settings-tls-decrypt-enabled`.split(`.`).some(t=>e[t]!==void 0)){let t=[`settings-certificate-id`,`settings-custom-certificate-enabled`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --settings-* flag is set`)}return!0})}const Mf={command:`update`,describe:`Update the current Zero Trust account configuration.`,builder:jf,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway configurations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({settings:{activity_log:{enabled:e[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:e[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:e[`settings-antivirus-enabled-upload-phase`],fail_closed:e[`settings-antivirus-fail-closed`],notification_settings:{enabled:e[`settings-antivirus-notification-settings-enabled`],include_context:e[`settings-antivirus-notification-settings-include-context`],msg:p(e[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:p(e[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:p(e[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:e[`settings-block-page-enabled`],footer_text:p(e[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:p(e[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:e[`settings-block-page-include-context`],logo_path:p(e[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:p(e[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:p(e[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:p(e[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:p(e[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:e[`settings-block-page-suppress-footer`],target_uri:p(e[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:p(e[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:e[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:e[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:p(e[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:e[`settings-custom-certificate-enabled`],id:p(e[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:e[`settings-extended-email-matching-enabled`]},fips:{tls:e[`settings-fips-tls`]},host_selector:{enabled:e[`settings-host-selector-enabled`]},inspection:{mode:p(e[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:e[`settings-max-ttl-secs`],protocol_detection:{enabled:e[`settings-protocol-detection-enabled`]},sandbox:{enabled:e[`settings-sandbox-enabled`],fallback_action:p(e[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:e[`settings-tls-decrypt-enabled`]}}}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.gateway.configurations.update({body:t,account_id:i})),{successLabel:`Updated`});return}let a=l({settings:{activity_log:{enabled:e[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:e[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:e[`settings-antivirus-enabled-upload-phase`],fail_closed:e[`settings-antivirus-fail-closed`],notification_settings:{enabled:e[`settings-antivirus-notification-settings-enabled`],include_context:e[`settings-antivirus-notification-settings-include-context`],msg:p(e[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:p(e[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:p(e[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:e[`settings-block-page-enabled`],footer_text:p(e[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:p(e[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:e[`settings-block-page-include-context`],logo_path:p(e[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:p(e[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:p(e[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:p(e[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:p(e[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:e[`settings-block-page-suppress-footer`],target_uri:p(e[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:p(e[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:e[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:e[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:p(e[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:e[`settings-custom-certificate-enabled`],id:p(e[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:e[`settings-extended-email-matching-enabled`]},fips:{tls:e[`settings-fips-tls`]},host_selector:{enabled:e[`settings-host-selector-enabled`]},inspection:{mode:p(e[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:e[`settings-max-ttl-secs`],protocol_detection:{enabled:e[`settings-protocol-detection-enabled`]},sandbox:{enabled:e[`settings-sandbox-enabled`],fallback_action:p(e[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:e[`settings-tls-decrypt-enabled`]}}});u(await f(`Updating`,async()=>n.zeroTrust.gateway.configurations.update({body:a,account_id:i})),{successLabel:`Updated`})}},Nf={command:`configurations`,describe:`Operations for gateway.configurations`,builder:e=>e.command(Of).command(Af).command(Mf).command(Ef).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Pf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ff={command:`create`,describe:`Create a Zero Trust account for an existing Cloudflare account.`,builder:Pf,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Creating`,async()=>n.zeroTrust.gateway.create({account_id:i})),{successLabel:`Created`})}};function If(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Lf={command:`list`,describe:`Retrieve information about the current Zero Trust account.`,builder:If,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.list({account_id:i})),{successLabel:`Loaded`})}};function Rf(e){return e.option(`description`,{type:`string`,description:`Provide the list description.`}).option(`name`,{type:`string`,description:`Specify the list name.`}).option(`type`,{type:`string`,description:`Specify the list type.`,choices:[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const zf={command:`create`,describe:`Creates a new Zero Trust list.`,builder:Rf,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust gateway lists create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/lists`,pathParams:{},bodyKind:`json`,body:i.body===void 0?l({description:p(i.description,`description`,`text`),name:p(i.name,`name`,`text`),type:p(i.type,`type`,`text`)}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Creating`,async()=>a.zeroTrust.gateway.lists.create({...e,account_id:o})),{successLabel:`Created`});return}i.name===void 0&&(i.name=await e(`name`,`Specify the list name.`)),i.type===void 0&&(i.type=await n(`type`,`Specify the list type.`,[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]));let m=l({description:p(i.description,`description`,`text`),name:p(i.name,`name`,`text`),type:p(i.type,`type`,`text`)});u(await f(`Creating`,async()=>a.zeroTrust.gateway.lists.create({...m,account_id:o})),{successLabel:`Created`})}};function Bf(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Vf={command:`delete <list-id>`,describe:`Deletes a Zero Trust list.`,builder:Bf,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway lists delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/lists/${e[`list-id`]==null?`<list-id>`:encodeURIComponent(String(e[`list-id`]))}`,pathParams:{"list-id":String(e[`list-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.gateway.lists.delete({account_id:a,list_id:e[`list-id`]})),{successLabel:`Deleted`})}};function Hf(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`remove`,{type:`string`,array:!0,description:`Lists of item values you want to remove.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Uf={command:`edit <list-id>`,describe:`Appends or removes an item from a configured Zero Trust list.`,builder:Hf,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway lists edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/lists/${e[`list-id`]==null?`<list-id>`:encodeURIComponent(String(e[`list-id`]))}`,pathParams:{"list-id":String(e[`list-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({remove:e.remove}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.gateway.lists.edit({...t,account_id:i,list_id:e[`list-id`]})),{successLabel:`Updated`});return}let a=l({remove:e.remove});u(await f(`Updating`,async()=>n.zeroTrust.gateway.lists.edit({...a,account_id:i,list_id:e[`list-id`]})),{successLabel:`Updated`})}};function Wf(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gf={command:`get <list-id>`,describe:`Fetch a single Zero Trust list.`,builder:Wf,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway lists get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/lists/${e[`list-id`]==null?`<list-id>`:encodeURIComponent(String(e[`list-id`]))}`,pathParams:{"list-id":String(e[`list-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.lists.get({account_id:i,list_id:e[`list-id`]})),{successLabel:`Loaded`})}};function Kf(e){return e.option(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qf={command:`list`,describe:`Fetch all items in a single Zero Trust list.`,builder:Kf,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway lists items list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/lists/${e[`list-id`]==null?`<list-id>`:encodeURIComponent(String(e[`list-id`]))}/items`,pathParams:{"list-id":String(e[`list-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.lists.items.list({account_id:i,list_id:e[`list-id`]})),{successLabel:`Loaded`})}},Jf={command:`items`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(qf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Yf(e){return e.option(`type`,{type:`string`,description:`Specify the list type.`,choices:[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xf={command:`list`,describe:`Fetch all Zero Trust lists for an account.`,builder:g(Yf),handler:async e=>{let n={type:e.type};if(e.dryRun){d({command:`cf zero-trust gateway lists list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/lists`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.gateway.lists.list({account_id:a,...n})),{successLabel:`Loaded`})}};function Zf(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`Provide the list description.`}).option(`name`,{type:`string`,description:`Specify the list name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Qf={command:`update <list-id>`,describe:`Updates a configured Zero Trust list. Skips updating list items if not included in the payload. A non empty list items will overwrite the existing list.`,builder:Zf,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust gateway lists update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/lists/${n[`list-id`]==null?`<list-id>`:encodeURIComponent(String(n[`list-id`]))}`,pathParams:{"list-id":String(n[`list-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Updating`,async()=>i.zeroTrust.gateway.lists.update({...e,account_id:a,list_id:n[`list-id`]})),{successLabel:`Updated`});return}n.name===void 0&&(n.name=await e(`name`,`Specify the list name.`));let o=l({description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`)});u(await f(`Updating`,async()=>i.zeroTrust.gateway.lists.update({...o,account_id:a,list_id:n[`list-id`]})),{successLabel:`Updated`})}},$f={command:`lists`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(zf).command(Vf).command(Uf).command(Gf).command(Xf).command(Qf).command(Jf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ep(e){return e.option(`client-default`,{type:`boolean`,description:`Indicate whether this location is the default location.`,default:!1}).option(`dns-destination-ips-id`,{type:`string`,description:`Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.`}).option(`ecs-support`,{type:`boolean`,description:`Indicate whether the location must resolve EDNS queries.`,default:!1}).option(`endpoints-doh-enabled`,{type:`boolean`,description:`Indicate whether the DOH endpoint is enabled for this location.`}).option(`endpoints-doh-require-token`,{type:`boolean`,description:`Specify whether the DOH endpoint requires user identity authentication.`}).option(`endpoints-dot-enabled`,{type:`boolean`,description:`Indicate whether the DOT endpoint is enabled for this location.`}).option(`endpoints-ipv4-enabled`,{type:`boolean`,description:`Indicate whether the IPv4 endpoint is enabled for this location.`}).option(`endpoints-ipv6-enabled`,{type:`boolean`,description:`Indicate whether the IPV6 endpoint is enabled for this location.`}).option(`max-ttl-mode`,{type:`string`,description:"`inherit` uses the account `max_ttl_secs`. `override` uses this location's `ttl_secs`. `disabled` leaves returned TTLs unchanged.",choices:[`inherit`,`override`,`disabled`]}).option(`max-ttl-ttl-secs`,{type:`number`,description:"Location-specific cap on DNS response TTLs, in seconds. Required when `mode` is `override`. Must be omitted when `mode` is `inherit` or `disabled`."}).option(`name`,{type:`string`,description:`Specify the location name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`max-ttl-mode`,`max-ttl-ttl-secs`].some(t=>e[t]!==void 0)){let t=[`max-ttl-mode`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --max_ttl-* flag is set`)}return!0})}const tp={command:`create`,describe:`Create a new Zero Trust Gateway location.`,builder:ep,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust gateway locations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/locations`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({client_default:n[`client-default`],dns_destination_ips_id:p(n[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:n[`ecs-support`],endpoints:{doh:{enabled:n[`endpoints-doh-enabled`],require_token:n[`endpoints-doh-require-token`]},dot:{enabled:n[`endpoints-dot-enabled`]},ipv4:{enabled:n[`endpoints-ipv4-enabled`]},ipv6:{enabled:n[`endpoints-ipv6-enabled`]}},max_ttl:{mode:p(n[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:n[`max-ttl-ttl-secs`]},name:p(n.name,`name`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.gateway.locations.create({...e,account_id:a})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await e(`name`,`Specify the location name.`));let o=l({client_default:n[`client-default`],dns_destination_ips_id:p(n[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:n[`ecs-support`],endpoints:{doh:{enabled:n[`endpoints-doh-enabled`],require_token:n[`endpoints-doh-require-token`]},dot:{enabled:n[`endpoints-dot-enabled`]},ipv4:{enabled:n[`endpoints-ipv4-enabled`]},ipv6:{enabled:n[`endpoints-ipv6-enabled`]}},max_ttl:{mode:p(n[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:n[`max-ttl-ttl-secs`]},name:p(n.name,`name`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.gateway.locations.create({...o,account_id:a})),{successLabel:`Created`})}};function np(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const rp={command:`delete <location-id>`,describe:`Delete a configured Zero Trust Gateway location.`,builder:np,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway locations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/locations/${e[`location-id`]==null?`<location-id>`:encodeURIComponent(String(e[`location-id`]))}`,pathParams:{"location-id":String(e[`location-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.gateway.locations.delete({account_id:a,location_id:e[`location-id`]})),{successLabel:`Deleted`})}};function ip(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ap={command:`get <location-id>`,describe:`Get a single Zero Trust Gateway location.`,builder:ip,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway locations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/locations/${e[`location-id`]==null?`<location-id>`:encodeURIComponent(String(e[`location-id`]))}`,pathParams:{"location-id":String(e[`location-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.locations.get({account_id:i,location_id:e[`location-id`]})),{successLabel:`Loaded`})}};function op(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sp={command:`list`,describe:`List Zero Trust Gateway locations for an account.`,builder:op,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway locations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/locations`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.locations.list({account_id:i})),{successLabel:`Loaded`})}};function cp(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`client-default`,{type:`boolean`,description:`Indicate whether this location is the default location.`}).option(`dns-destination-ips-id`,{type:`string`,description:`Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.`}).option(`ecs-support`,{type:`boolean`,description:`Indicate whether the location must resolve EDNS queries.`}).option(`endpoints-doh-enabled`,{type:`boolean`,description:`Indicate whether the DOH endpoint is enabled for this location.`}).option(`endpoints-doh-require-token`,{type:`boolean`,description:`Specify whether the DOH endpoint requires user identity authentication.`}).option(`endpoints-dot-enabled`,{type:`boolean`,description:`Indicate whether the DOT endpoint is enabled for this location.`}).option(`endpoints-ipv4-enabled`,{type:`boolean`,description:`Indicate whether the IPv4 endpoint is enabled for this location.`}).option(`endpoints-ipv6-enabled`,{type:`boolean`,description:`Indicate whether the IPV6 endpoint is enabled for this location.`}).option(`max-ttl-mode`,{type:`string`,description:"`inherit` uses the account `max_ttl_secs`. `override` uses this location's `ttl_secs`. `disabled` leaves returned TTLs unchanged.",choices:[`inherit`,`override`,`disabled`]}).option(`max-ttl-ttl-secs`,{type:`number`,description:"Location-specific cap on DNS response TTLs, in seconds. Required when `mode` is `override`. Must be omitted when `mode` is `inherit` or `disabled`."}).option(`name`,{type:`string`,description:`Specify the location name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`max-ttl-mode`,`max-ttl-ttl-secs`].some(t=>e[t]!==void 0)){let t=[`max-ttl-mode`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --max_ttl-* flag is set`)}return!0})}const lp={command:`update <location-id>`,describe:`Update a configured Zero Trust Gateway location.`,builder:cp,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust gateway locations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/locations/${n[`location-id`]==null?`<location-id>`:encodeURIComponent(String(n[`location-id`]))}`,pathParams:{"location-id":String(n[`location-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({client_default:n[`client-default`],dns_destination_ips_id:p(n[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:n[`ecs-support`],endpoints:{doh:{enabled:n[`endpoints-doh-enabled`],require_token:n[`endpoints-doh-require-token`]},dot:{enabled:n[`endpoints-dot-enabled`]},ipv4:{enabled:n[`endpoints-ipv4-enabled`]},ipv6:{enabled:n[`endpoints-ipv6-enabled`]}},max_ttl:{mode:p(n[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:n[`max-ttl-ttl-secs`]},name:p(n.name,`name`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Updating`,async()=>i.zeroTrust.gateway.locations.update({...e,account_id:a,location_id:n[`location-id`]})),{successLabel:`Updated`});return}n.name===void 0&&(n.name=await e(`name`,`Specify the location name.`));let o=l({client_default:n[`client-default`],dns_destination_ips_id:p(n[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:n[`ecs-support`],endpoints:{doh:{enabled:n[`endpoints-doh-enabled`],require_token:n[`endpoints-doh-require-token`]},dot:{enabled:n[`endpoints-dot-enabled`]},ipv4:{enabled:n[`endpoints-ipv4-enabled`]},ipv6:{enabled:n[`endpoints-ipv6-enabled`]}},max_ttl:{mode:p(n[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:n[`max-ttl-ttl-secs`]},name:p(n.name,`name`,`text`)});u(await f(`Updating`,async()=>i.zeroTrust.gateway.locations.update({...o,account_id:a,location_id:n[`location-id`]})),{successLabel:`Updated`})}},up={command:`locations`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(tp).command(rp).command(ap).command(sp).command(lp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function dp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fp={command:`get`,describe:`Retrieve the current logging settings for the Zero Trust account.`,builder:dp,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway logging get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/logging`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.logging.get({account_id:i})),{successLabel:`Loaded`})}};function pp(e){return e.option(`redact-pii`,{type:`boolean`,description:`Indicate whether to redact personally identifiable information from activity logging (PII fields include source IP, user email, user ID, device ID, URL, referrer, and user agent).`}).option(`settings-by-rule-type-dns-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-dns-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`settings-by-rule-type-http-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-http-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`settings-by-rule-type-l4-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-l4-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const mp={command:`update`,describe:`Update logging settings for the current Zero Trust account.`,builder:pp,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway logging update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/logging`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({redact_pii:e[`redact-pii`],settings_by_rule_type:{dns:{log_all:e[`settings-by-rule-type-dns-log-all`],log_blocks:e[`settings-by-rule-type-dns-log-blocks`]},http:{log_all:e[`settings-by-rule-type-http-log-all`],log_blocks:e[`settings-by-rule-type-http-log-blocks`]},l4:{log_all:e[`settings-by-rule-type-l4-log-all`],log_blocks:e[`settings-by-rule-type-l4-log-blocks`]}}}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.gateway.logging.update({body:t,account_id:i})),{successLabel:`Updated`});return}let a=l({redact_pii:e[`redact-pii`],settings_by_rule_type:{dns:{log_all:e[`settings-by-rule-type-dns-log-all`],log_blocks:e[`settings-by-rule-type-dns-log-blocks`]},http:{log_all:e[`settings-by-rule-type-http-log-all`],log_blocks:e[`settings-by-rule-type-http-log-blocks`]},l4:{log_all:e[`settings-by-rule-type-l4-log-all`],log_blocks:e[`settings-by-rule-type-l4-log-blocks`]}}});u(await f(`Updating`,async()=>n.zeroTrust.gateway.logging.update({body:a,account_id:i})),{successLabel:`Updated`})}},hp={command:`logging`,describe:`Operations for gateway.logging`,builder:e=>e.command(fp).command(mp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function gp(e){return e.option(`contents`,{type:`string`,description:`Actual contents of the PAC file`}).option(`description`,{type:`string`,description:`Detailed description of the PAC file.`}).option(`name`,{type:`string`,description:`Name of the PAC file.`}).option(`slug`,{type:`string`,description:`URL-friendly version of the PAC file name. If not provided, it will be auto-generated`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _p={command:`create`,describe:`Create a new Zero Trust Gateway PAC file.`,builder:gp,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust gateway pacfiles create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/pacfiles`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({contents:p(n.contents,`contents`,`text`),description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`),slug:p(n.slug,`slug`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.gateway.pacfiles.create({...e,account_id:a})),{successLabel:`Created`});return}n.contents===void 0&&(n.contents=await e(`contents`,`Actual contents of the PAC file`)),n.name===void 0&&(n.name=await e(`name`,`Name of the PAC file.`));let o=l({contents:p(n.contents,`contents`,`text`),description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`),slug:p(n.slug,`slug`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.gateway.pacfiles.create({...o,account_id:a})),{successLabel:`Created`})}};function vp(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const yp={command:`delete <pacfile-id>`,describe:`Delete a configured Zero Trust Gateway PAC file.`,builder:vp,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway pacfiles delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/pacfiles/${e[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(e[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(e[`pacfile-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.gateway.pacfiles.delete({account_id:a,pacfile_id:e[`pacfile-id`]})),{successLabel:`Deleted`})}};function bp(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xp={command:`get <pacfile-id>`,describe:`Get a single Zero Trust Gateway PAC file.`,builder:bp,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway pacfiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/pacfiles/${e[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(e[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(e[`pacfile-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.pacfiles.get({account_id:i,pacfile_id:e[`pacfile-id`]})),{successLabel:`Loaded`})}};function Sp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cp={command:`list`,describe:`List all Zero Trust Gateway PAC files for an account.`,builder:Sp,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway pacfiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/pacfiles`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.pacfiles.list({account_id:i})),{successLabel:`Loaded`})}};function wp(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`contents`,{type:`string`,description:`Actual contents of the PAC file`}).option(`description`,{type:`string`,description:`Detailed description of the PAC file.`}).option(`name`,{type:`string`,description:`Name of the PAC file.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Tp={command:`update <pacfile-id>`,describe:`Update a configured Zero Trust Gateway PAC file.`,builder:wp,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust gateway pacfiles update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/pacfiles/${n[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(n[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(n[`pacfile-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({contents:p(n.contents,`contents`,`text`),description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Updating`,async()=>i.zeroTrust.gateway.pacfiles.update({...e,account_id:a,pacfile_id:n[`pacfile-id`]})),{successLabel:`Updated`});return}n.contents===void 0&&(n.contents=await e(`contents`,`Actual contents of the PAC file`)),n.description===void 0&&(n.description=await e(`description`,`Detailed description of the PAC file.`)),n.name===void 0&&(n.name=await e(`name`,`Name of the PAC file.`));let o=l({contents:p(n.contents,`contents`,`text`),description:p(n.description,`description`,`text`),name:p(n.name,`name`,`text`)});u(await f(`Updating`,async()=>i.zeroTrust.gateway.pacfiles.update({...o,account_id:a,pacfile_id:n[`pacfile-id`]})),{successLabel:`Updated`})}},Ep={command:`pacfiles`,describe:`Operations for gateway.pacfiles`,builder:e=>e.command(_p).command(yp).command(xp).command(Cp).command(Tp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Dp(e){return e.option(`kind`,{type:`string`,description:`The proxy endpoint kind.`,choices:[`ip`,`identity`],default:`ip`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Op={command:`create`,describe:`Create a new Zero Trust Gateway proxy endpoint.`,builder:Dp,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust gateway proxy-endpoints create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/proxy_endpoints`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({kind:p(n.kind,`kind`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.gateway.proxyEndpoints.create({body:e,account_id:a})),{successLabel:`Created`});return}n.kind===`identity`&&n.kind===void 0&&(n.kind=await e(`kind`,`The proxy endpoint kind.`,{question:`Enter value for --kind`}));let o=l({kind:p(n.kind,`kind`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.gateway.proxyEndpoints.create({body:o,account_id:a})),{successLabel:`Created`})}};function kp(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ap={command:`delete <proxy-endpoint-id>`,describe:`Delete a configured Zero Trust Gateway proxy endpoint.`,builder:kp,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway proxy-endpoints delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/proxy_endpoints/${e[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(e[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(e[`proxy-endpoint-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.gateway.proxyEndpoints.delete({account_id:a,proxy_endpoint_id:e[`proxy-endpoint-id`]})),{successLabel:`Deleted`})}};function jp(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`ips`,{type:`string`,array:!0,description:`Specify the list of CIDRs to restrict ingress connections.`}).option(`name`,{type:`string`,description:`Specify the name of the proxy endpoint.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Mp={command:`edit <proxy-endpoint-id>`,describe:`Update a configured Zero Trust Gateway proxy endpoint.`,builder:jp,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway proxy-endpoints edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/proxy_endpoints/${e[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(e[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(e[`proxy-endpoint-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({ips:e.ips,name:p(e.name,`name`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.gateway.proxyEndpoints.edit({...t,account_id:i,proxy_endpoint_id:e[`proxy-endpoint-id`]})),{successLabel:`Updated`});return}let a=l({ips:e.ips,name:p(e.name,`name`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.gateway.proxyEndpoints.edit({...a,account_id:i,proxy_endpoint_id:e[`proxy-endpoint-id`]})),{successLabel:`Updated`})}};function Np(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pp={command:`get <proxy-endpoint-id>`,describe:`Get a single Zero Trust Gateway proxy endpoint.`,builder:Np,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway proxy-endpoints get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/proxy_endpoints/${e[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(e[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(e[`proxy-endpoint-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.proxyEndpoints.get({account_id:i,proxy_endpoint_id:e[`proxy-endpoint-id`]})),{successLabel:`Loaded`})}};function Fp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ip={command:`list`,describe:`List all Zero Trust Gateway proxy endpoints for an account.`,builder:Fp,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway proxy-endpoints list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/proxy_endpoints`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.proxyEndpoints.list({account_id:i})),{successLabel:`Loaded`})}},Lp={command:`proxy-endpoints`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(Op).command(Ap).command(Mp).command(Pp).command(Ip).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Rp(e){return e.option(`action`,{type:`string`,description:"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",choices:[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`]}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`device-posture`,{type:`string`,description:`Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`,default:!1}).option(`expiration-duration`,{type:`number`,description:"Defines the default duration a policy active in minutes. Must set in order to use the `reset_expiration` endpoint on this rule."}).option(`filters`,{type:`string`,array:!0,description:`Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.`}).option(`identity`,{type:`string`,description:`Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`rule-settings-allow-child-bypass`,{type:`boolean`,description:`Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.`}).option(`rule-settings-audit-ssh-command-logging`,{type:`boolean`,description:`Enable SSH command logging.`}).option(`rule-settings-biso-admin-controls-copy`,{type:`string`,description:`Configure copy behavior. If set to remote_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dcp`,{type:`boolean`,description:'Set to false to enable copy-pasting. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dd`,{type:`boolean`,description:'Set to false to enable downloading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dk`,{type:`boolean`,description:'Set to false to enable keyboard usage. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-download`,{type:`string`,description:`Configure download behavior. When set to remote_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dp`,{type:`boolean`,description:'Set to false to enable printing. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-du`,{type:`boolean`,description:'Set to false to enable uploading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-keyboard`,{type:`string`,description:`Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-paste`,{type:`string`,description:`Configure paste behavior. If set to remote_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-printing`,{type:`string`,description:`Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-upload`,{type:`string`,description:`Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-version`,{type:`string`,description:`Indicate which version of the browser isolation controls should apply.`,choices:[`v1`,`v2`],default:`v1`}).option(`rule-settings-biso-admin-controls-wm-id`,{type:`string`,description:`Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser.`}).option(`rule-settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-block-page-enabled`,{type:`boolean`,description:"Enable the custom block page. Settable only for `dns` rules with action `block`."}).option(`rule-settings-block-reason`,{type:`string`,description:"Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`."}).option(`rule-settings-bypass-parent-rule`,{type:`boolean`,description:`Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.`}).option(`rule-settings-check-session-duration`,{type:`string`,description:`Sets the required session freshness threshold. The API returns a normalized version of this value.`}).option(`rule-settings-check-session-enforce`,{type:`boolean`,description:`Enable session enforcement.`}).option(`rule-settings-delete-headers`,{type:`string`,array:!0,description:"Remove headers from allowed requests by name. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes. Settable only for `http` rules with the action set to `allow`."}).option(`rule-settings-egress-ipv4`,{type:`string`,description:`Specify the IPv4 address to use for egress.`}).option(`rule-settings-egress-ipv4-fallback`,{type:`string`,description:`Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.`}).option(`rule-settings-egress-ipv6`,{type:`string`,description:`Specify the IPv6 range to use for egress.`}).option(`rule-settings-forensic-copy-enabled`,{type:`boolean`,description:`Enable sending the copy to storage.`}).option(`rule-settings-ignore-cname-category-matches`,{type:`boolean`,description:"Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-insecure-disable-dnssec-validation`,{type:`boolean`,description:"Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules."}).option(`rule-settings-ip-categories`,{type:`boolean`,description:"Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-ip-indicator-feeds`,{type:`boolean`,description:"Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-l4override-ip`,{type:`string`,description:`Defines the IPv4 or IPv6 address.`}).option(`rule-settings-l4override-port`,{type:`number`,description:`Defines a port number to use for TCP/UDP overrides.`}).option(`rule-settings-notification-settings-enabled`,{type:`boolean`,description:`Enable notification.`}).option(`rule-settings-notification-settings-include-context`,{type:`boolean`,description:`Indicates whether to pass the context information as query parameters.`}).option(`rule-settings-notification-settings-msg`,{type:`string`,description:`Customize the message shown in the notification.`}).option(`rule-settings-notification-settings-support-url`,{type:`string`,description:`Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.`}).option(`rule-settings-override-host`,{type:`string`,description:"Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-override-ips`,{type:`string`,array:!0,description:"Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-payload-log-enabled`,{type:`boolean`,description:`Enable DLP payload logging for this rule.`}).option(`rule-settings-quarantine-file-types`,{type:`string`,array:!0,description:`Specify the types of files to sandbox.`}).option(`rule-settings-redirect-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-redirect-preserve-path-and-query`,{type:`boolean`,description:`Specify whether to append the path and query parameters from the original request to target_uri.`}).option(`rule-settings-redirect-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-resolve-dns-internally-fallback`,{type:`string`,description:`Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.`,choices:[`none`,`public_dns`]}).option(`rule-settings-resolve-dns-internally-view-id`,{type:`string`,description:`Specify the internal DNS view identifier to pass to the internal DNS service.`}).option(`rule-settings-resolve-dns-through-cloudflare`,{type:`boolean`,description:"Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dns_resolver` rules."}).option(`rule-settings-untrusted-cert-action`,{type:`string`,description:`Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.`,choices:[`pass_through`,`block`,`error`]}).option(`schedule-fri`,{type:`string`,description:`Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-mon`,{type:`string`,description:`Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sat`,{type:`string`,description:`Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sun`,{type:`string`,description:`Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-thu`,{type:`string`,description:`Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-time-zone`,{type:`string`,description:`Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.`}).option(`schedule-tue`,{type:`string`,description:`Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-wed`,{type:`string`,description:`Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`traffic`,{type:`string`,description:`Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if(`rule-settings-allow-child-bypass.rule-settings-audit-ssh-command-logging.rule-settings-biso-admin-controls-copy.rule-settings-biso-admin-controls-dcp.rule-settings-biso-admin-controls-dd.rule-settings-biso-admin-controls-dk.rule-settings-biso-admin-controls-download.rule-settings-biso-admin-controls-dp.rule-settings-biso-admin-controls-du.rule-settings-biso-admin-controls-keyboard.rule-settings-biso-admin-controls-paste.rule-settings-biso-admin-controls-printing.rule-settings-biso-admin-controls-upload.rule-settings-biso-admin-controls-wm-id.rule-settings-block-page-include-context.rule-settings-block-page-target-uri.rule-settings-block-page-enabled.rule-settings-block-reason.rule-settings-bypass-parent-rule.rule-settings-check-session-duration.rule-settings-check-session-enforce.rule-settings-delete-headers.rule-settings-egress-ipv4.rule-settings-egress-ipv4-fallback.rule-settings-egress-ipv6.rule-settings-forensic-copy-enabled.rule-settings-ignore-cname-category-matches.rule-settings-insecure-disable-dnssec-validation.rule-settings-ip-categories.rule-settings-ip-indicator-feeds.rule-settings-l4override-ip.rule-settings-l4override-port.rule-settings-notification-settings-enabled.rule-settings-notification-settings-include-context.rule-settings-notification-settings-msg.rule-settings-notification-settings-support-url.rule-settings-override-host.rule-settings-override-ips.rule-settings-payload-log-enabled.rule-settings-quarantine-file-types.rule-settings-redirect-include-context.rule-settings-redirect-preserve-path-and-query.rule-settings-redirect-target-uri.rule-settings-resolve-dns-internally-fallback.rule-settings-resolve-dns-internally-view-id.rule-settings-resolve-dns-through-cloudflare.rule-settings-untrusted-cert-action`.split(`.`).some(t=>e[t]!==void 0)){let t=[`rule-settings-block-page-target-uri`,`rule-settings-redirect-target-uri`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --rule_settings-* flag is set`)}return!0})}const zp={command:`create`,describe:`Create a new Zero Trust Gateway rule.`,builder:Rp,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust gateway rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/rules`,pathParams:{},bodyKind:`json`,body:i.body===void 0?l({action:p(i.action,`action`,`text`),description:p(i.description,`description`,`text`),device_posture:p(i[`device-posture`],`device-posture`,`text`),enabled:i.enabled,expiration:{duration:i[`expiration-duration`]},filters:i.filters,identity:p(i.identity,`identity`,`text`),name:p(i.name,`name`,`text`),precedence:i.precedence,rule_settings:{allow_child_bypass:i[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:i[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:p(i[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:i[`rule-settings-biso-admin-controls-dcp`],dd:i[`rule-settings-biso-admin-controls-dd`],dk:i[`rule-settings-biso-admin-controls-dk`],download:p(i[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:i[`rule-settings-biso-admin-controls-dp`],du:i[`rule-settings-biso-admin-controls-du`],keyboard:p(i[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:p(i[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:p(i[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:p(i[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:p(i[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:p(i[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:i[`rule-settings-block-page-include-context`],target_uri:p(i[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:i[`rule-settings-block-page-enabled`],block_reason:p(i[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:i[`rule-settings-bypass-parent-rule`],check_session:{duration:p(i[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:i[`rule-settings-check-session-enforce`]},delete_headers:i[`rule-settings-delete-headers`],egress:{ipv4:p(i[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:p(i[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:p(i[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:i[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:i[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:i[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:i[`rule-settings-ip-categories`],ip_indicator_feeds:i[`rule-settings-ip-indicator-feeds`],l4override:{ip:p(i[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:i[`rule-settings-l4override-port`]},notification_settings:{enabled:i[`rule-settings-notification-settings-enabled`],include_context:i[`rule-settings-notification-settings-include-context`],msg:p(i[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:p(i[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:p(i[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:i[`rule-settings-override-ips`],payload_log:{enabled:i[`rule-settings-payload-log-enabled`]},quarantine:{file_types:i[`rule-settings-quarantine-file-types`]},redirect:{include_context:i[`rule-settings-redirect-include-context`],preserve_path_and_query:i[`rule-settings-redirect-preserve-path-and-query`],target_uri:p(i[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:p(i[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:p(i[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:i[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:p(i[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:p(i[`schedule-fri`],`schedule-fri`,`text`),mon:p(i[`schedule-mon`],`schedule-mon`,`text`),sat:p(i[`schedule-sat`],`schedule-sat`,`text`),sun:p(i[`schedule-sun`],`schedule-sun`,`text`),thu:p(i[`schedule-thu`],`schedule-thu`,`text`),time_zone:p(i[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:p(i[`schedule-tue`],`schedule-tue`,`text`),wed:p(i[`schedule-wed`],`schedule-wed`,`text`)},traffic:p(i.traffic,`traffic`,`text`)}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Creating`,async()=>a.zeroTrust.gateway.rules.create({...e,account_id:o})),{successLabel:`Created`});return}i.action===void 0&&(i.action=await n(`action`,"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`])),i.name===void 0&&(i.name=await e(`name`,`Specify the rule name.`));let m=l({action:p(i.action,`action`,`text`),description:p(i.description,`description`,`text`),device_posture:p(i[`device-posture`],`device-posture`,`text`),enabled:i.enabled,expiration:{duration:i[`expiration-duration`]},filters:i.filters,identity:p(i.identity,`identity`,`text`),name:p(i.name,`name`,`text`),precedence:i.precedence,rule_settings:{allow_child_bypass:i[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:i[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:p(i[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:i[`rule-settings-biso-admin-controls-dcp`],dd:i[`rule-settings-biso-admin-controls-dd`],dk:i[`rule-settings-biso-admin-controls-dk`],download:p(i[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:i[`rule-settings-biso-admin-controls-dp`],du:i[`rule-settings-biso-admin-controls-du`],keyboard:p(i[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:p(i[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:p(i[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:p(i[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:p(i[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:p(i[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:i[`rule-settings-block-page-include-context`],target_uri:p(i[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:i[`rule-settings-block-page-enabled`],block_reason:p(i[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:i[`rule-settings-bypass-parent-rule`],check_session:{duration:p(i[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:i[`rule-settings-check-session-enforce`]},delete_headers:i[`rule-settings-delete-headers`],egress:{ipv4:p(i[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:p(i[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:p(i[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:i[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:i[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:i[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:i[`rule-settings-ip-categories`],ip_indicator_feeds:i[`rule-settings-ip-indicator-feeds`],l4override:{ip:p(i[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:i[`rule-settings-l4override-port`]},notification_settings:{enabled:i[`rule-settings-notification-settings-enabled`],include_context:i[`rule-settings-notification-settings-include-context`],msg:p(i[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:p(i[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:p(i[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:i[`rule-settings-override-ips`],payload_log:{enabled:i[`rule-settings-payload-log-enabled`]},quarantine:{file_types:i[`rule-settings-quarantine-file-types`]},redirect:{include_context:i[`rule-settings-redirect-include-context`],preserve_path_and_query:i[`rule-settings-redirect-preserve-path-and-query`],target_uri:p(i[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:p(i[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:p(i[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:i[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:p(i[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:p(i[`schedule-fri`],`schedule-fri`,`text`),mon:p(i[`schedule-mon`],`schedule-mon`,`text`),sat:p(i[`schedule-sat`],`schedule-sat`,`text`),sun:p(i[`schedule-sun`],`schedule-sun`,`text`),thu:p(i[`schedule-thu`],`schedule-thu`,`text`),time_zone:p(i[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:p(i[`schedule-tue`],`schedule-tue`,`text`),wed:p(i[`schedule-wed`],`schedule-wed`,`text`)},traffic:p(i.traffic,`traffic`,`text`)});u(await f(`Creating`,async()=>a.zeroTrust.gateway.rules.create({...m,account_id:o})),{successLabel:`Created`})}};function Bp(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Vp={command:`delete <rule-id>`,describe:`Delete a Zero Trust Gateway rule.`,builder:Bp,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.gateway.rules.delete({account_id:a,rule_id:e[`rule-id`]})),{successLabel:`Deleted`})}};function Hp(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Up={command:`get <rule-id>`,describe:`Get a single Zero Trust Gateway rule.`,builder:Hp,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.rules.get({account_id:i,rule_id:e[`rule-id`]})),{successLabel:`Loaded`})}};function Wp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gp={command:`list-tenant`,describe:`List Zero Trust Gateway rules for the parent account of an account in the MSP configuration.`,builder:Wp,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway rules list-tenant`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/rules/tenant`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.rules.listTenant({account_id:i})),{successLabel:`Loaded`})}};function Kp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qp={command:`list`,describe:`List Zero Trust Gateway rules for an account.`,builder:Kp,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/rules`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.gateway.rules.list({account_id:i})),{successLabel:`Loaded`})}};function Jp(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yp={command:`reset-expiration <rule-id>`,describe:"Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and it has a default duration. The Zero Trust Gateway Rule must have values for both `expiration.expires_at` and `expiration.duration`.",builder:Jp,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust gateway rules reset-expiration`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}/reset_expiration`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Creating`,async()=>n.zeroTrust.gateway.rules.resetExpiration({account_id:i,rule_id:e[`rule-id`]})),{successLabel:`Created`})}};function Xp(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`action`,{type:`string`,description:"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",choices:[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`]}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`device-posture`,{type:`string`,description:`Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`}).option(`expiration-duration`,{type:`number`,description:"Defines the default duration a policy active in minutes. Must set in order to use the `reset_expiration` endpoint on this rule."}).option(`filters`,{type:`string`,array:!0,description:`Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.`}).option(`identity`,{type:`string`,description:`Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`rule-settings-allow-child-bypass`,{type:`boolean`,description:`Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.`}).option(`rule-settings-audit-ssh-command-logging`,{type:`boolean`,description:`Enable SSH command logging.`}).option(`rule-settings-biso-admin-controls-copy`,{type:`string`,description:`Configure copy behavior. If set to remote_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dcp`,{type:`boolean`,description:'Set to false to enable copy-pasting. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dd`,{type:`boolean`,description:'Set to false to enable downloading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dk`,{type:`boolean`,description:'Set to false to enable keyboard usage. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-download`,{type:`string`,description:`Configure download behavior. When set to remote_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dp`,{type:`boolean`,description:'Set to false to enable printing. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-du`,{type:`boolean`,description:'Set to false to enable uploading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-keyboard`,{type:`string`,description:`Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-paste`,{type:`string`,description:`Configure paste behavior. If set to remote_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-printing`,{type:`string`,description:`Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-upload`,{type:`string`,description:`Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-version`,{type:`string`,description:`Indicate which version of the browser isolation controls should apply.`,choices:[`v1`,`v2`]}).option(`rule-settings-biso-admin-controls-wm-id`,{type:`string`,description:`Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser.`}).option(`rule-settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-block-page-enabled`,{type:`boolean`,description:"Enable the custom block page. Settable only for `dns` rules with action `block`."}).option(`rule-settings-block-reason`,{type:`string`,description:"Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`."}).option(`rule-settings-bypass-parent-rule`,{type:`boolean`,description:`Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.`}).option(`rule-settings-check-session-duration`,{type:`string`,description:`Sets the required session freshness threshold. The API returns a normalized version of this value.`}).option(`rule-settings-check-session-enforce`,{type:`boolean`,description:`Enable session enforcement.`}).option(`rule-settings-delete-headers`,{type:`string`,array:!0,description:"Remove headers from allowed requests by name. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes. Settable only for `http` rules with the action set to `allow`."}).option(`rule-settings-egress-ipv4`,{type:`string`,description:`Specify the IPv4 address to use for egress.`}).option(`rule-settings-egress-ipv4-fallback`,{type:`string`,description:`Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.`}).option(`rule-settings-egress-ipv6`,{type:`string`,description:`Specify the IPv6 range to use for egress.`}).option(`rule-settings-forensic-copy-enabled`,{type:`boolean`,description:`Enable sending the copy to storage.`}).option(`rule-settings-ignore-cname-category-matches`,{type:`boolean`,description:"Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-insecure-disable-dnssec-validation`,{type:`boolean`,description:"Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules."}).option(`rule-settings-ip-categories`,{type:`boolean`,description:"Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-ip-indicator-feeds`,{type:`boolean`,description:"Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-l4override-ip`,{type:`string`,description:`Defines the IPv4 or IPv6 address.`}).option(`rule-settings-l4override-port`,{type:`number`,description:`Defines a port number to use for TCP/UDP overrides.`}).option(`rule-settings-notification-settings-enabled`,{type:`boolean`,description:`Enable notification.`}).option(`rule-settings-notification-settings-include-context`,{type:`boolean`,description:`Indicates whether to pass the context information as query parameters.`}).option(`rule-settings-notification-settings-msg`,{type:`string`,description:`Customize the message shown in the notification.`}).option(`rule-settings-notification-settings-support-url`,{type:`string`,description:`Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.`}).option(`rule-settings-override-host`,{type:`string`,description:"Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-override-ips`,{type:`string`,array:!0,description:"Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-payload-log-enabled`,{type:`boolean`,description:`Enable DLP payload logging for this rule.`}).option(`rule-settings-quarantine-file-types`,{type:`string`,array:!0,description:`Specify the types of files to sandbox.`}).option(`rule-settings-redirect-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-redirect-preserve-path-and-query`,{type:`boolean`,description:`Specify whether to append the path and query parameters from the original request to target_uri.`}).option(`rule-settings-redirect-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-resolve-dns-internally-fallback`,{type:`string`,description:`Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.`,choices:[`none`,`public_dns`]}).option(`rule-settings-resolve-dns-internally-view-id`,{type:`string`,description:`Specify the internal DNS view identifier to pass to the internal DNS service.`}).option(`rule-settings-resolve-dns-through-cloudflare`,{type:`boolean`,description:"Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dns_resolver` rules."}).option(`rule-settings-untrusted-cert-action`,{type:`string`,description:`Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.`,choices:[`pass_through`,`block`,`error`]}).option(`schedule-fri`,{type:`string`,description:`Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-mon`,{type:`string`,description:`Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sat`,{type:`string`,description:`Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sun`,{type:`string`,description:`Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-thu`,{type:`string`,description:`Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-time-zone`,{type:`string`,description:`Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.`}).option(`schedule-tue`,{type:`string`,description:`Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-wed`,{type:`string`,description:`Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`traffic`,{type:`string`,description:`Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if(`rule-settings-allow-child-bypass.rule-settings-audit-ssh-command-logging.rule-settings-biso-admin-controls-copy.rule-settings-biso-admin-controls-dcp.rule-settings-biso-admin-controls-dd.rule-settings-biso-admin-controls-dk.rule-settings-biso-admin-controls-download.rule-settings-biso-admin-controls-dp.rule-settings-biso-admin-controls-du.rule-settings-biso-admin-controls-keyboard.rule-settings-biso-admin-controls-paste.rule-settings-biso-admin-controls-printing.rule-settings-biso-admin-controls-upload.rule-settings-biso-admin-controls-wm-id.rule-settings-block-page-include-context.rule-settings-block-page-target-uri.rule-settings-block-page-enabled.rule-settings-block-reason.rule-settings-bypass-parent-rule.rule-settings-check-session-duration.rule-settings-check-session-enforce.rule-settings-delete-headers.rule-settings-egress-ipv4.rule-settings-egress-ipv4-fallback.rule-settings-egress-ipv6.rule-settings-forensic-copy-enabled.rule-settings-ignore-cname-category-matches.rule-settings-insecure-disable-dnssec-validation.rule-settings-ip-categories.rule-settings-ip-indicator-feeds.rule-settings-l4override-ip.rule-settings-l4override-port.rule-settings-notification-settings-enabled.rule-settings-notification-settings-include-context.rule-settings-notification-settings-msg.rule-settings-notification-settings-support-url.rule-settings-override-host.rule-settings-override-ips.rule-settings-payload-log-enabled.rule-settings-quarantine-file-types.rule-settings-redirect-include-context.rule-settings-redirect-preserve-path-and-query.rule-settings-redirect-target-uri.rule-settings-resolve-dns-internally-fallback.rule-settings-resolve-dns-internally-view-id.rule-settings-resolve-dns-through-cloudflare.rule-settings-untrusted-cert-action`.split(`.`).some(t=>e[t]!==void 0)){let t=[`rule-settings-block-page-target-uri`,`rule-settings-redirect-target-uri`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --rule_settings-* flag is set`)}return!0})}const Zp={command:`update <rule-id>`,describe:`Update a configured Zero Trust Gateway rule.`,builder:Xp,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust gateway rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/gateway/rules/${i[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(i[`rule-id`]))}`,pathParams:{"rule-id":String(i[`rule-id`]??``)},bodyKind:`json`,body:i.body===void 0?l({action:p(i.action,`action`,`text`),description:p(i.description,`description`,`text`),device_posture:p(i[`device-posture`],`device-posture`,`text`),enabled:i.enabled,expiration:{duration:i[`expiration-duration`]},filters:i.filters,identity:p(i.identity,`identity`,`text`),name:p(i.name,`name`,`text`),precedence:i.precedence,rule_settings:{allow_child_bypass:i[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:i[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:p(i[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:i[`rule-settings-biso-admin-controls-dcp`],dd:i[`rule-settings-biso-admin-controls-dd`],dk:i[`rule-settings-biso-admin-controls-dk`],download:p(i[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:i[`rule-settings-biso-admin-controls-dp`],du:i[`rule-settings-biso-admin-controls-du`],keyboard:p(i[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:p(i[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:p(i[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:p(i[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:p(i[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:p(i[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:i[`rule-settings-block-page-include-context`],target_uri:p(i[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:i[`rule-settings-block-page-enabled`],block_reason:p(i[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:i[`rule-settings-bypass-parent-rule`],check_session:{duration:p(i[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:i[`rule-settings-check-session-enforce`]},delete_headers:i[`rule-settings-delete-headers`],egress:{ipv4:p(i[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:p(i[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:p(i[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:i[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:i[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:i[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:i[`rule-settings-ip-categories`],ip_indicator_feeds:i[`rule-settings-ip-indicator-feeds`],l4override:{ip:p(i[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:i[`rule-settings-l4override-port`]},notification_settings:{enabled:i[`rule-settings-notification-settings-enabled`],include_context:i[`rule-settings-notification-settings-include-context`],msg:p(i[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:p(i[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:p(i[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:i[`rule-settings-override-ips`],payload_log:{enabled:i[`rule-settings-payload-log-enabled`]},quarantine:{file_types:i[`rule-settings-quarantine-file-types`]},redirect:{include_context:i[`rule-settings-redirect-include-context`],preserve_path_and_query:i[`rule-settings-redirect-preserve-path-and-query`],target_uri:p(i[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:p(i[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:p(i[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:i[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:p(i[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:p(i[`schedule-fri`],`schedule-fri`,`text`),mon:p(i[`schedule-mon`],`schedule-mon`,`text`),sat:p(i[`schedule-sat`],`schedule-sat`,`text`),sun:p(i[`schedule-sun`],`schedule-sun`,`text`),thu:p(i[`schedule-thu`],`schedule-thu`,`text`),time_zone:p(i[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:p(i[`schedule-tue`],`schedule-tue`,`text`),wed:p(i[`schedule-wed`],`schedule-wed`,`text`)},traffic:p(i.traffic,`traffic`,`text`)}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Updating`,async()=>a.zeroTrust.gateway.rules.update({...e,account_id:o,rule_id:i[`rule-id`]})),{successLabel:`Updated`});return}i.action===void 0&&(i.action=await n(`action`,"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`])),i.name===void 0&&(i.name=await e(`name`,`Specify the rule name.`));let m=l({action:p(i.action,`action`,`text`),description:p(i.description,`description`,`text`),device_posture:p(i[`device-posture`],`device-posture`,`text`),enabled:i.enabled,expiration:{duration:i[`expiration-duration`]},filters:i.filters,identity:p(i.identity,`identity`,`text`),name:p(i.name,`name`,`text`),precedence:i.precedence,rule_settings:{allow_child_bypass:i[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:i[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:p(i[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:i[`rule-settings-biso-admin-controls-dcp`],dd:i[`rule-settings-biso-admin-controls-dd`],dk:i[`rule-settings-biso-admin-controls-dk`],download:p(i[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:i[`rule-settings-biso-admin-controls-dp`],du:i[`rule-settings-biso-admin-controls-du`],keyboard:p(i[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:p(i[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:p(i[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:p(i[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:p(i[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:p(i[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:i[`rule-settings-block-page-include-context`],target_uri:p(i[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:i[`rule-settings-block-page-enabled`],block_reason:p(i[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:i[`rule-settings-bypass-parent-rule`],check_session:{duration:p(i[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:i[`rule-settings-check-session-enforce`]},delete_headers:i[`rule-settings-delete-headers`],egress:{ipv4:p(i[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:p(i[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:p(i[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:i[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:i[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:i[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:i[`rule-settings-ip-categories`],ip_indicator_feeds:i[`rule-settings-ip-indicator-feeds`],l4override:{ip:p(i[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:i[`rule-settings-l4override-port`]},notification_settings:{enabled:i[`rule-settings-notification-settings-enabled`],include_context:i[`rule-settings-notification-settings-include-context`],msg:p(i[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:p(i[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:p(i[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:i[`rule-settings-override-ips`],payload_log:{enabled:i[`rule-settings-payload-log-enabled`]},quarantine:{file_types:i[`rule-settings-quarantine-file-types`]},redirect:{include_context:i[`rule-settings-redirect-include-context`],preserve_path_and_query:i[`rule-settings-redirect-preserve-path-and-query`],target_uri:p(i[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:p(i[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:p(i[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:i[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:p(i[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:p(i[`schedule-fri`],`schedule-fri`,`text`),mon:p(i[`schedule-mon`],`schedule-mon`,`text`),sat:p(i[`schedule-sat`],`schedule-sat`,`text`),sun:p(i[`schedule-sun`],`schedule-sun`,`text`),thu:p(i[`schedule-thu`],`schedule-thu`,`text`),time_zone:p(i[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:p(i[`schedule-tue`],`schedule-tue`,`text`),wed:p(i[`schedule-wed`],`schedule-wed`,`text`)},traffic:p(i.traffic,`traffic`,`text`)});u(await f(`Updating`,async()=>a.zeroTrust.gateway.rules.update({...m,account_id:o,rule_id:i[`rule-id`]})),{successLabel:`Updated`})}},Qp={command:`rules`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(zp).command(Vp).command(Up).command(qp).command(Gp).command(Yp).command(Zp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},$p={command:`gateway`,describe:`Operations for gateway`,builder:e=>e.command(Ff).command(Lf).command($d).command(sf).command(uf).command(Cf).command(Nf).command($f).command(up).command(hp).command(Ep).command(Lp).command(Qp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function em(e){return e.option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const tm={command:`create`,describe:`Creates a new Access group.`,builder:em,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/groups`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({name:p(t.name,`name`,`text`)}):c(t.body)});return}let n=await s(t),r=await a({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.groups.create({...e,zone_id:r})),{successLabel:`Created`});return}t.name===void 0&&(t.name=await e(`name`,`The name of the Access group.`));let i=l({name:p(t.name,`name`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.groups.create({...i,zone_id:r})),{successLabel:`Created`})}};function nm(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const rm={command:`delete <group-id>`,describe:`Deletes an Access group.`,builder:nm,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>t.zeroTrust.groups.delete({zone_id:n,group_id:e[`group-id`]})),{successLabel:`Deleted`})}};function im(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const am={command:`get <group-id>`,describe:`Fetches a single Access group.`,builder:im,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.groups.get({zone_id:n,group_id:e[`group-id`]})),{successLabel:`Loaded`})}};function om(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sm={command:`list`,describe:`Lists all Access groups.`,builder:om,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/groups`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.groups.list({zone_id:n})),{successLabel:`Loaded`})}};function cm(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const lm={command:`update <group-id>`,describe:`Updates a configured Access group.`,builder:cm,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/groups/${t[`group-id`]==null?`<group-id>`:encodeURIComponent(String(t[`group-id`]))}`,pathParams:{"group-id":String(t[`group-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({name:p(t.name,`name`,`text`)}):c(t.body)});return}let n=await s(t),r=await a({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.groups.update({...e,zone_id:r,group_id:t[`group-id`]})),{successLabel:`Updated`});return}t.name===void 0&&(t.name=await e(`name`,`The name of the Access group.`));let i=l({name:p(t.name,`name`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.groups.update({...i,zone_id:r,group_id:t[`group-id`]})),{successLabel:`Updated`})}},um={command:`groups`,describe:`Operations for groups`,builder:e=>e.command(tm).command(rm).command(am).command(sm).command(lm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function dm(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const fm={command:`create`,describe:`Adds a new identity provider to Access.`,builder:dm,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust identity-providers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/identity_providers`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.identityProviders.create({body:t,account_id:i})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function pm(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const mm={command:`delete <identity-provider-id>`,describe:`Deletes an identity provider from Access.`,builder:pm,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust identity-providers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.identityProviders.delete({account_id:a,identity_provider_id:e[`identity-provider-id`]})),{successLabel:`Deleted`})}};function hm(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gm={command:`get <identity-provider-id>`,describe:`Fetches a configured identity provider.`,builder:hm,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust identity-providers get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.identityProviders.get({account_id:i,identity_provider_id:e[`identity-provider-id`]})),{successLabel:`Loaded`})}};function _m(e){return e.option(`scim-enabled`,{type:`string`,description:`Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const vm={command:`list`,describe:`Lists all configured identity providers.`,builder:_m,handler:async e=>{let n={scim_enabled:e[`scim-enabled`],page:e.page,per_page:e[`per-page`]};if(e.dryRun){d({command:`cf zero-trust identity-providers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/identity_providers`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.identityProviders.list({account_id:a,...n})),{successLabel:`Loaded`})}};function ym(e){return e.option(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`cf-resource-id`,{type:`string`,description:'The unique Cloudflare-generated Id of the SCIM Group resource; also known as the "Id".\nPass once for a single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to look up multiple groups in one request,\nup to 50 values. Mutually exclusive with `idp_resource_id`, `name`,\n`search_contains`, and `search_starts_with`.'}).option(`idp-resource-id`,{type:`string`,description:'The IdP-generated Id of the SCIM Group resource; also known as the "external Id".\nPass once for a single lookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to look up multiple groups in one request,\nup to 50 values. Mutually exclusive with `cf_resource_id`, `name`,\n`search_contains`, and `search_starts_with`.'}).option(`name`,{type:`string`,description:`The display name of the SCIM Group resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const bm={command:`list`,describe:`Lists SCIM Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:ym,handler:async e=>{let n={cf_resource_id:e[`cf-resource-id`],idp_resource_id:e[`idp-resource-id`],name:e.name,page:e.page,per_page:e[`per-page`]};if(e.dryRun){d({command:`cf zero-trust identity-providers scim groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}/scim/groups`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``)},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.identityProviders.scim.groups.list({account_id:a,identity_provider_id:e[`identity-provider-id`],...n})),{successLabel:`Loaded`})}},xm={command:`groups`,describe:`Operations for identity-providers.scim.groups`,builder:e=>e.command(bm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Sm(e){return e.option(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`cf-resource-id`,{type:`string`,description:'The unique Cloudflare-generated Id of the SCIM User resource; also known as the "Id".\nPass once for a single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to look up multiple users in one request,\nup to 50 values. Mutually exclusive with `idp_resource_id`, `username`, `email`,\n`name`, `search_contains`, and `search_starts_with`.'}).option(`idp-resource-id`,{type:`string`,description:'The IdP-generated Id of the SCIM User resource; also known as the "external Id".\nPass once for a single lookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to look up multiple users in one request,\nup to 50 values. Mutually exclusive with `cf_resource_id`, `username`, `email`,\n`name`, `search_contains`, and `search_starts_with`.'}).option(`username`,{type:`string`,description:`The username of the SCIM User resource.`}).option(`email`,{type:`string`,description:`The email address of the SCIM User resource.`}).option(`name`,{type:`string`,description:`The name of the SCIM User resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cm={command:`list`,describe:`Lists SCIM User resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:Sm,handler:async e=>{let n={cf_resource_id:e[`cf-resource-id`],idp_resource_id:e[`idp-resource-id`],username:e.username,email:e.email,name:e.name,page:e.page,per_page:e[`per-page`]};if(e.dryRun){d({command:`cf zero-trust identity-providers scim users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}/scim/users`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``)},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.identityProviders.scim.users.list({account_id:a,identity_provider_id:e[`identity-provider-id`],...n})),{successLabel:`Loaded`})}},wm={command:`users`,describe:`Operations for identity-providers.scim.users`,builder:e=>e.command(Cm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Tm={command:`scim`,describe:`Operations for identity-providers.scim`,builder:e=>e.command(xm).command(wm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Em(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Dm={command:`update <identity-provider-id>`,describe:`Updates a configured identity provider.`,builder:Em,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust identity-providers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.identityProviders.update({body:t,account_id:i,identity_provider_id:e[`identity-provider-id`]})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Om={command:`identity-providers`,describe:`Operations for identity-providers`,builder:e=>e.command(fm).command(mm).command(gm).command(vm).command(Dm).command(Tm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function km(e){return e.option(`comment`,{type:`string`,description:`An optional description of the hostname route.`}).option(`hostname`,{type:`string`,description:`The hostname of the route.`}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Am={command:`create`,describe:`Create a hostname route.`,builder:km,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks hostname-routes create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zerotrust/routes/hostname`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({comment:p(e.comment,`comment`,`text`),hostname:p(e.hostname,`hostname`,`text`),tunnel_id:p(e[`tunnel-id`],`tunnel-id`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.networks.hostnameRoutes.create({...t,account_id:i})),{successLabel:`Created`});return}let a=l({comment:p(e.comment,`comment`,`text`),hostname:p(e.hostname,`hostname`,`text`),tunnel_id:p(e[`tunnel-id`],`tunnel-id`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.networks.hostnameRoutes.create({...a,account_id:i})),{successLabel:`Created`})}};function jm(e){return e.positional(`hostname-route-id`,{type:`string`,description:`The hostname route ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Mm={command:`delete <hostname-route-id>`,describe:`Delete a hostname route.`,builder:jm,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks hostname-routes delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zerotrust/routes/hostname/${e[`hostname-route-id`]==null?`<hostname-route-id>`:encodeURIComponent(String(e[`hostname-route-id`]))}`,pathParams:{"hostname-route-id":String(e[`hostname-route-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.networks.hostnameRoutes.delete({account_id:a,hostname_route_id:e[`hostname-route-id`]})),{successLabel:`Deleted`})}};function Nm(e){return e.positional(`hostname-route-id`,{type:`string`,description:`The hostname route ID.`,demandOption:!0}).option(`comment`,{type:`string`,description:`An optional description of the hostname route.`}).option(`hostname`,{type:`string`,description:`The hostname of the route.`}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Pm={command:`edit <hostname-route-id>`,describe:`Updates a hostname route.`,builder:Nm,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks hostname-routes edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zerotrust/routes/hostname/${e[`hostname-route-id`]==null?`<hostname-route-id>`:encodeURIComponent(String(e[`hostname-route-id`]))}`,pathParams:{"hostname-route-id":String(e[`hostname-route-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({comment:p(e.comment,`comment`,`text`),hostname:p(e.hostname,`hostname`,`text`),tunnel_id:p(e[`tunnel-id`],`tunnel-id`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.networks.hostnameRoutes.edit({...t,account_id:i,hostname_route_id:e[`hostname-route-id`]})),{successLabel:`Updated`});return}let a=l({comment:p(e.comment,`comment`,`text`),hostname:p(e.hostname,`hostname`,`text`),tunnel_id:p(e[`tunnel-id`],`tunnel-id`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.networks.hostnameRoutes.edit({...a,account_id:i,hostname_route_id:e[`hostname-route-id`]})),{successLabel:`Updated`})}};function Fm(e){return e.positional(`hostname-route-id`,{type:`string`,description:`The hostname route ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Im={command:`get <hostname-route-id>`,describe:`Get a hostname route.`,builder:Fm,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks hostname-routes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zerotrust/routes/hostname/${e[`hostname-route-id`]==null?`<hostname-route-id>`:encodeURIComponent(String(e[`hostname-route-id`]))}`,pathParams:{"hostname-route-id":String(e[`hostname-route-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.networks.hostnameRoutes.get({account_id:i,hostname_route_id:e[`hostname-route-id`]})),{successLabel:`Loaded`})}};function Lm(e){return e.option(`id`,{type:`string`,description:`The hostname route ID.`}).option(`hostname`,{type:`string`,description:`If set, only list hostname routes that contain a substring of the given value, the filter is case-insensitive.`}).option(`tunnel-id`,{type:`string`,description:`If set, only list hostname routes that point to a specific tunnel.`}).option(`comment`,{type:`string`,description:`If set, only list hostname routes with the given comment.`}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only return deleted hostname routes. If `false`, exclude deleted hostname routes."}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Rm={command:`list`,describe:`Lists and filters hostname routes in an account.`,builder:Lm,handler:async e=>{let n={id:e.id,hostname:e.hostname,tunnel_id:e[`tunnel-id`],comment:e.comment,existed_at:e[`existed-at`],is_deleted:e[`is-deleted`],per_page:e[`per-page`],page:e.page};if(e.dryRun){d({command:`cf zero-trust networks hostname-routes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zerotrust/routes/hostname`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.networks.hostnameRoutes.list({account_id:a,...n})),{successLabel:`Loaded`})}},zm={command:`hostname-routes`,describe:`Operations for networks.hostname-routes`,builder:e=>e.command(Am).command(Mm).command(Pm).command(Im).command(Rm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bm(e){return e.option(`comment`,{type:`string`,description:`Optional remark describing the route.`,default:``}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range connected by the route, in CIDR notation.`}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Vm={command:`create`,describe:`Routes a private network through a Cloudflare Tunnel.`,builder:Bm,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust networks routes create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/teamnet/routes`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({comment:p(n.comment,`comment`,`text`),network:p(n.network,`network`,`text`),virtual_network_id:p(n[`virtual-network-id`],`virtual-network-id`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.networks.routes.create({...e,account_id:a})),{successLabel:`Created`});return}n.network===void 0&&(n.network=await e(`network`,`The private IPv4 or IPv6 range connected by the route, in CIDR notation.`));let o=l({comment:p(n.comment,`comment`,`text`),network:p(n.network,`network`,`text`),virtual_network_id:p(n[`virtual-network-id`],`virtual-network-id`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.networks.routes.create({...o,account_id:a})),{successLabel:`Created`})}};function Hm(e){return e.positional(`route-id`,{type:`string`,description:`UUID of the route.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Um={command:`delete <route-id>`,describe:`Deletes a private network route from an account.`,builder:Hm,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks routes delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/teamnet/routes/${e[`route-id`]==null?`<route-id>`:encodeURIComponent(String(e[`route-id`]))}`,pathParams:{"route-id":String(e[`route-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.networks.routes.delete({account_id:a,route_id:e[`route-id`]})),{successLabel:`Deleted`})}};function Wm(e){return e.positional(`route-id`,{type:`string`,description:`UUID of the route.`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the route.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range connected by the route, in CIDR notation.`}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Gm={command:`edit <route-id>`,describe:`Updates an existing private network route in an account. The fields that are meant to be updated should be provided in the body of the request.`,builder:Wm,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks routes edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/teamnet/routes/${e[`route-id`]==null?`<route-id>`:encodeURIComponent(String(e[`route-id`]))}`,pathParams:{"route-id":String(e[`route-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({comment:p(e.comment,`comment`,`text`),network:p(e.network,`network`,`text`),virtual_network_id:p(e[`virtual-network-id`],`virtual-network-id`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.networks.routes.edit({...t,account_id:i,route_id:e[`route-id`]})),{successLabel:`Updated`});return}let a=l({comment:p(e.comment,`comment`,`text`),network:p(e.network,`network`,`text`),virtual_network_id:p(e[`virtual-network-id`],`virtual-network-id`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.networks.routes.edit({...a,account_id:i,route_id:e[`route-id`]})),{successLabel:`Updated`})}};function Km(e){return e.positional(`route-id`,{type:`string`,description:`UUID of the route.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qm={command:`get <route-id>`,describe:`Get a private network route in an account.`,builder:Km,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks routes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/teamnet/routes/${e[`route-id`]==null?`<route-id>`:encodeURIComponent(String(e[`route-id`]))}`,pathParams:{"route-id":String(e[`route-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.networks.routes.get({account_id:i,route_id:e[`route-id`]})),{successLabel:`Loaded`})}};function Jm(e){return e.positional(`ip`,{type:`string`,description:`Ip`,demandOption:!0}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`default-virtual-network-fallback`,{type:`boolean`,description:`When the virtual_network_id parameter is not provided the request filter will default search routes that are in the default virtual network for the account. If this parameter is set to false, the search will include routes that do not have a virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ym={command:`get <ip>`,describe:`Fetches routes that contain the given IP address.`,builder:Jm,handler:async e=>{let n={virtual_network_id:e[`virtual-network-id`],default_virtual_network_fallback:e[`default-virtual-network-fallback`]};if(e.dryRun){d({command:`cf zero-trust networks routes ips get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/teamnet/routes/ip/${e.ip==null?`<ip>`:encodeURIComponent(String(e.ip))}`,pathParams:{ip:String(e.ip??``)},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.networks.routes.ips.get({account_id:a,ip:e.ip,...n})),{successLabel:`Loaded`})}},Xm={command:`ips`,describe:`Operations for networks.routes.ips`,builder:e=>e.command(Ym).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Zm(e){return e.option(`comment`,{type:`string`,description:`Optional remark describing the route.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted routes. If `false`, exclude deleted routes. If empty, all routes will be included."}).option(`network-subset`,{type:`string`,description:`If set, only list routes that are contained within this IP range.`}).option(`network-superset`,{type:`string`,description:`If set, only list routes that contain this IP range.`}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`route-id`,{type:`string`,description:`UUID of the route.`}).option(`tun-types`,{type:`string`,description:`The types of tunnels to filter by, separated by commas.`}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qm={command:`list`,describe:`Lists and filters private network routes in an account.`,builder:g(Zm),handler:async e=>{let n={comment:e.comment,is_deleted:e[`is-deleted`],network_subset:e[`network-subset`],network_superset:e[`network-superset`],existed_at:e[`existed-at`],tunnel_id:e[`tunnel-id`],route_id:e[`route-id`],tun_types:e[`tun-types`],virtual_network_id:e[`virtual-network-id`],per_page:e[`per-page`],page:e.page};if(e.dryRun){d({command:`cf zero-trust networks routes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/teamnet/routes`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.networks.routes.list({account_id:a,...n})),{successLabel:`Loaded`})}};function $m(e){return e.positional(`ip-network-encoded`,{type:`string`,description:`IP/CIDR range in URL-encoded format`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the route.`,default:``}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const eh={command:`create <ip-network-encoded>`,describe:"Routes a private network through a Cloudflare Tunnel. The CIDR in `ip_network_encoded` must be written in URL-encoded format.",builder:$m,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks routes networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/teamnet/routes/network/${e[`ip-network-encoded`]==null?`<ip-network-encoded>`:encodeURIComponent(String(e[`ip-network-encoded`]))}`,pathParams:{"ip-network-encoded":String(e[`ip-network-encoded`]??``)},bodyKind:`json`,body:e.body===void 0?l({comment:p(e.comment,`comment`,`text`),virtual_network_id:p(e[`virtual-network-id`],`virtual-network-id`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.networks.routes.networks.create({...t,account_id:i,ip_network_encoded:e[`ip-network-encoded`]})),{successLabel:`Created`});return}let a=l({comment:p(e.comment,`comment`,`text`),virtual_network_id:p(e[`virtual-network-id`],`virtual-network-id`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.networks.routes.networks.create({...a,account_id:i,ip_network_encoded:e[`ip-network-encoded`]})),{successLabel:`Created`})}};function th(e){return e.positional(`ip-network-encoded`,{type:`string`,description:`IP/CIDR range in URL-encoded format`,demandOption:!0}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`tun-type`,{type:`string`,description:`The type of tunnel.`,choices:[`cfd_tunnel`,`warp_connector`,`warp`,`magic`,`ip_sec`,`gre`,`cni`]}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const nh={command:`delete <ip-network-encoded>`,describe:"Deletes a private network route from an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format. If no virtual_network_id is provided it will delete the route from the default vnet. If no tun_type is provided it will fetch the type from the tunnel_id or if that is missing it will assume Cloudflare Tunnel as default. If tunnel_id is provided it will delete the route from that tunnel, otherwise it will delete the route based on the vnet and tun_type.",builder:g(th),handler:async e=>{let n={virtual_network_id:e[`virtual-network-id`],tun_type:e[`tun-type`],tunnel_id:e[`tunnel-id`]};if(e.dryRun){d({command:`cf zero-trust networks routes networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/teamnet/routes/network/${e[`ip-network-encoded`]==null?`<ip-network-encoded>`:encodeURIComponent(String(e[`ip-network-encoded`]))}`,pathParams:{"ip-network-encoded":String(e[`ip-network-encoded`]??``)},query:n,bodyKind:`none`});return}let a=await s(e),o=e.local?h:await r(a);if(e.accountId=o,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>a.zeroTrust.networks.routes.networks.delete({account_id:o,ip_network_encoded:e[`ip-network-encoded`],...n})),{successLabel:`Deleted`})}};function rh(e){return e.positional(`ip-network-encoded`,{type:`string`,description:`IP/CIDR range in URL-encoded format`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ih={command:`edit <ip-network-encoded>`,describe:"Updates an existing private network route in an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format.",builder:rh,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks routes networks edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/teamnet/routes/network/${e[`ip-network-encoded`]==null?`<ip-network-encoded>`:encodeURIComponent(String(e[`ip-network-encoded`]))}`,pathParams:{"ip-network-encoded":String(e[`ip-network-encoded`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Updating`,async()=>n.zeroTrust.networks.routes.networks.edit({account_id:i,ip_network_encoded:e[`ip-network-encoded`]})),{successLabel:`Updated`})}},ah={command:`networks`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(eh).command(nh).command(ih).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},oh={command:`routes`,describe:`Operations for networks.routes`,builder:e=>e.command(Vm).command(Um).command(Gm).command(qm).command(Qm).command(Xm).command(ah).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function sh(e){return e.positional(`address-family`,{type:`string`,description:"IP address family, either `v4` (IPv4) or `v6` (IPv6)",demandOption:!0}).option(`comment`,{type:`string`,description:`An optional description of the subnet.`}).option(`name`,{type:`string`,description:`A user-friendly name for the subnet.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ch={command:`update <address-family>`,describe:`Updates the Cloudflare Source subnet of the given address family`,builder:g(sh),handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks subnets cloudflare-source update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zerotrust/subnets/cloudflare_source/${e[`address-family`]==null?`<address-family>`:encodeURIComponent(String(e[`address-family`]))}`,pathParams:{"address-family":String(e[`address-family`]??``)},bodyKind:`json`,body:e.body===void 0?l({comment:p(e.comment,`comment`,`text`),name:p(e.name,`name`,`text`),network:p(e.network,`network`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.networks.subnets.cloudflareSource.update({...t,account_id:i,address_family:e[`address-family`]})),{successLabel:`Updated`});return}let a=l({comment:p(e.comment,`comment`,`text`),name:p(e.name,`name`,`text`),network:p(e.network,`network`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.networks.subnets.cloudflareSource.update({...a,account_id:i,address_family:e[`address-family`]})),{successLabel:`Updated`})}},lh={command:`cloudflare-source`,describe:`Operations for networks.subnets.cloudflare-source`,builder:e=>e.command(ch).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function uh(e){return e.positional(`address-family`,{type:`string`,description:"IP address family, either `v4` (IPv4) or `v6` (IPv6)",demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dh={command:`get <address-family>`,describe:`Returns the account's default gateway ephemeral subnet for the given address family.`,builder:g(uh),handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks subnets initial-resolved-ip get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zerotrust/subnets/initial_resolved_ip/${e[`address-family`]==null?`<address-family>`:encodeURIComponent(String(e[`address-family`]))}`,pathParams:{"address-family":String(e[`address-family`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.networks.subnets.initialResolvedIp.get({account_id:i,address_family:e[`address-family`]})),{successLabel:`Loaded`})}};function fh(e){return e.positional(`address-family`,{type:`string`,description:"IP address family, either `v4` (IPv4) or `v6` (IPv6)",demandOption:!0}).option(`comment`,{type:`string`,description:`An optional description of the subnet.`}).option(`name`,{type:`string`,description:`A user-friendly name for the subnet.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ph={command:`update <address-family>`,describe:`Updates the CIDR for the account's default gateway ephemeral subnet of the given address family. The new CIDR must not conflict with existing private routes in the account.`,builder:g(fh),handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks subnets initial-resolved-ip update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zerotrust/subnets/initial_resolved_ip/${e[`address-family`]==null?`<address-family>`:encodeURIComponent(String(e[`address-family`]))}`,pathParams:{"address-family":String(e[`address-family`]??``)},bodyKind:`json`,body:e.body===void 0?l({comment:p(e.comment,`comment`,`text`),name:p(e.name,`name`,`text`),network:p(e.network,`network`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.networks.subnets.initialResolvedIp.update({...t,account_id:i,address_family:e[`address-family`]})),{successLabel:`Updated`});return}let a=l({comment:p(e.comment,`comment`,`text`),name:p(e.name,`name`,`text`),network:p(e.network,`network`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.networks.subnets.initialResolvedIp.update({...a,account_id:i,address_family:e[`address-family`]})),{successLabel:`Updated`})}},mh={command:`initial-resolved-ip`,describe:`Operations for networks.subnets.initial-resolved-ip`,builder:e=>e.command(dh).command(ph).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function hh(e){return e.option(`name`,{type:`string`,description:`If set, only list subnets with the given name`}).option(`comment`,{type:`string`,description:`If set, only list subnets with the given comment.`}).option(`network`,{type:`string`,description:`If set, only list the subnet whose network exactly matches the given CIDR.`}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`address-family`,{type:`string`,description:"If set, only include subnets in the given address family - `v4` or `v6`",choices:[`v4`,`v6`]}).option(`is-default-network`,{type:`boolean`,description:"If `true`, only include default subnets. If `false`, exclude default subnets subnets. If not set, all subnets will be included."}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted subnets. If `false`, exclude deleted subnets. If not set, all subnets will be included."}).option(`sort-order`,{type:`string`,description:"Sort order of the results. `asc` means oldest to newest, `desc` means newest to oldest. If not set, they will not be in any particular order.",choices:[`asc`,`desc`]}).option(`subnet-types`,{type:`string`,description:`If set, the types of subnets to include, separated by comma.`,choices:[`cloudflare_source`,`initial_resolved_ip`,`warp`]}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gh={command:`list`,describe:`Lists and filters subnets in an account.`,builder:g(hh),handler:async e=>{let n={name:e.name,comment:e.comment,network:e.network,existed_at:e[`existed-at`],address_family:e[`address-family`],is_default_network:e[`is-default-network`],is_deleted:e[`is-deleted`],sort_order:e[`sort-order`],subnet_types:e[`subnet-types`],per_page:e[`per-page`],page:e.page};if(e.dryRun){d({command:`cf zero-trust networks subnets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zerotrust/subnets`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.networks.subnets.list({account_id:a,...n})),{successLabel:`Loaded`})}};function _h(e){return e.option(`comment`,{type:`string`,description:`An optional description of the subnet.`,default:``}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this is the default subnet for the account. There can only be one default subnet per account.",default:!1}).option(`name`,{type:`string`,description:`A user-friendly name for the subnet.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const vh={command:`create`,describe:"Create a WARP IP assignment subnet. Currently, only IPv4 subnets can be created. **Network constraints:** - The network must be within one of the following private IP ranges: - `10.0.0.0/8` (RFC 1918) - `172.16.0.0/12` (RFC 1918) - `192.168.0.0/16` (RFC 1918) - `100.64.0.0/10` (RFC 6598 - CGNAT) - The subnet must have a prefix length of `/24` or larger (e.g., `/16`, `/20`, `/24` are valid; `/25`, `/28` are not)",builder:_h,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust networks subnets warp create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zerotrust/subnets/warp`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({comment:p(n.comment,`comment`,`text`),is_default_network:n[`is-default-network`],name:p(n.name,`name`,`text`),network:p(n.network,`network`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.networks.subnets.warp.create({...e,account_id:a})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await e(`name`,`A user-friendly name for the subnet.`)),n.network===void 0&&(n.network=await e(`network`,`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`));let o=l({comment:p(n.comment,`comment`,`text`),is_default_network:n[`is-default-network`],name:p(n.name,`name`,`text`),network:p(n.network,`network`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.networks.subnets.warp.create({...o,account_id:a})),{successLabel:`Created`})}};function yh(e){return e.positional(`subnet-id`,{type:`string`,description:`The UUID of the subnet.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const bh={command:`delete <subnet-id>`,describe:`Delete a WARP IP assignment subnet. This operation is idempotent - deleting an already-deleted or non-existent subnet will return success with a null result.`,builder:yh,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks subnets warp delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zerotrust/subnets/warp/${e[`subnet-id`]==null?`<subnet-id>`:encodeURIComponent(String(e[`subnet-id`]))}`,pathParams:{"subnet-id":String(e[`subnet-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.networks.subnets.warp.delete({account_id:a,subnet_id:e[`subnet-id`]})),{successLabel:`Deleted`})}};function xh(e){return e.positional(`subnet-id`,{type:`string`,description:`The UUID of the subnet.`,demandOption:!0}).option(`comment`,{type:`string`,description:`An optional description of the subnet.`}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this is the default subnet for the account. There can only be one default subnet per account."}).option(`name`,{type:`string`,description:`A user-friendly name for the subnet.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Sh={command:`edit <subnet-id>`,describe:"Updates a WARP IP assignment subnet. **Update constraints:** - The `network` field cannot be modified for WARP subnets. Only `name`, `comment`, and `is_default_network` can be updated. - IPv6 subnets cannot be updated",builder:xh,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks subnets warp edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zerotrust/subnets/warp/${e[`subnet-id`]==null?`<subnet-id>`:encodeURIComponent(String(e[`subnet-id`]))}`,pathParams:{"subnet-id":String(e[`subnet-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({comment:p(e.comment,`comment`,`text`),is_default_network:e[`is-default-network`],name:p(e.name,`name`,`text`),network:p(e.network,`network`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.networks.subnets.warp.edit({...t,account_id:i,subnet_id:e[`subnet-id`]})),{successLabel:`Updated`});return}let a=l({comment:p(e.comment,`comment`,`text`),is_default_network:e[`is-default-network`],name:p(e.name,`name`,`text`),network:p(e.network,`network`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.networks.subnets.warp.edit({...a,account_id:i,subnet_id:e[`subnet-id`]})),{successLabel:`Updated`})}};function Ch(e){return e.positional(`subnet-id`,{type:`string`,description:`The UUID of the subnet.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wh={command:`get <subnet-id>`,describe:`Get a WARP IP assignment subnet.`,builder:Ch,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks subnets warp get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zerotrust/subnets/warp/${e[`subnet-id`]==null?`<subnet-id>`:encodeURIComponent(String(e[`subnet-id`]))}`,pathParams:{"subnet-id":String(e[`subnet-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.networks.subnets.warp.get({account_id:i,subnet_id:e[`subnet-id`]})),{successLabel:`Loaded`})}},Th={command:`warp`,describe:`Operations for networks.subnets.warp`,builder:e=>e.command(vh).command(bh).command(Sh).command(wh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Eh={command:`subnets`,describe:`Operations for networks.subnets`,builder:e=>e.command(gh).command(lh).command(mh).command(Th).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Dh(e){return e.option(`comment`,{type:`string`,description:`Optional remark describing the virtual network.`,default:``}).option(`is-default`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account."}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account.",default:!1}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Oh={command:`create`,describe:`Adds a new virtual network to an account.`,builder:Dh,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust networks virtual-networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/teamnet/virtual_networks`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({comment:p(n.comment,`comment`,`text`),is_default:n[`is-default`],is_default_network:n[`is-default-network`],name:p(n.name,`name`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.networks.virtualNetworks.create({...e,account_id:a})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await e(`name`,`A user-friendly name for the virtual network.`));let o=l({comment:p(n.comment,`comment`,`text`),is_default:n[`is-default`],is_default_network:n[`is-default-network`],name:p(n.name,`name`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.networks.virtualNetworks.create({...o,account_id:a})),{successLabel:`Created`})}};function kh(e){return e.positional(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ah={command:`delete <virtual-network-id>`,describe:`Deletes an existing virtual network.`,builder:kh,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks virtual-networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/teamnet/virtual_networks/${e[`virtual-network-id`]==null?`<virtual-network-id>`:encodeURIComponent(String(e[`virtual-network-id`]))}`,pathParams:{"virtual-network-id":String(e[`virtual-network-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.networks.virtualNetworks.delete({account_id:a,virtual_network_id:e[`virtual-network-id`]})),{successLabel:`Deleted`})}};function jh(e){return e.positional(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the virtual network.`}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account."}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Mh={command:`edit <virtual-network-id>`,describe:`Updates an existing virtual network.`,builder:jh,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks virtual-networks edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/teamnet/virtual_networks/${e[`virtual-network-id`]==null?`<virtual-network-id>`:encodeURIComponent(String(e[`virtual-network-id`]))}`,pathParams:{"virtual-network-id":String(e[`virtual-network-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({comment:p(e.comment,`comment`,`text`),is_default_network:e[`is-default-network`],name:p(e.name,`name`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.networks.virtualNetworks.edit({...t,account_id:i,virtual_network_id:e[`virtual-network-id`]})),{successLabel:`Updated`});return}let a=l({comment:p(e.comment,`comment`,`text`),is_default_network:e[`is-default-network`],name:p(e.name,`name`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.networks.virtualNetworks.edit({...a,account_id:i,virtual_network_id:e[`virtual-network-id`]})),{successLabel:`Updated`})}};function Nh(e){return e.positional(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the virtual network.`,default:``}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account."}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ph={command:`get <virtual-network-id>`,describe:`Get a virtual network.`,builder:Nh,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust networks virtual-networks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/teamnet/virtual_networks/${e[`virtual-network-id`]==null?`<virtual-network-id>`:encodeURIComponent(String(e[`virtual-network-id`]))}`,pathParams:{"virtual-network-id":String(e[`virtual-network-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.networks.virtualNetworks.get({account_id:i,virtual_network_id:e[`virtual-network-id`]})),{successLabel:`Loaded`})}};function Fh(e){return e.option(`id`,{type:`string`,description:`UUID of the virtual network.`}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`is-default`,{type:`boolean`,description:"If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included."}).option(`is-default-network`,{type:`boolean`,description:"If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included."}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted virtual networks. If `false`, exclude deleted virtual networks. If empty, all virtual networks will be included."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ih={command:`list`,describe:`Lists and filters virtual networks in an account.`,builder:Fh,handler:async e=>{let n={id:e.id,name:e.name,is_default:e[`is-default`],is_default_network:e[`is-default-network`],is_deleted:e[`is-deleted`]};if(e.dryRun){d({command:`cf zero-trust networks virtual-networks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/teamnet/virtual_networks`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.networks.virtualNetworks.list({account_id:a,...n})),{successLabel:`Loaded`})}},Lh={command:`virtual-networks`,describe:`Operations for networks.virtual-networks`,builder:e=>e.command(Oh).command(Ah).command(Mh).command(Ph).command(Ih).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Rh={command:`networks`,describe:`Operations for networks`,builder:e=>e.command(zm).command(oh).command(Eh).command(Lh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function zh(e){return e.option(`allow-authenticate-via-warp`,{type:`boolean`,description:`When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.`,default:!1}).option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`auto-redirect-to-identity`,{type:`boolean`,description:"When set to `true`, users skip the identity provider selection step during login.",default:!1}).option(`deny-unmatched-requests`,{type:`boolean`,description:"Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names` array."}).option(`deny-unmatched-requests-exempted-zone-names`,{type:`string`,array:!0,description:"Contains zone names to exempt from the `deny_unmatched_requests` feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request."}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`,default:!1}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:`Lists the MFA methods that users can authenticate with.`}).option(`mfa-config-amr-matching-session-duration`,{type:`string`,description:`Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).`}).option(`mfa-config-required-aaguids`,{type:`string`,description:`Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`mfa-piv-key-requirements-pin-policy`,{type:`string`,description:"Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN required), `once` (PIN required once per session), `always` (PIN required for each use).",choices:[`never`,`once`,`always`]}).option(`mfa-piv-key-requirements-require-fips-device`,{type:`boolean`,description:`Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.`}).option(`mfa-piv-key-requirements-ssh-key-size`,{type:`string`,array:!0,description:`Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.`}).option(`mfa-piv-key-requirements-ssh-key-type`,{type:`string`,array:!0,description:"Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and `rsa`."}).option(`mfa-piv-key-requirements-touch-policy`,{type:`string`,description:"Defines when physical touch is required to use the SSH key. Valid values: `never` (no touch required), `always` (touch required for each use), `cached` (touch cached for 15 seconds).",choices:[`never`,`always`,`cached`]}).option(`mfa-required-for-all-apps`,{type:`boolean`,description:`Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: 'allowed_authenticators' cannot only contain 'piv_key' if the organization has any non-infrastructure applications because PIV keys are only compatible with infrastructure apps.`,default:!1}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`warp-auth-session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Bh={command:`create`,describe:`Sets up a Zero Trust organization for your account.`,builder:zh,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust organizations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/organizations`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({allow_authenticate_via_warp:n[`allow-authenticate-via-warp`],auth_domain:p(n[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:n[`auto-redirect-to-identity`],deny_unmatched_requests:n[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:n[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:n[`is-ui-read-only`],login_design:{background_color:p(n[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(n[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(n[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(n[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(n[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:n[`mfa-config-allowed-authenticators`],amr_matching_session_duration:p(n[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:p(n[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:p(n[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:p(n[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:n[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:n[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:n[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:p(n[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:n[`mfa-required-for-all-apps`],name:p(n.name,`name`,`text`),session_duration:p(n[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:p(n[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(n[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_session_duration:p(n[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.organizations.create({...e,account_id:a})),{successLabel:`Created`});return}n[`auth-domain`]===void 0&&(n[`auth-domain`]=await e(`auth-domain`,`The unique subdomain assigned to your Zero Trust organization.`)),n.name===void 0&&(n.name=await e(`name`,`The name of your Zero Trust organization.`));let o=l({allow_authenticate_via_warp:n[`allow-authenticate-via-warp`],auth_domain:p(n[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:n[`auto-redirect-to-identity`],deny_unmatched_requests:n[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:n[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:n[`is-ui-read-only`],login_design:{background_color:p(n[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(n[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(n[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(n[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(n[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:n[`mfa-config-allowed-authenticators`],amr_matching_session_duration:p(n[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:p(n[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:p(n[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:p(n[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:n[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:n[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:n[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:p(n[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:n[`mfa-required-for-all-apps`],name:p(n.name,`name`,`text`),session_duration:p(n[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:p(n[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(n[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_session_duration:p(n[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.organizations.create({...o,account_id:a})),{successLabel:`Created`})}};function Vh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Hh={command:`get`,describe:`Returns the DoH settings for your Zero Trust organization.`,builder:Vh,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust organizations doh get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/organizations/doh`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.organizations.doh.get({account_id:i})),{successLabel:`Loaded`})}};function Uh(e){return e.option(`doh-jwt-duration`,{type:`string`,description:"The duration the DoH JWT is valid for. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.  Note that the maximum duration for this setting is the same as the key rotation period on the account. Default expiration is 24h"}).option(`service-token-id`,{type:`string`,description:`The uuid of the service token you want to use for DoH authentication`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wh={command:`update`,describe:`Updates the DoH settings for your Zero Trust organization.`,builder:Uh,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust organizations doh update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/organizations/doh`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({doh_jwt_duration:p(e[`doh-jwt-duration`],`doh-jwt-duration`,`text`),service_token_id:p(e[`service-token-id`],`service-token-id`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.organizations.doh.update({...t,account_id:i})),{successLabel:`Updated`});return}let a=l({doh_jwt_duration:p(e[`doh-jwt-duration`],`doh-jwt-duration`,`text`),service_token_id:p(e[`service-token-id`],`service-token-id`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.organizations.doh.update({...a,account_id:i})),{successLabel:`Updated`})}},Gh={command:`doh`,describe:`Operations for organizations.doh`,builder:e=>e.command(Hh).command(Wh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Kh(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qh={command:`list`,describe:`Returns the configuration for your Zero Trust organization.`,builder:Kh,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust organizations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/organizations`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.organizations.list({account_id:i})),{successLabel:`Loaded`})}};function Jh(e){return e.option(`devices`,{type:`boolean`,description:"When set to `true`, all devices associated with the user will be revoked."}).option(`email`,{type:`string`,description:`The email of the user to revoke.`}).option(`user-uid`,{type:`string`,description:`The uuid of the user to revoke.`}).option(`warp-session-reauth`,{type:`boolean`,description:"When set to `true`, the user will be required to re-authenticate to WARP for all Gateway policies that enforce a WARP client session duration. When `false`, the user’s WARP session will remain active"}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Yh={command:`revoke-users`,describe:`Revokes a user's access across all applications.`,builder:Jh,handler:async n=>{let a={devices:n.devices};if(n.dryRun){d({command:`cf zero-trust organizations revoke-users`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/organizations/revoke_user`,pathParams:{},query:a,bodyKind:`json`,body:n.body===void 0?l({email:p(n.email,`email`,`text`),user_uid:p(n[`user-uid`],`user-uid`,`text`),warp_session_reauth:n[`warp-session-reauth`]}):c(n.body)});return}let o=await s(n),m=n.local?h:await r(o);if(n.accountId=m,!await i({force:!!n.force,message:`This operation revokes all access tokens for a user destructively.`})){process.stderr.write(`Aborted.
+`);return}if(n.body){let e=c(n.body);new URLSearchParams(Object.entries(a).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString(),u(await f(`Deleting`,async()=>o.zeroTrust.organizations.revokeUsers({...e,account_id:m,...a})),{successLabel:`Deleted`});return}n.email===void 0&&(n.email=await e(`email`,`The email of the user to revoke.`));let g=l({email:p(n.email,`email`,`text`),user_uid:p(n[`user-uid`],`user-uid`,`text`),warp_session_reauth:n[`warp-session-reauth`]});new URLSearchParams(Object.entries(a).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString(),u(await f(`Deleting`,async()=>o.zeroTrust.organizations.revokeUsers({...g,account_id:m,...a})),{successLabel:`Deleted`})}};function Xh(e){return e.option(`allow-authenticate-via-warp`,{type:`boolean`,description:`When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.`}).option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`auto-redirect-to-identity`,{type:`boolean`,description:"When set to `true`, users skip the identity provider selection step during login."}).option(`custom-pages-forbidden`,{type:`string`,description:`The uid of the custom page to use when a user is denied access after failing a non-identity rule.`}).option(`custom-pages-identity-denied`,{type:`string`,description:`The uid of the custom page to use when a user is denied access.`}).option(`deny-unmatched-requests`,{type:`boolean`,description:"Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names` array."}).option(`deny-unmatched-requests-exempted-zone-names`,{type:`string`,array:!0,description:"Contains zone names to exempt from the `deny_unmatched_requests` feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request."}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:`Lists the MFA methods that users can authenticate with.`}).option(`mfa-config-amr-matching-session-duration`,{type:`string`,description:`Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).`}).option(`mfa-config-required-aaguids`,{type:`string`,description:`Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`mfa-piv-key-requirements-pin-policy`,{type:`string`,description:"Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN required), `once` (PIN required once per session), `always` (PIN required for each use).",choices:[`never`,`once`,`always`]}).option(`mfa-piv-key-requirements-require-fips-device`,{type:`boolean`,description:`Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.`}).option(`mfa-piv-key-requirements-ssh-key-size`,{type:`string`,array:!0,description:`Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.`}).option(`mfa-piv-key-requirements-ssh-key-type`,{type:`string`,array:!0,description:"Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and `rsa`."}).option(`mfa-piv-key-requirements-touch-policy`,{type:`string`,description:"Defines when physical touch is required to use the SSH key. Valid values: `never` (no touch required), `always` (touch required for each use), `cached` (touch cached for 15 seconds).",choices:[`never`,`always`,`cached`]}).option(`mfa-required-for-all-apps`,{type:`boolean`,description:`Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: 'allowed_authenticators' cannot only contain 'piv_key' if the organization has any non-infrastructure applications because PIV keys are only compatible with infrastructure apps.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`warp-auth-session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Zh={command:`update`,describe:`Updates the configuration for your Zero Trust organization.`,builder:Xh,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust organizations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/organizations`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({allow_authenticate_via_warp:e[`allow-authenticate-via-warp`],auth_domain:p(e[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:e[`auto-redirect-to-identity`],custom_pages:{forbidden:p(e[`custom-pages-forbidden`],`custom-pages-forbidden`,`text`),identity_denied:p(e[`custom-pages-identity-denied`],`custom-pages-identity-denied`,`text`)},deny_unmatched_requests:e[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:e[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:e[`is-ui-read-only`],login_design:{background_color:p(e[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(e[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(e[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(e[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(e[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:e[`mfa-config-allowed-authenticators`],amr_matching_session_duration:p(e[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:p(e[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:p(e[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:p(e[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:e[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:e[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:e[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:p(e[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:e[`mfa-required-for-all-apps`],name:p(e.name,`name`,`text`),session_duration:p(e[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:p(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_session_duration:p(e[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.organizations.update({...t,account_id:i})),{successLabel:`Updated`});return}let a=l({allow_authenticate_via_warp:e[`allow-authenticate-via-warp`],auth_domain:p(e[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:e[`auto-redirect-to-identity`],custom_pages:{forbidden:p(e[`custom-pages-forbidden`],`custom-pages-forbidden`,`text`),identity_denied:p(e[`custom-pages-identity-denied`],`custom-pages-identity-denied`,`text`)},deny_unmatched_requests:e[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:e[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:e[`is-ui-read-only`],login_design:{background_color:p(e[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(e[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(e[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(e[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(e[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:e[`mfa-config-allowed-authenticators`],amr_matching_session_duration:p(e[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:p(e[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:p(e[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:p(e[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:e[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:e[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:e[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:p(e[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:e[`mfa-required-for-all-apps`],name:p(e.name,`name`,`text`),session_duration:p(e[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:p(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_session_duration:p(e[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.organizations.update({...a,account_id:i})),{successLabel:`Updated`})}},Qh={command:`organizations`,describe:`Operations for organizations`,builder:e=>e.command(Bh).command(qh).command(Yh).command(Zh).command(Gh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $h(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const eg={command:`list`,describe:`Lists all DLP custom profiles in an account.`,builder:$h,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust profiles custom list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/profiles/custom`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.profiles.custom.list({account_id:i})),{successLabel:`Loaded`})}},tg={command:`custom`,describe:`Profiles operations`,builder:e=>e.command(eg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ng(e){return e.option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Predefined profiles can not be created. This endpoint will only update an existing predefined profiles settings.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const rg={command:`create`,describe:`Creates a DLP predefined profile. Only supports enabling/disabling entries.`,builder:ng,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust profiles predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/profiles/predefined`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({ai_context_enabled:n[`ai-context-enabled`],allowed_match_count:n[`allowed-match-count`],confidence_threshold:p(n[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:n[`context-awareness-enabled`],skip:{files:n[`context-awareness-skip-files`]}},ocr_enabled:n[`ocr-enabled`],profile_id:p(n[`profile-id`],`profile-id`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.profiles.predefined.create({...e,account_id:a})),{successLabel:`Created`});return}n[`profile-id`]===void 0&&(n[`profile-id`]=await e(`profile-id`,`The profile_id field`));let o=l({ai_context_enabled:n[`ai-context-enabled`],allowed_match_count:n[`allowed-match-count`],confidence_threshold:p(n[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:n[`context-awareness-enabled`],skip:{files:n[`context-awareness-skip-files`]}},ocr_enabled:n[`ocr-enabled`],profile_id:p(n[`profile-id`],`profile-id`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.profiles.predefined.create({...o,account_id:a})),{successLabel:`Created`})}};function ig(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ag={command:`get <profile-id>`,describe:`Fetches a predefined DLP profile by id.`,builder:ig,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust profiles predefined get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/profiles/predefined/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.profiles.predefined.get({account_id:i,profile_id:e[`profile-id`]})),{successLabel:`Loaded`})}};function og(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the predefined profile.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const sg={command:`update <profile-id>`,describe:`Updates a DLP predefined profile. Only supports enabling/disabling entries.`,builder:og,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust profiles predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/profiles/predefined/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:p(e[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:e[`context-awareness-enabled`],skip:{files:e[`context-awareness-skip-files`]}},ocr_enabled:e[`ocr-enabled`]}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.profiles.predefined.update({...t,account_id:i,profile_id:e[`profile-id`]})),{successLabel:`Updated`});return}let a=l({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:p(e[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:e[`context-awareness-enabled`],skip:{files:e[`context-awareness-skip-files`]}},ocr_enabled:e[`ocr-enabled`]});u(await f(`Updating`,async()=>n.zeroTrust.profiles.predefined.update({...a,account_id:i,profile_id:e[`profile-id`]})),{successLabel:`Updated`})}},cg={command:`predefined`,describe:`Profiles operations`,builder:e=>e.command(rg).command(ag).command(sg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},lg={command:`profiles`,describe:`Operations for profiles`,builder:e=>e.command(tg).command(cg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ug(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dg={command:`get`,describe:`Retrieves configured risk score behaviors that define how user actions affect their overall risk score.`,builder:ug,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust risk-scoring behaviours get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zt_risk_scoring/behaviors`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.riskScoring.behaviours.get({account_id:i})),{successLabel:`Loaded`})}};function fg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Behaviors.`})}const pg={command:`update`,describe:`Updates risk score behavior configurations, defining weights and thresholds for risk calculation.`,builder:fg,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust risk-scoring behaviours update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zt_risk_scoring/behaviors`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.riskScoring.behaviours.update({body:t,account_id:i})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},mg={command:`behaviours`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(dg).command(pg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function hg(e){return e.positional(`user-id`,{type:`string`,description:`User ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gg={command:`get <user-id>`,describe:`Retrieves the detailed risk score breakdown for a specific user, including contributing factors.`,builder:hg,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust risk-scoring get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zt_risk_scoring/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.riskScoring.get({account_id:i,user_id:e[`user-id`]})),{successLabel:`Loaded`})}};function _g(e){return e.option(`integration-type`,{type:`string`,description:`The integration_type field`,choices:[`Okta`]}).option(`reference-id`,{type:`string`,description:`A reference id that can be supplied by the client. Currently this should be set to the Access-Okta IDP ID (a UUIDv4).
+https://developers.cloudflare.com/api/operations/access-identity-providers-get-an-access-identity-provider`}).option(`tenant-url`,{type:`string`,description:`The base url of the tenant, e.g. "https://tenant.okta.com".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const vg={command:`create`,describe:`Creates a new Zero Trust risk score integration, connecting external risk signals to Cloudflare's risk scoring system.`,builder:_g,handler:async i=>{if(i.dryRun){d({command:`cf zero-trust risk-scoring integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zt_risk_scoring/integrations`,pathParams:{},bodyKind:`json`,body:i.body===void 0?l({integration_type:p(i[`integration-type`],`integration-type`,`text`),reference_id:p(i[`reference-id`],`reference-id`,`text`),tenant_url:p(i[`tenant-url`],`tenant-url`,`text`)}):c(i.body)});return}let a=await s(i),o=i.local?h:await r(a);if(i.accountId=o,i.body){let e=c(i.body);u(await f(`Creating`,async()=>a.zeroTrust.riskScoring.integrations.create({...e,account_id:o})),{successLabel:`Created`});return}i[`integration-type`]===void 0&&(i[`integration-type`]=await n(`integration-type`,`The integration_type field`,[`Okta`])),i[`tenant-url`]===void 0&&(i[`tenant-url`]=await e(`tenant-url`,`The base url of the tenant, e.g. "https://tenant.okta.com".`));let m=l({integration_type:p(i[`integration-type`],`integration-type`,`text`),reference_id:p(i[`reference-id`],`reference-id`,`text`),tenant_url:p(i[`tenant-url`],`tenant-url`,`text`)});u(await f(`Creating`,async()=>a.zeroTrust.riskScoring.integrations.create({...m,account_id:o})),{successLabel:`Created`})}};function yg(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const bg={command:`delete <integration-id>`,describe:`Removes a Zero Trust risk score integration, disconnecting the external risk signal source.`,builder:yg,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust risk-scoring integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zt_risk_scoring/integrations/${e[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(e[`integration-id`]))}`,pathParams:{"integration-id":String(e[`integration-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.riskScoring.integrations.delete({account_id:a,integration_id:e[`integration-id`]})),{successLabel:`Deleted`})}};function xg(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sg={command:`get <integration-id>`,describe:`Gets a Zero Trust risk score integration by ID.`,builder:xg,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust risk-scoring integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zt_risk_scoring/integrations/${e[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(e[`integration-id`]))}`,pathParams:{"integration-id":String(e[`integration-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.riskScoring.integrations.get({account_id:i,integration_id:e[`integration-id`]})),{successLabel:`Loaded`})}};function Cg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wg={command:`list`,describe:`Lists all configured Zero Trust risk score integrations for the account.`,builder:Cg,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust risk-scoring integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zt_risk_scoring/integrations`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.riskScoring.integrations.list({account_id:i})),{successLabel:`Loaded`})}};function Tg(e){return e.positional(`reference-id`,{type:`string`,description:`Reference ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Eg={command:`get <reference-id>`,describe:`Retrieves a Zero Trust risk score integration using its external reference ID.`,builder:Tg,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust risk-scoring integrations references get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zt_risk_scoring/integrations/reference_id/${e[`reference-id`]==null?`<reference-id>`:encodeURIComponent(String(e[`reference-id`]))}`,pathParams:{"reference-id":String(e[`reference-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.riskScoring.integrations.references.get({account_id:i,reference_id:e[`reference-id`]})),{successLabel:`Loaded`})}},Dg={command:`references`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(Eg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Og(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`active`,{type:`boolean`,description:`Whether this integration is enabled. If disabled, no risk changes will be exported to the third-party.`}).option(`reference-id`,{type:`string`,description:`A reference id that can be supplied by the client. Currently this should be set to the Access-Okta IDP ID (a UUIDv4).
+https://developers.cloudflare.com/api/operations/access-identity-providers-get-an-access-identity-provider`}).option(`tenant-url`,{type:`string`,description:`The base url of the tenant, e.g. "https://tenant.okta.com".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const kg={command:`update <integration-id>`,describe:`Overwrite the reference_id, tenant_url, and active values with the ones provided.`,builder:Og,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust risk-scoring integrations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zt_risk_scoring/integrations/${n[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(n[`integration-id`]))}`,pathParams:{"integration-id":String(n[`integration-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({active:n.active,reference_id:p(n[`reference-id`],`reference-id`,`text`),tenant_url:p(n[`tenant-url`],`tenant-url`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Updating`,async()=>i.zeroTrust.riskScoring.integrations.update({...e,account_id:a,integration_id:n[`integration-id`]})),{successLabel:`Updated`});return}if(n.active===void 0)throw Error(`--active is required (or pass --body with this field set).`);n[`tenant-url`]===void 0&&(n[`tenant-url`]=await e(`tenant-url`,`The base url of the tenant, e.g. "https://tenant.okta.com".`));let o=l({active:n.active,reference_id:p(n[`reference-id`],`reference-id`,`text`),tenant_url:p(n[`tenant-url`],`tenant-url`,`text`)});u(await f(`Updating`,async()=>i.zeroTrust.riskScoring.integrations.update({...o,account_id:a,integration_id:n[`integration-id`]})),{successLabel:`Updated`})}},Ag={command:`integrations`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(vg).command(bg).command(Sg).command(wg).command(kg).command(Dg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function jg(e){return e.positional(`user-id`,{type:`string`,description:`User ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Mg={command:`reset <user-id>`,describe:`Resets risk scores for specified users, clearing their accumulated risk history.`,builder:jg,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust risk-scoring reset`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zt_risk_scoring/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}/reset`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force,message:`This operation wipes risk-scoring history.`})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.riskScoring.reset({account_id:a,user_id:e[`user-id`]})),{successLabel:`Deleted`})}};function Ng(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pg={command:`get`,describe:`Gets an aggregate summary of risk scores across the account, including distribution and trends.`,builder:Ng,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust risk-scoring summary get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/zt_risk_scoring/summary`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.riskScoring.summary.get({account_id:i})),{successLabel:`Loaded`})}},Fg={command:`summary`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(Pg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ig={command:`risk-scoring`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(gg).command(Mg).command(mg).command(Ag).command(Fg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Lg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Rg={command:`edit`,describe:"Removes a user from a Zero Trust seat when both `access_seat` and `gateway_seat` are set to false.",builder:Lg,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust seats edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/seats`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.seats.edit({body:t,account_id:i})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},zg={command:`seats`,describe:`Operations for seats`,builder:e=>e.command(Rg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bg(e){return e.option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.",default:1}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).",default:`8760h`}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Vg={command:`create`,describe:`Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to create a new service token.`,builder:Bg,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust service-tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/service_tokens`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({client_secret_version:t[`client-secret-version`],duration:p(t.duration,`duration`,`text`),name:p(t.name,`name`,`text`),previous_client_secret_expires_at:p(t[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):c(t.body)});return}let n=await s(t),r=await a({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.serviceTokens.create({...e,zone_id:r})),{successLabel:`Created`});return}t.name===void 0&&(t.name=await e(`name`,`The name of the service token.`));let i=l({client_secret_version:t[`client-secret-version`],duration:p(t.duration,`duration`,`text`),name:p(t.name,`name`,`text`),previous_client_secret_expires_at:p(t[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.serviceTokens.create({...i,zone_id:r})),{successLabel:`Created`})}};function Hg(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ug={command:`delete <service-token-id>`,describe:`Deletes a service token.`,builder:Hg,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust service-tokens delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>t.zeroTrust.serviceTokens.delete({zone_id:n,service_token_id:e[`service-token-id`]})),{successLabel:`Deleted`})}};function Wg(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gg={command:`get <service-token-id>`,describe:`Fetches a single service token.`,builder:Wg,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust service-tokens get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.serviceTokens.get({zone_id:n,service_token_id:e[`service-token-id`]})),{successLabel:`Loaded`})}};function Kg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qg={command:`list`,describe:`Lists all service tokens.`,builder:Kg,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust service-tokens list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.serviceTokens.list({zone_id:n})),{successLabel:`Loaded`})}};function Jg(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`."}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h)."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Yg={command:`update <service-token-id>`,describe:`Updates a configured service token.`,builder:Jg,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust service-tokens update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({client_secret_version:e[`client-secret-version`],duration:p(e.duration,`duration`,`text`),name:p(e.name,`name`,`text`),previous_client_secret_expires_at:p(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):c(e.body)});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.serviceTokens.update({...r,zone_id:n,service_token_id:e[`service-token-id`]})),{successLabel:`Updated`});return}let r=l({client_secret_version:e[`client-secret-version`],duration:p(e.duration,`duration`,`text`),name:p(e.name,`name`,`text`),previous_client_secret_expires_at:p(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});u(await f(`Updating`,async()=>t.zeroTrust.serviceTokens.update({...r,zone_id:n,service_token_id:e[`service-token-id`]})),{successLabel:`Updated`})}},Xg={command:`service-tokens`,describe:`Operations for service-tokens`,builder:e=>e.command(Vg).command(Ug).command(Gg).command(qg).command(Yg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Zg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Qg={command:`delete`,describe:`Deletes account-level DLP settings and returns the initial values.`,builder:Zg,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust settings delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.settings.delete({account_id:a})),{successLabel:`Deleted`})}};function $g(e){return e.option(`ai-context-analysis`,{type:`boolean`,description:`Whether AI context analysis is enabled at the account level.`}).option(`ocr`,{type:`boolean`,description:`Whether OCR is enabled at the account level.`}).option(`payload-logging-public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
 
 - Set to a non-empty base64 string to enable payload logging with the given key.
 - Set to an empty string to disable payload logging.
-- Omit or set to null to leave unchanged (PATCH) or reset to disabled (PUT).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`DLP settings fields to update.`})}const Yg={command:`edit`,describe:`Missing fields keep their existing values.`,builder:Jg,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({ai_context_analysis:t[`ai-context-analysis`],ocr:t.ocr,payload_logging:{public_key:p(t[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.settings.edit({body:e,account_id:r})),{successLabel:`Updated`});return}let i=l({ai_context_analysis:t[`ai-context-analysis`],ocr:t.ocr,payload_logging:{public_key:p(t[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}});u(await f(`Updating`,async()=>n.zeroTrust.settings.edit({body:i,account_id:r})),{successLabel:`Updated`})}};function Xg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zg={command:`get`,describe:`Gets the account-level DLP settings.`,builder:Xg,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.settings.get({account_id:r})),{successLabel:`Loaded`})}};function Qg(e){return e.option(`ai-context-analysis`,{type:`boolean`,description:`Whether AI context analysis is enabled at the account level.`}).option(`ocr`,{type:`boolean`,description:`Whether OCR is enabled at the account level.`}).option(`payload-logging-public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
+- Omit or set to null to leave unchanged (PATCH) or reset to disabled (PUT).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`DLP settings fields to update.`})}const e_={command:`edit`,describe:`Missing fields keep their existing values.`,builder:$g,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({ai_context_analysis:e[`ai-context-analysis`],ocr:e.ocr,payload_logging:{public_key:p(e[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.settings.edit({body:t,account_id:i})),{successLabel:`Updated`});return}let a=l({ai_context_analysis:e[`ai-context-analysis`],ocr:e.ocr,payload_logging:{public_key:p(e[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}});u(await f(`Updating`,async()=>n.zeroTrust.settings.edit({body:a,account_id:i})),{successLabel:`Updated`})}};function t_(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const n_={command:`get`,describe:`Gets the account-level DLP settings.`,builder:t_,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.settings.get({account_id:i})),{successLabel:`Loaded`})}};function r_(e){return e.option(`ai-context-analysis`,{type:`boolean`,description:`Whether AI context analysis is enabled at the account level.`}).option(`ocr`,{type:`boolean`,description:`Whether OCR is enabled at the account level.`}).option(`payload-logging-public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
 
 - Set to a non-empty base64 string to enable payload logging with the given key.
 - Set to an empty string to disable payload logging.
-- Omit or set to null to leave unchanged (PATCH) or reset to disabled (PUT).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`New DLP settings.`})}const $g={command:`update`,describe:`Missing fields are reset to initial (unconfigured) values.`,builder:Qg,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`json`,body:t.body===void 0?l({ai_context_analysis:t[`ai-context-analysis`],ocr:t.ocr,payload_logging:{public_key:p(t[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.settings.update({body:e,account_id:r})),{successLabel:`Updated`});return}let i=l({ai_context_analysis:t[`ai-context-analysis`],ocr:t.ocr,payload_logging:{public_key:p(t[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}});u(await f(`Updating`,async()=>n.zeroTrust.settings.update({body:i,account_id:r})),{successLabel:`Updated`})}},e_={command:`settings`,describe:`Settings operations`,builder:e=>e.command(qg).command(Yg).command(Zg).command($g).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function t_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const n_={command:`get <tunnel-id>`,describe:`Gets the configuration for a remotely-managed tunnel`,builder:t_,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust tunnels cloudflared configurations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/cfd_tunnel/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}/configurations`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.cloudflared.configurations.get({account_id:r,tunnel_id:t[`tunnel-id`]})),{successLabel:`Loaded`})}};function r_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`config-origin-request-access-aud-tag`,{type:`string`,array:!0,description:`Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.`}).option(`config-origin-request-access-required`,{type:`boolean`,description:`Deny traffic that has not fulfilled Access authorization.`}).option(`config-origin-request-access-team-name`,{type:`string`,description:`The config.originRequest.access.teamName field`}).option(`config-origin-request-ca-pool`,{type:`string`,description:`Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.`}).option(`config-origin-request-connect-timeout`,{type:`number`,description:`Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.`}).option(`config-origin-request-disable-chunked-encoding`,{type:`boolean`,description:`Disables chunked transfer encoding. Useful if you are running a WSGI server.`}).option(`config-origin-request-http2origin`,{type:`boolean`,description:`Attempt to connect to origin using HTTP2. Origin must be configured as https.`}).option(`config-origin-request-http-host-header`,{type:`string`,description:`Sets the HTTP Host header on requests sent to the local service.`}).option(`config-origin-request-keep-alive-connections`,{type:`number`,description:`Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.`}).option(`config-origin-request-keep-alive-timeout`,{type:`number`,description:`Timeout after which an idle keepalive connection can be discarded.`}).option(`config-origin-request-match-snito-host`,{type:`boolean`,description:`Auto configure the Hostname on the origin server certificate.`}).option(`config-origin-request-no-happy-eyeballs`,{type:`boolean`,description:`Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.`}).option(`config-origin-request-no-tlsverify`,{type:`boolean`,description:`Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.`}).option(`config-origin-request-origin-server-name`,{type:`string`,description:`Hostname that cloudflared should expect from your origin server certificate.`}).option(`config-origin-request-proxy-type`,{type:`string`,description:`cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and "socks" for a SOCKS5 proxy.
-`}).option(`config-origin-request-tcp-keep-alive`,{type:`number`,description:`The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.`}).option(`config-origin-request-tls-timeout`,{type:`number`,description:`Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`config-origin-request-access-aud-tag`,`config-origin-request-access-required`,`config-origin-request-access-team-name`,`config-origin-request-ca-pool`,`config-origin-request-connect-timeout`,`config-origin-request-disable-chunked-encoding`,`config-origin-request-http2origin`,`config-origin-request-http-host-header`,`config-origin-request-keep-alive-connections`,`config-origin-request-keep-alive-timeout`,`config-origin-request-match-snito-host`,`config-origin-request-no-happy-eyeballs`,`config-origin-request-no-tlsverify`,`config-origin-request-origin-server-name`,`config-origin-request-proxy-type`,`config-origin-request-tcp-keep-alive`,`config-origin-request-tls-timeout`].some(t=>e[t]!==void 0)){let t=[`config-origin-request-access-aud-tag`,`config-origin-request-access-team-name`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --config-* flag is set`)}return!0})}const i_={command:`update <tunnel-id>`,describe:`Adds or updates the configuration for a remotely-managed tunnel.`,builder:r_,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust tunnels cloudflared configurations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/cfd_tunnel/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}/configurations`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({config:{originRequest:{access:{audTag:t[`config-origin-request-access-aud-tag`],required:t[`config-origin-request-access-required`],teamName:p(t[`config-origin-request-access-team-name`],`config-origin-request-access-team-name`,`text`)},caPool:p(t[`config-origin-request-ca-pool`],`config-origin-request-ca-pool`,`text`),connectTimeout:t[`config-origin-request-connect-timeout`],disableChunkedEncoding:t[`config-origin-request-disable-chunked-encoding`],http2Origin:t[`config-origin-request-http2origin`],httpHostHeader:p(t[`config-origin-request-http-host-header`],`config-origin-request-http-host-header`,`text`),keepAliveConnections:t[`config-origin-request-keep-alive-connections`],keepAliveTimeout:t[`config-origin-request-keep-alive-timeout`],matchSNItoHost:t[`config-origin-request-match-snito-host`],noHappyEyeballs:t[`config-origin-request-no-happy-eyeballs`],noTLSVerify:t[`config-origin-request-no-tlsverify`],originServerName:p(t[`config-origin-request-origin-server-name`],`config-origin-request-origin-server-name`,`text`),proxyType:p(t[`config-origin-request-proxy-type`],`config-origin-request-proxy-type`,`text`),tcpKeepAlive:t[`config-origin-request-tcp-keep-alive`],tlsTimeout:t[`config-origin-request-tls-timeout`]}}}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.tunnels.cloudflared.configurations.update({...e,account_id:r,tunnel_id:t[`tunnel-id`]})),{successLabel:`Updated`});return}let i=l({config:{originRequest:{access:{audTag:t[`config-origin-request-access-aud-tag`],required:t[`config-origin-request-access-required`],teamName:p(t[`config-origin-request-access-team-name`],`config-origin-request-access-team-name`,`text`)},caPool:p(t[`config-origin-request-ca-pool`],`config-origin-request-ca-pool`,`text`),connectTimeout:t[`config-origin-request-connect-timeout`],disableChunkedEncoding:t[`config-origin-request-disable-chunked-encoding`],http2Origin:t[`config-origin-request-http2origin`],httpHostHeader:p(t[`config-origin-request-http-host-header`],`config-origin-request-http-host-header`,`text`),keepAliveConnections:t[`config-origin-request-keep-alive-connections`],keepAliveTimeout:t[`config-origin-request-keep-alive-timeout`],matchSNItoHost:t[`config-origin-request-match-snito-host`],noHappyEyeballs:t[`config-origin-request-no-happy-eyeballs`],noTLSVerify:t[`config-origin-request-no-tlsverify`],originServerName:p(t[`config-origin-request-origin-server-name`],`config-origin-request-origin-server-name`,`text`),proxyType:p(t[`config-origin-request-proxy-type`],`config-origin-request-proxy-type`,`text`),tcpKeepAlive:t[`config-origin-request-tcp-keep-alive`],tlsTimeout:t[`config-origin-request-tls-timeout`]}}});u(await f(`Updating`,async()=>n.zeroTrust.tunnels.cloudflared.configurations.update({...i,account_id:r,tunnel_id:t[`tunnel-id`]})),{successLabel:`Updated`})}},a_={command:`configurations`,describe:`Operations for tunnels.cloudflared.configurations`,builder:e=>e.command(n_).command(i_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function o_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`client-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const s_={command:`delete <tunnel-id>`,describe:`Removes a connection (aka Cloudflare Tunnel Connector) from a Cloudflare Tunnel independently of its current state. If no connector id (client_id) is provided all connectors will be removed. We recommend running this command after rotating tokens.`,builder:o_,handler:async t=>{let n={client_id:t[`client-id`]};if(t.dryRun){d({command:`cf zero-trust tunnels cloudflared connections delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/cfd_tunnel/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}/connections`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``)},query:n,bodyKind:`none`});return}let r=await s(t),o=t.local?h:await a(r);if(t.accountId=o,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>r.zeroTrust.tunnels.cloudflared.connections.delete({account_id:o,tunnel_id:t[`tunnel-id`],...n})),{successLabel:`Deleted`})}};function c_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const l_={command:`get <tunnel-id>`,describe:`Fetches connection details for a Cloudflare Tunnel.`,builder:c_,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust tunnels cloudflared connections get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/cfd_tunnel/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}/connections`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.cloudflared.connections.get({account_id:r,tunnel_id:t[`tunnel-id`]})),{successLabel:`Loaded`})}},u_={command:`connections`,describe:`Operations for tunnels.cloudflared.connections`,builder:e=>e.command(s_).command(l_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function d_(e){return e.positional(`connector-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`,demandOption:!0}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const f_={command:`get <connector-id>`,describe:`Fetches connector and connection details for a Cloudflare Tunnel.`,builder:d_,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust tunnels cloudflared connectors get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/cfd_tunnel/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}/connectors/${t[`connector-id`]==null?`<connector-id>`:encodeURIComponent(String(t[`connector-id`]))}`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``),"connector-id":String(t[`connector-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.cloudflared.connectors.get({account_id:r,tunnel_id:t[`tunnel-id`],connector_id:t[`connector-id`]})),{successLabel:`Loaded`})}},p_={command:`connectors`,describe:`Operations for tunnels.cloudflared.connectors`,builder:e=>e.command(f_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function m_(e){return e.option(`config-src`,{type:`string`,description:"Indicates if this is a locally or remotely configured tunnel. If `local`, manage the tunnel using a YAML file on the origin machine. If `cloudflare`, manage the tunnel on the Zero Trust dashboard.",choices:[`local`,`cloudflare`],default:`local`}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`tunnel-secret`,{type:`string`,description:`Sets the password required to run a locally-managed tunnel. Must be at least 32 bytes and encoded as a base64 string.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const h_={command:`create`,describe:`Creates a new Cloudflare Tunnel in an account.`,builder:m_,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust tunnels cloudflared create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/cfd_tunnel`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({config_src:p(n[`config-src`],`config-src`,`text`),name:p(n.name,`name`,`text`),tunnel_secret:p(n[`tunnel-secret`],`tunnel-secret`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.tunnels.cloudflared.create({...e,account_id:i})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await t(`name`,`A user-friendly name for a tunnel.`));let o=l({config_src:p(n[`config-src`],`config-src`,`text`),name:p(n.name,`name`,`text`),tunnel_secret:p(n[`tunnel-secret`],`tunnel-secret`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.tunnels.cloudflared.create({...o,account_id:i})),{successLabel:`Created`})}};function g_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const __={command:`delete <tunnel-id>`,describe:`Deletes a Cloudflare Tunnel from an account.`,builder:g_,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust tunnels cloudflared delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/cfd_tunnel/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.tunnels.cloudflared.delete({account_id:r,tunnel_id:t[`tunnel-id`]})),{successLabel:`Deleted`})}};function v_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`tunnel-secret`,{type:`string`,description:`Sets the password required to run a locally-managed tunnel. Must be at least 32 bytes and encoded as a base64 string.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const y_={command:`edit <tunnel-id>`,describe:`Updates an existing Cloudflare Tunnel.`,builder:v_,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust tunnels cloudflared edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/cfd_tunnel/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({name:p(t.name,`name`,`text`),tunnel_secret:p(t[`tunnel-secret`],`tunnel-secret`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.tunnels.cloudflared.edit({...e,account_id:r,tunnel_id:t[`tunnel-id`]})),{successLabel:`Updated`});return}let i=l({name:p(t.name,`name`,`text`),tunnel_secret:p(t[`tunnel-secret`],`tunnel-secret`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.tunnels.cloudflared.edit({...i,account_id:r,tunnel_id:t[`tunnel-id`]})),{successLabel:`Updated`})}};function b_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const x_={command:`get <tunnel-id>`,describe:`Fetches a single Cloudflare Tunnel.`,builder:b_,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust tunnels cloudflared get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/cfd_tunnel/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.cloudflared.get({account_id:r,tunnel_id:t[`tunnel-id`]})),{successLabel:`Loaded`})}};function S_(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included."}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`uuid`,{type:`string`,description:`UUID of the tunnel.`}).option(`was-active-at`,{type:`string`,description:`Was active at`}).option(`was-inactive-at`,{type:`string`,description:`Was inactive at`}).option(`include-prefix`,{type:`string`,description:`Include prefix`}).option(`exclude-prefix`,{type:`string`,description:`Exclude prefix`}).option(`status`,{type:`string`,description:"The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).",choices:[`inactive`,`degraded`,`healthy`,`down`]}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const C_={command:`list`,describe:`Lists and filters Cloudflare Tunnels in an account.`,builder:g(S_),handler:async t=>{let n={name:t.name,is_deleted:t[`is-deleted`],existed_at:t[`existed-at`],uuid:t.uuid,was_active_at:t[`was-active-at`],was_inactive_at:t[`was-inactive-at`],include_prefix:t[`include-prefix`],exclude_prefix:t[`exclude-prefix`],status:t.status,per_page:t[`per-page`],page:t.page};if(t.dryRun){d({command:`cf zero-trust tunnels cloudflared list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/cfd_tunnel`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.tunnels.cloudflared.list({account_id:i,...n})),{successLabel:`Loaded`})}};function w_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`resources`,{type:`string`,array:!0,description:`The resources field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const T_={command:`create <tunnel-id>`,describe:`Gets a management token used to access the management resources (i.e. Streaming Logs) of a tunnel.`,builder:w_,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust tunnels cloudflared management create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/cfd_tunnel/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}/management`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({resources:t.resources}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.tunnels.cloudflared.management.create({...e,account_id:r,tunnel_id:t[`tunnel-id`]})),{successLabel:`Created`});return}if(t.resources===void 0)throw Error(`--resources is required (or pass --body with this field set).`);let i=l({resources:t.resources});u(await f(`Creating`,async()=>n.zeroTrust.tunnels.cloudflared.management.create({...i,account_id:r,tunnel_id:t[`tunnel-id`]})),{successLabel:`Created`})}},E_={command:`management`,describe:`Operations for tunnels.cloudflared.management`,builder:e=>e.command(T_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function D_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const O_={command:`get <tunnel-id>`,describe:`Gets the token used to associate cloudflared with a specific tunnel.`,builder:D_,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust tunnels cloudflared token get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/cfd_tunnel/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}/token`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.cloudflared.token.get({account_id:r,tunnel_id:t[`tunnel-id`]})),{successLabel:`Loaded`})}},k_={command:`token`,describe:`Operations for tunnels.cloudflared.token`,builder:e=>e.command(O_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},A_={command:`cloudflared`,describe:`Operations for tunnels.cloudflared`,builder:e=>e.command(h_).command(__).command(y_).command(x_).command(C_).command(a_).command(u_).command(p_).command(E_).command(k_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function j_(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for the tunnel.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included."}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`uuid`,{type:`string`,description:`UUID of the tunnel.`}).option(`was-active-at`,{type:`string`,description:`Was active at`}).option(`was-inactive-at`,{type:`string`,description:`Was inactive at`}).option(`include-prefix`,{type:`string`,description:`Include prefix`}).option(`exclude-prefix`,{type:`string`,description:`Exclude prefix`}).option(`tun-types`,{type:`string`,description:`The types of tunnels to filter by, separated by commas.`}).option(`status`,{type:`string`,description:"The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).",choices:[`inactive`,`degraded`,`healthy`,`down`]}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const M_={command:`list`,describe:`Lists and filters all types of Tunnels in an account.`,builder:g(j_),handler:async t=>{let n={name:t.name,is_deleted:t[`is-deleted`],existed_at:t[`existed-at`],uuid:t.uuid,was_active_at:t[`was-active-at`],was_inactive_at:t[`was-inactive-at`],include_prefix:t[`include-prefix`],exclude_prefix:t[`exclude-prefix`],tun_types:t[`tun-types`],status:t.status,per_page:t[`per-page`],page:t.page};if(t.dryRun){d({command:`cf zero-trust tunnels list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/tunnels`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.tunnels.list({account_id:i,...n})),{successLabel:`Loaded`})}};function N_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const P_={command:`get <tunnel-id>`,describe:`Fetches connection details for a WARP Connector Tunnel.`,builder:N_,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust tunnels warp-connector connections get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/warp_connector/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}/connections`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.warpConnector.connections.get({account_id:r,tunnel_id:t[`tunnel-id`]})),{successLabel:`Loaded`})}},F_={command:`connections`,describe:`Operations for tunnels.warp-connector.connections`,builder:e=>e.command(P_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function I_(e){return e.positional(`connector-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`,demandOption:!0}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const L_={command:`get <connector-id>`,describe:`Fetches connector and connection details for a WARP Connector Tunnel.`,builder:I_,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust tunnels warp-connector connectors get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/warp_connector/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}/connectors/${t[`connector-id`]==null?`<connector-id>`:encodeURIComponent(String(t[`connector-id`]))}`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``),"connector-id":String(t[`connector-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.warpConnector.connectors.get({account_id:r,tunnel_id:t[`tunnel-id`],connector_id:t[`connector-id`]})),{successLabel:`Loaded`})}},R_={command:`connectors`,describe:`Operations for tunnels.warp-connector.connectors`,builder:e=>e.command(L_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function z_(e){return e.option(`ha`,{type:`boolean`,description:`Indicates that the tunnel will be created to be highly available. If omitted, defaults to false.`,default:!1}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const B_={command:`create`,describe:`Creates a new Warp Connector Tunnel in an account.`,builder:z_,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust tunnels warp-connector create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/warp_connector`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({ha:n.ha,name:p(n.name,`name`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Creating`,async()=>r.zeroTrust.tunnels.warpConnector.create({...e,account_id:i})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await t(`name`,`A user-friendly name for a tunnel.`));let o=l({ha:n.ha,name:p(n.name,`name`,`text`)});u(await f(`Creating`,async()=>r.zeroTrust.tunnels.warpConnector.create({...o,account_id:i})),{successLabel:`Created`})}};function V_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const H_={command:`delete <tunnel-id>`,describe:`Deletes a Warp Connector Tunnel from an account.`,builder:V_,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust tunnels warp-connector delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/warp_connector/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.tunnels.warpConnector.delete({account_id:r,tunnel_id:t[`tunnel-id`]})),{successLabel:`Deleted`})}};function U_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`tunnel-secret`,{type:`string`,description:`Sets the password required to run a locally-managed tunnel. Must be at least 32 bytes and encoded as a base64 string.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const W_={command:`edit <tunnel-id>`,describe:`Updates an existing Warp Connector Tunnel.`,builder:U_,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust tunnels warp-connector edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/warp_connector/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({name:p(t.name,`name`,`text`),tunnel_secret:p(t[`tunnel-secret`],`tunnel-secret`,`text`)}):c(t.body)});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,t.body){let e=c(t.body);u(await f(`Updating`,async()=>n.zeroTrust.tunnels.warpConnector.edit({...e,account_id:r,tunnel_id:t[`tunnel-id`]})),{successLabel:`Updated`});return}let i=l({name:p(t.name,`name`,`text`),tunnel_secret:p(t[`tunnel-secret`],`tunnel-secret`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.tunnels.warpConnector.edit({...i,account_id:r,tunnel_id:t[`tunnel-id`]})),{successLabel:`Updated`})}};function G_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`client-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const K_={command:`update <tunnel-id>`,describe:`Triggers a manual failover for a specific WARP Connector Tunnel, setting the specified client as the active connector. The tunnel must be configured for high availability (HA) and the client must be linked to the tunnel.`,builder:G_,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust tunnels warp-connector failover update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/warp_connector/${n[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(n[`tunnel-id`]))}/failover`,pathParams:{"tunnel-id":String(n[`tunnel-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({client_id:p(n[`client-id`],`client-id`,`text`)}):c(n.body)});return}let r=await s(n),i=n.local?h:await a(r);if(n.accountId=i,n.body){let e=c(n.body);u(await f(`Updating`,async()=>r.zeroTrust.tunnels.warpConnector.failover.update({...e,account_id:i,tunnel_id:n[`tunnel-id`]})),{successLabel:`Updated`});return}n[`client-id`]===void 0&&(n[`client-id`]=await t(`client-id`,`UUID of the Cloudflare Tunnel connector.`));let o=l({client_id:p(n[`client-id`],`client-id`,`text`)});u(await f(`Updating`,async()=>r.zeroTrust.tunnels.warpConnector.failover.update({...o,account_id:i,tunnel_id:n[`tunnel-id`]})),{successLabel:`Updated`})}},q_={command:`failover`,describe:`Operations for tunnels.warp-connector.failover`,builder:e=>e.command(K_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function J_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Y_={command:`get <tunnel-id>`,describe:`Fetches a single Warp Connector Tunnel.`,builder:J_,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust tunnels warp-connector get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/warp_connector/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.warpConnector.get({account_id:r,tunnel_id:t[`tunnel-id`]})),{successLabel:`Loaded`})}};function X_(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for the tunnel.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included."}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`uuid`,{type:`string`,description:`UUID of the tunnel.`}).option(`was-active-at`,{type:`string`,description:`Was active at`}).option(`was-inactive-at`,{type:`string`,description:`Was inactive at`}).option(`include-prefix`,{type:`string`,description:`Include prefix`}).option(`exclude-prefix`,{type:`string`,description:`Exclude prefix`}).option(`status`,{type:`string`,description:"The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).",choices:[`inactive`,`degraded`,`healthy`,`down`]}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Z_={command:`list`,describe:`Lists and filters Warp Connector Tunnels in an account.`,builder:g(X_),handler:async t=>{let n={name:t.name,is_deleted:t[`is-deleted`],existed_at:t[`existed-at`],uuid:t.uuid,was_active_at:t[`was-active-at`],was_inactive_at:t[`was-inactive-at`],include_prefix:t[`include-prefix`],exclude_prefix:t[`exclude-prefix`],status:t.status,per_page:t[`per-page`],page:t.page};if(t.dryRun){d({command:`cf zero-trust tunnels warp-connector list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/warp_connector`,pathParams:{},query:n,bodyKind:`none`});return}let r=await s(t),i=t.local?h:await a(r);t.accountId=i,u(await f(`Loading`,async()=>r.zeroTrust.tunnels.warpConnector.list({account_id:i,...n})),{successLabel:`Loaded`})}};function Q_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $_={command:`get <tunnel-id>`,describe:`Gets the token used to associate warp device with a specific Warp Connector tunnel.`,builder:Q_,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust tunnels warp-connector token get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/warp_connector/${t[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(t[`tunnel-id`]))}/token`,pathParams:{"tunnel-id":String(t[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);t.accountId=r,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.warpConnector.token.get({account_id:r,tunnel_id:t[`tunnel-id`]})),{successLabel:`Loaded`})}},ev={command:`token`,describe:`Operations for tunnels.warp-connector.token`,builder:e=>e.command($_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},tv={command:`warp-connector`,describe:`Operations for tunnels.warp-connector`,builder:e=>e.command(B_).command(H_).command(W_).command(Y_).command(Z_).command(F_).command(R_).command(q_).command(ev).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},nv={command:`tunnels`,describe:`Operations for tunnels`,builder:e=>e.command(M_).command(A_).command(tv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function rv(e){return e.positional(`authenticator-id`,{type:`string`,description:`The unique identifier for the MFA device.`,demandOption:!0}).option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const iv={command:`delete <authenticator-id>`,describe:`Deletes a specific MFA device for a user. This action is only available if MFA is turned on for the organization.`,builder:rv,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust users mfa authenticators delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${e()??`<account-id>`}/access/users/${t[`user-id`]==null?`<user-id>`:encodeURIComponent(String(t[`user-id`]))}/mfa_authenticators/${t[`authenticator-id`]==null?`<authenticator-id>`:encodeURIComponent(String(t[`authenticator-id`]))}`,pathParams:{"user-id":String(t[`user-id`]??``),"authenticator-id":String(t[`authenticator-id`]??``)},bodyKind:`none`});return}let n=await s(t),r=t.local?h:await a(n);if(t.accountId=r,!await i({force:!!t.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>n.zeroTrust.users.mfa.authenticators.delete({account_id:r,user_id:t[`user-id`],authenticator_id:t[`authenticator-id`]})),{successLabel:`Deleted`})}},av={command:`authenticators`,describe:`Users operations`,builder:e=>e.command(iv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ov={command:`mfa`,describe:`Operations for users.mfa`,builder:e=>e.command(av).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},sv={command:`users`,describe:`Operations for users`,builder:e=>e.command(ov).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cv(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const lv={command:`create`,describe:`Adds a new identity provider to Access.`,builder:cv,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust zone-identity-providers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Creating`,async()=>t.zeroTrust.zoneIdentityProviders.create({body:r,zone_id:n})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function uv(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const dv={command:`delete <identity-provider-id>`,describe:`Deletes an identity provider from Access.`,builder:uv,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust zone-identity-providers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i({force:!!e.force})){process.stderr.write(`Aborted.
-`);return}u(await f(`Deleting`,async()=>t.zeroTrust.zoneIdentityProviders.delete({zone_id:n,identity_provider_id:e[`identity-provider-id`]})),{successLabel:`Deleted`})}};function fv(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pv={command:`get <identity-provider-id>`,describe:`Fetches a configured identity provider.`,builder:fv,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust zone-identity-providers get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.zoneIdentityProviders.get({zone_id:n,identity_provider_id:e[`identity-provider-id`]})),{successLabel:`Loaded`})}};function mv(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const hv={command:`list`,describe:`Lists all configured identity providers.`,builder:mv,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust zone-identity-providers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.zoneIdentityProviders.list({zone_id:n})),{successLabel:`Loaded`})}};function gv(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _v={command:`update <identity-provider-id>`,describe:`Updates a configured identity provider.`,builder:gv,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust zone-identity-providers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.zoneIdentityProviders.update({body:r,zone_id:n,identity_provider_id:e[`identity-provider-id`]})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},vv={command:`zone-identity-providers`,describe:`Zone-scoped Access identity provider management`,builder:e=>e.command(lv).command(dv).command(pv).command(hv).command(_v).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function yv(e){return e.option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const bv={command:`create`,describe:`Sets up a Zero Trust organization for your account.`,builder:yv,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust zone-organizations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/organizations`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({auth_domain:p(e[`auth-domain`],`auth-domain`,`text`),is_ui_read_only:e[`is-ui-read-only`],login_design:{background_color:p(e[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(e[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(e[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(e[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(e[`login-design-text-color`],`login-design-text-color`,`text`)},name:p(e.name,`name`,`text`),ui_read_only_toggle_reason:p(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)}):c(e.body)});return}let n=await s(e),i=await r({zone:e.zone},n,{quiet:e.quiet});if(e.zoneId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.zoneOrganizations.create({...t,zone_id:i})),{successLabel:`Created`});return}e[`auth-domain`]===void 0&&(e[`auth-domain`]=await t(`auth-domain`,`The unique subdomain assigned to your Zero Trust organization.`)),e.name===void 0&&(e.name=await t(`name`,`The name of your Zero Trust organization.`));let a=l({auth_domain:p(e[`auth-domain`],`auth-domain`,`text`),is_ui_read_only:e[`is-ui-read-only`],login_design:{background_color:p(e[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(e[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(e[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(e[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(e[`login-design-text-color`],`login-design-text-color`,`text`)},name:p(e.name,`name`,`text`),ui_read_only_toggle_reason:p(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.zoneOrganizations.create({...a,zone_id:i})),{successLabel:`Created`})}};function xv(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sv={command:`get`,describe:`Returns the configuration for your Zero Trust organization.`,builder:xv,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust zone-organizations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/organizations`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.zoneOrganizations.get({zone_id:n})),{successLabel:`Loaded`})}};function Cv(e){return e.option(`email`,{type:`string`,description:`The email of the user to revoke.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const wv={command:`revoke-user-create`,describe:`Revokes a user's access across all applications.`,builder:Cv,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust zone-organizations revoke-user-create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/organizations/revoke_user`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({email:p(e.email,`email`,`text`)}):c(e.body)});return}let n=await s(e),a=await r({zone:e.zone},n,{quiet:e.quiet});if(e.zoneId=a,!await i({force:!!e.force,message:`This operation revokes all access tokens for a user, affecting their access to all applications within the zone.`})){process.stderr.write(`Aborted.
-`);return}if(e.body){let t=c(e.body);u(await f(`Deleting`,async()=>n.zeroTrust.zoneOrganizations.revokeUserCreate({...t,zone_id:a})),{successLabel:`Deleted`});return}e.email===void 0&&(e.email=await t(`email`,`The email of the user to revoke.`));let o=l({email:p(e.email,`email`,`text`)});u(await f(`Deleting`,async()=>n.zeroTrust.zoneOrganizations.revokeUserCreate({...o,zone_id:a})),{successLabel:`Deleted`})}};function Tv(e){return e.option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ev={command:`update`,describe:`Updates the configuration for your Zero Trust organization.`,builder:Tv,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust zone-organizations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/organizations`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({auth_domain:p(e[`auth-domain`],`auth-domain`,`text`),is_ui_read_only:e[`is-ui-read-only`],login_design:{background_color:p(e[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(e[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(e[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(e[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(e[`login-design-text-color`],`login-design-text-color`,`text`)},name:p(e.name,`name`,`text`),ui_read_only_toggle_reason:p(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)}):c(e.body)});return}let t=await s(e),n=await r({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.zoneOrganizations.update({...r,zone_id:n})),{successLabel:`Updated`});return}let i=l({auth_domain:p(e[`auth-domain`],`auth-domain`,`text`),is_ui_read_only:e[`is-ui-read-only`],login_design:{background_color:p(e[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(e[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(e[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(e[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(e[`login-design-text-color`],`login-design-text-color`,`text`)},name:p(e.name,`name`,`text`),ui_read_only_toggle_reason:p(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)});u(await f(`Updating`,async()=>t.zeroTrust.zoneOrganizations.update({...i,zone_id:n})),{successLabel:`Updated`})}},Dv={command:`zone-organizations`,describe:`Zone-scoped Zero Trust organization management`,builder:e=>e.command(bv).command(Sv).command(wv).command(Ev).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ov={command:`zero-trust`,describe:`Cloudflare's SASE platform — secure access, device posture, DLP, tunnels, gateway policies, and network segmentation`,builder:e=>e.command(Or).command(ki).command(Gi).command(Xi).command(ic).command(Ll).command(Md).command(Xd).command($p).command(um).command(Om).command(Nh).command(qh).command(ig).command(jg).command(Pg).command(Gg).command(e_).command(nv).command(sv).command(vv).command(Dv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{Ov as default};
+- Omit or set to null to leave unchanged (PATCH) or reset to disabled (PUT).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`New DLP settings.`})}const i_={command:`update`,describe:`Missing fields are reset to initial (unconfigured) values.`,builder:r_,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`json`,body:e.body===void 0?l({ai_context_analysis:e[`ai-context-analysis`],ocr:e.ocr,payload_logging:{public_key:p(e[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.settings.update({body:t,account_id:i})),{successLabel:`Updated`});return}let a=l({ai_context_analysis:e[`ai-context-analysis`],ocr:e.ocr,payload_logging:{public_key:p(e[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}});u(await f(`Updating`,async()=>n.zeroTrust.settings.update({body:a,account_id:i})),{successLabel:`Updated`})}},a_={command:`settings`,describe:`Settings operations`,builder:e=>e.command(Qg).command(e_).command(n_).command(i_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function o_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const s_={command:`get <tunnel-id>`,describe:`Gets the configuration for a remotely-managed tunnel`,builder:o_,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust tunnels cloudflared configurations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/configurations`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.cloudflared.configurations.get({account_id:i,tunnel_id:e[`tunnel-id`]})),{successLabel:`Loaded`})}};function c_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`config-origin-request-access-aud-tag`,{type:`string`,array:!0,description:`Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.`}).option(`config-origin-request-access-required`,{type:`boolean`,description:`Deny traffic that has not fulfilled Access authorization.`}).option(`config-origin-request-access-team-name`,{type:`string`,description:`The config.originRequest.access.teamName field`}).option(`config-origin-request-ca-pool`,{type:`string`,description:`Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.`}).option(`config-origin-request-connect-timeout`,{type:`number`,description:`Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.`}).option(`config-origin-request-disable-chunked-encoding`,{type:`boolean`,description:`Disables chunked transfer encoding. Useful if you are running a WSGI server.`}).option(`config-origin-request-http2origin`,{type:`boolean`,description:`Attempt to connect to origin using HTTP2. Origin must be configured as https.`}).option(`config-origin-request-http-host-header`,{type:`string`,description:`Sets the HTTP Host header on requests sent to the local service.`}).option(`config-origin-request-keep-alive-connections`,{type:`number`,description:`Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.`}).option(`config-origin-request-keep-alive-timeout`,{type:`number`,description:`Timeout after which an idle keepalive connection can be discarded.`}).option(`config-origin-request-match-snito-host`,{type:`boolean`,description:`Auto configure the Hostname on the origin server certificate.`}).option(`config-origin-request-no-happy-eyeballs`,{type:`boolean`,description:`Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.`}).option(`config-origin-request-no-tlsverify`,{type:`boolean`,description:`Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.`}).option(`config-origin-request-origin-server-name`,{type:`string`,description:`Hostname that cloudflared should expect from your origin server certificate.`}).option(`config-origin-request-proxy-type`,{type:`string`,description:`cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and "socks" for a SOCKS5 proxy.
+`}).option(`config-origin-request-tcp-keep-alive`,{type:`number`,description:`The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.`}).option(`config-origin-request-tls-timeout`,{type:`number`,description:`Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`config-origin-request-access-aud-tag`,`config-origin-request-access-required`,`config-origin-request-access-team-name`,`config-origin-request-ca-pool`,`config-origin-request-connect-timeout`,`config-origin-request-disable-chunked-encoding`,`config-origin-request-http2origin`,`config-origin-request-http-host-header`,`config-origin-request-keep-alive-connections`,`config-origin-request-keep-alive-timeout`,`config-origin-request-match-snito-host`,`config-origin-request-no-happy-eyeballs`,`config-origin-request-no-tlsverify`,`config-origin-request-origin-server-name`,`config-origin-request-proxy-type`,`config-origin-request-tcp-keep-alive`,`config-origin-request-tls-timeout`].some(t=>e[t]!==void 0)){let t=[`config-origin-request-access-aud-tag`,`config-origin-request-access-team-name`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --config-* flag is set`)}return!0})}const l_={command:`update <tunnel-id>`,describe:`Adds or updates the configuration for a remotely-managed tunnel.`,builder:c_,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust tunnels cloudflared configurations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/configurations`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({config:{originRequest:{access:{audTag:e[`config-origin-request-access-aud-tag`],required:e[`config-origin-request-access-required`],teamName:p(e[`config-origin-request-access-team-name`],`config-origin-request-access-team-name`,`text`)},caPool:p(e[`config-origin-request-ca-pool`],`config-origin-request-ca-pool`,`text`),connectTimeout:e[`config-origin-request-connect-timeout`],disableChunkedEncoding:e[`config-origin-request-disable-chunked-encoding`],http2Origin:e[`config-origin-request-http2origin`],httpHostHeader:p(e[`config-origin-request-http-host-header`],`config-origin-request-http-host-header`,`text`),keepAliveConnections:e[`config-origin-request-keep-alive-connections`],keepAliveTimeout:e[`config-origin-request-keep-alive-timeout`],matchSNItoHost:e[`config-origin-request-match-snito-host`],noHappyEyeballs:e[`config-origin-request-no-happy-eyeballs`],noTLSVerify:e[`config-origin-request-no-tlsverify`],originServerName:p(e[`config-origin-request-origin-server-name`],`config-origin-request-origin-server-name`,`text`),proxyType:p(e[`config-origin-request-proxy-type`],`config-origin-request-proxy-type`,`text`),tcpKeepAlive:e[`config-origin-request-tcp-keep-alive`],tlsTimeout:e[`config-origin-request-tls-timeout`]}}}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.tunnels.cloudflared.configurations.update({...t,account_id:i,tunnel_id:e[`tunnel-id`]})),{successLabel:`Updated`});return}let a=l({config:{originRequest:{access:{audTag:e[`config-origin-request-access-aud-tag`],required:e[`config-origin-request-access-required`],teamName:p(e[`config-origin-request-access-team-name`],`config-origin-request-access-team-name`,`text`)},caPool:p(e[`config-origin-request-ca-pool`],`config-origin-request-ca-pool`,`text`),connectTimeout:e[`config-origin-request-connect-timeout`],disableChunkedEncoding:e[`config-origin-request-disable-chunked-encoding`],http2Origin:e[`config-origin-request-http2origin`],httpHostHeader:p(e[`config-origin-request-http-host-header`],`config-origin-request-http-host-header`,`text`),keepAliveConnections:e[`config-origin-request-keep-alive-connections`],keepAliveTimeout:e[`config-origin-request-keep-alive-timeout`],matchSNItoHost:e[`config-origin-request-match-snito-host`],noHappyEyeballs:e[`config-origin-request-no-happy-eyeballs`],noTLSVerify:e[`config-origin-request-no-tlsverify`],originServerName:p(e[`config-origin-request-origin-server-name`],`config-origin-request-origin-server-name`,`text`),proxyType:p(e[`config-origin-request-proxy-type`],`config-origin-request-proxy-type`,`text`),tcpKeepAlive:e[`config-origin-request-tcp-keep-alive`],tlsTimeout:e[`config-origin-request-tls-timeout`]}}});u(await f(`Updating`,async()=>n.zeroTrust.tunnels.cloudflared.configurations.update({...a,account_id:i,tunnel_id:e[`tunnel-id`]})),{successLabel:`Updated`})}},u_={command:`configurations`,describe:`Operations for tunnels.cloudflared.configurations`,builder:e=>e.command(s_).command(l_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function d_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`client-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const f_={command:`delete <tunnel-id>`,describe:`Removes a connection (aka Cloudflare Tunnel Connector) from a Cloudflare Tunnel independently of its current state. If no connector id (client_id) is provided all connectors will be removed. We recommend running this command after rotating tokens.`,builder:d_,handler:async e=>{let n={client_id:e[`client-id`]};if(e.dryRun){d({command:`cf zero-trust tunnels cloudflared connections delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/connections`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},query:n,bodyKind:`none`});return}let a=await s(e),o=e.local?h:await r(a);if(e.accountId=o,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>a.zeroTrust.tunnels.cloudflared.connections.delete({account_id:o,tunnel_id:e[`tunnel-id`],...n})),{successLabel:`Deleted`})}};function p_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const m_={command:`get <tunnel-id>`,describe:`Fetches connection details for a Cloudflare Tunnel.`,builder:p_,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust tunnels cloudflared connections get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/connections`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.cloudflared.connections.get({account_id:i,tunnel_id:e[`tunnel-id`]})),{successLabel:`Loaded`})}},h_={command:`connections`,describe:`Operations for tunnels.cloudflared.connections`,builder:e=>e.command(f_).command(m_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function g_(e){return e.positional(`connector-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`,demandOption:!0}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const __={command:`get <connector-id>`,describe:`Fetches connector and connection details for a Cloudflare Tunnel.`,builder:g_,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust tunnels cloudflared connectors get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/connectors/${e[`connector-id`]==null?`<connector-id>`:encodeURIComponent(String(e[`connector-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``),"connector-id":String(e[`connector-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.cloudflared.connectors.get({account_id:i,tunnel_id:e[`tunnel-id`],connector_id:e[`connector-id`]})),{successLabel:`Loaded`})}},v_={command:`connectors`,describe:`Operations for tunnels.cloudflared.connectors`,builder:e=>e.command(__).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function y_(e){return e.option(`config-src`,{type:`string`,description:"Indicates if this is a locally or remotely configured tunnel. If `local`, manage the tunnel using a YAML file on the origin machine. If `cloudflare`, manage the tunnel on the Zero Trust dashboard.",choices:[`local`,`cloudflare`],default:`local`}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`tunnel-secret`,{type:`string`,description:`Sets the password required to run a locally-managed tunnel. Must be at least 32 bytes and encoded as a base64 string.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const b_={command:`create`,describe:`Creates a new Cloudflare Tunnel in an account.`,builder:y_,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust tunnels cloudflared create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/cfd_tunnel`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({config_src:p(n[`config-src`],`config-src`,`text`),name:p(n.name,`name`,`text`),tunnel_secret:p(n[`tunnel-secret`],`tunnel-secret`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.tunnels.cloudflared.create({...e,account_id:a})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await e(`name`,`A user-friendly name for a tunnel.`));let o=l({config_src:p(n[`config-src`],`config-src`,`text`),name:p(n.name,`name`,`text`),tunnel_secret:p(n[`tunnel-secret`],`tunnel-secret`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.tunnels.cloudflared.create({...o,account_id:a})),{successLabel:`Created`})}};function x_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const S_={command:`delete <tunnel-id>`,describe:`Deletes a Cloudflare Tunnel from an account.`,builder:x_,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust tunnels cloudflared delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.tunnels.cloudflared.delete({account_id:a,tunnel_id:e[`tunnel-id`]})),{successLabel:`Deleted`})}};function C_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`tunnel-secret`,{type:`string`,description:`Sets the password required to run a locally-managed tunnel. Must be at least 32 bytes and encoded as a base64 string.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const w_={command:`edit <tunnel-id>`,describe:`Updates an existing Cloudflare Tunnel.`,builder:C_,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust tunnels cloudflared edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({name:p(e.name,`name`,`text`),tunnel_secret:p(e[`tunnel-secret`],`tunnel-secret`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.tunnels.cloudflared.edit({...t,account_id:i,tunnel_id:e[`tunnel-id`]})),{successLabel:`Updated`});return}let a=l({name:p(e.name,`name`,`text`),tunnel_secret:p(e[`tunnel-secret`],`tunnel-secret`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.tunnels.cloudflared.edit({...a,account_id:i,tunnel_id:e[`tunnel-id`]})),{successLabel:`Updated`})}};function T_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const E_={command:`get <tunnel-id>`,describe:`Fetches a single Cloudflare Tunnel.`,builder:T_,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust tunnels cloudflared get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.cloudflared.get({account_id:i,tunnel_id:e[`tunnel-id`]})),{successLabel:`Loaded`})}};function D_(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included."}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`uuid`,{type:`string`,description:`UUID of the tunnel.`}).option(`was-active-at`,{type:`string`,description:`Was active at`}).option(`was-inactive-at`,{type:`string`,description:`Was inactive at`}).option(`include-prefix`,{type:`string`,description:`Include prefix`}).option(`exclude-prefix`,{type:`string`,description:`Exclude prefix`}).option(`status`,{type:`string`,description:"The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).",choices:[`inactive`,`degraded`,`healthy`,`down`]}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const O_={command:`list`,describe:`Lists and filters Cloudflare Tunnels in an account.`,builder:g(D_),handler:async e=>{let n={name:e.name,is_deleted:e[`is-deleted`],existed_at:e[`existed-at`],uuid:e.uuid,was_active_at:e[`was-active-at`],was_inactive_at:e[`was-inactive-at`],include_prefix:e[`include-prefix`],exclude_prefix:e[`exclude-prefix`],status:e.status,per_page:e[`per-page`],page:e.page};if(e.dryRun){d({command:`cf zero-trust tunnels cloudflared list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/cfd_tunnel`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.tunnels.cloudflared.list({account_id:a,...n})),{successLabel:`Loaded`})}};function k_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`resources`,{type:`string`,array:!0,description:`The resources field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const A_={command:`create <tunnel-id>`,describe:`Gets a management token used to access the management resources (i.e. Streaming Logs) of a tunnel.`,builder:k_,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust tunnels cloudflared management create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/management`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({resources:e.resources}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Creating`,async()=>n.zeroTrust.tunnels.cloudflared.management.create({...t,account_id:i,tunnel_id:e[`tunnel-id`]})),{successLabel:`Created`});return}if(e.resources===void 0)throw Error(`--resources is required (or pass --body with this field set).`);let a=l({resources:e.resources});u(await f(`Creating`,async()=>n.zeroTrust.tunnels.cloudflared.management.create({...a,account_id:i,tunnel_id:e[`tunnel-id`]})),{successLabel:`Created`})}},j_={command:`management`,describe:`Operations for tunnels.cloudflared.management`,builder:e=>e.command(A_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function M_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const N_={command:`get <tunnel-id>`,describe:`Gets the token used to associate cloudflared with a specific tunnel.`,builder:M_,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust tunnels cloudflared token get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/token`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.cloudflared.token.get({account_id:i,tunnel_id:e[`tunnel-id`]})),{successLabel:`Loaded`})}},P_={command:`token`,describe:`Operations for tunnels.cloudflared.token`,builder:e=>e.command(N_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},F_={command:`cloudflared`,describe:`Operations for tunnels.cloudflared`,builder:e=>e.command(b_).command(S_).command(w_).command(E_).command(O_).command(u_).command(h_).command(v_).command(j_).command(P_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function I_(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for the tunnel.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included."}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`uuid`,{type:`string`,description:`UUID of the tunnel.`}).option(`was-active-at`,{type:`string`,description:`Was active at`}).option(`was-inactive-at`,{type:`string`,description:`Was inactive at`}).option(`include-prefix`,{type:`string`,description:`Include prefix`}).option(`exclude-prefix`,{type:`string`,description:`Exclude prefix`}).option(`tun-types`,{type:`string`,description:`The types of tunnels to filter by, separated by commas.`}).option(`status`,{type:`string`,description:"The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).",choices:[`inactive`,`degraded`,`healthy`,`down`]}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const L_={command:`list`,describe:`Lists and filters all types of Tunnels in an account.`,builder:g(I_),handler:async e=>{let n={name:e.name,is_deleted:e[`is-deleted`],existed_at:e[`existed-at`],uuid:e.uuid,was_active_at:e[`was-active-at`],was_inactive_at:e[`was-inactive-at`],include_prefix:e[`include-prefix`],exclude_prefix:e[`exclude-prefix`],tun_types:e[`tun-types`],status:e.status,per_page:e[`per-page`],page:e.page};if(e.dryRun){d({command:`cf zero-trust tunnels list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/tunnels`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.tunnels.list({account_id:a,...n})),{successLabel:`Loaded`})}};function R_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const z_={command:`get <tunnel-id>`,describe:`Fetches connection details for a WARP Connector Tunnel.`,builder:R_,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust tunnels warp-connector connections get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/connections`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.warpConnector.connections.get({account_id:i,tunnel_id:e[`tunnel-id`]})),{successLabel:`Loaded`})}},B_={command:`connections`,describe:`Operations for tunnels.warp-connector.connections`,builder:e=>e.command(z_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function V_(e){return e.positional(`connector-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`,demandOption:!0}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const H_={command:`get <connector-id>`,describe:`Fetches connector and connection details for a WARP Connector Tunnel.`,builder:V_,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust tunnels warp-connector connectors get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/connectors/${e[`connector-id`]==null?`<connector-id>`:encodeURIComponent(String(e[`connector-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``),"connector-id":String(e[`connector-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.warpConnector.connectors.get({account_id:i,tunnel_id:e[`tunnel-id`],connector_id:e[`connector-id`]})),{successLabel:`Loaded`})}},U_={command:`connectors`,describe:`Operations for tunnels.warp-connector.connectors`,builder:e=>e.command(H_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function W_(e){return e.option(`ha`,{type:`boolean`,description:`Indicates that the tunnel will be created to be highly available. If omitted, defaults to false.`,default:!1}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const G_={command:`create`,describe:`Creates a new Warp Connector Tunnel in an account.`,builder:W_,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust tunnels warp-connector create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/warp_connector`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({ha:n.ha,name:p(n.name,`name`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Creating`,async()=>i.zeroTrust.tunnels.warpConnector.create({...e,account_id:a})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await e(`name`,`A user-friendly name for a tunnel.`));let o=l({ha:n.ha,name:p(n.name,`name`,`text`)});u(await f(`Creating`,async()=>i.zeroTrust.tunnels.warpConnector.create({...o,account_id:a})),{successLabel:`Created`})}};function K_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const q_={command:`delete <tunnel-id>`,describe:`Deletes a Warp Connector Tunnel from an account.`,builder:K_,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust tunnels warp-connector delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.tunnels.warpConnector.delete({account_id:a,tunnel_id:e[`tunnel-id`]})),{successLabel:`Deleted`})}};function J_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`tunnel-secret`,{type:`string`,description:`Sets the password required to run a locally-managed tunnel. Must be at least 32 bytes and encoded as a base64 string.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Y_={command:`edit <tunnel-id>`,describe:`Updates an existing Warp Connector Tunnel.`,builder:J_,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust tunnels warp-connector edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({name:p(e.name,`name`,`text`),tunnel_secret:p(e[`tunnel-secret`],`tunnel-secret`,`text`)}):c(e.body)});return}let n=await s(e),i=e.local?h:await r(n);if(e.accountId=i,e.body){let t=c(e.body);u(await f(`Updating`,async()=>n.zeroTrust.tunnels.warpConnector.edit({...t,account_id:i,tunnel_id:e[`tunnel-id`]})),{successLabel:`Updated`});return}let a=l({name:p(e.name,`name`,`text`),tunnel_secret:p(e[`tunnel-secret`],`tunnel-secret`,`text`)});u(await f(`Updating`,async()=>n.zeroTrust.tunnels.warpConnector.edit({...a,account_id:i,tunnel_id:e[`tunnel-id`]})),{successLabel:`Updated`})}};function X_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`client-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Z_={command:`update <tunnel-id>`,describe:`Triggers a manual failover for a specific WARP Connector Tunnel, setting the specified client as the active connector. The tunnel must be configured for high availability (HA) and the client must be linked to the tunnel.`,builder:X_,handler:async n=>{if(n.dryRun){d({command:`cf zero-trust tunnels warp-connector failover update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/warp_connector/${n[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(n[`tunnel-id`]))}/failover`,pathParams:{"tunnel-id":String(n[`tunnel-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({client_id:p(n[`client-id`],`client-id`,`text`)}):c(n.body)});return}let i=await s(n),a=n.local?h:await r(i);if(n.accountId=a,n.body){let e=c(n.body);u(await f(`Updating`,async()=>i.zeroTrust.tunnels.warpConnector.failover.update({...e,account_id:a,tunnel_id:n[`tunnel-id`]})),{successLabel:`Updated`});return}n[`client-id`]===void 0&&(n[`client-id`]=await e(`client-id`,`UUID of the Cloudflare Tunnel connector.`));let o=l({client_id:p(n[`client-id`],`client-id`,`text`)});u(await f(`Updating`,async()=>i.zeroTrust.tunnels.warpConnector.failover.update({...o,account_id:a,tunnel_id:n[`tunnel-id`]})),{successLabel:`Updated`})}},Q_={command:`failover`,describe:`Operations for tunnels.warp-connector.failover`,builder:e=>e.command(Z_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ev={command:`get <tunnel-id>`,describe:`Fetches a single Warp Connector Tunnel.`,builder:$_,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust tunnels warp-connector get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.warpConnector.get({account_id:i,tunnel_id:e[`tunnel-id`]})),{successLabel:`Loaded`})}};function tv(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for the tunnel.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included."}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`uuid`,{type:`string`,description:`UUID of the tunnel.`}).option(`was-active-at`,{type:`string`,description:`Was active at`}).option(`was-inactive-at`,{type:`string`,description:`Was inactive at`}).option(`include-prefix`,{type:`string`,description:`Include prefix`}).option(`exclude-prefix`,{type:`string`,description:`Exclude prefix`}).option(`status`,{type:`string`,description:"The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).",choices:[`inactive`,`degraded`,`healthy`,`down`]}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const nv={command:`list`,describe:`Lists and filters Warp Connector Tunnels in an account.`,builder:g(tv),handler:async e=>{let n={name:e.name,is_deleted:e[`is-deleted`],existed_at:e[`existed-at`],uuid:e.uuid,was_active_at:e[`was-active-at`],was_inactive_at:e[`was-inactive-at`],include_prefix:e[`include-prefix`],exclude_prefix:e[`exclude-prefix`],status:e.status,per_page:e[`per-page`],page:e.page};if(e.dryRun){d({command:`cf zero-trust tunnels warp-connector list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/warp_connector`,pathParams:{},query:n,bodyKind:`none`});return}let i=await s(e),a=e.local?h:await r(i);e.accountId=a,u(await f(`Loading`,async()=>i.zeroTrust.tunnels.warpConnector.list({account_id:a,...n})),{successLabel:`Loaded`})}};function rv(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const iv={command:`get <tunnel-id>`,describe:`Gets the token used to associate warp device with a specific Warp Connector tunnel.`,builder:rv,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust tunnels warp-connector token get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/token`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let n=await s(e),i=e.local?h:await r(n);e.accountId=i,u(await f(`Loading`,async()=>n.zeroTrust.tunnels.warpConnector.token.get({account_id:i,tunnel_id:e[`tunnel-id`]})),{successLabel:`Loaded`})}},av={command:`token`,describe:`Operations for tunnels.warp-connector.token`,builder:e=>e.command(iv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ov={command:`warp-connector`,describe:`Operations for tunnels.warp-connector`,builder:e=>e.command(G_).command(q_).command(Y_).command(ev).command(nv).command(B_).command(U_).command(Q_).command(av).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},sv={command:`tunnels`,describe:`Operations for tunnels`,builder:e=>e.command(L_).command(F_).command(ov).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cv(e){return e.positional(`authenticator-id`,{type:`string`,description:`The unique identifier for the MFA device.`,demandOption:!0}).option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const lv={command:`delete <authenticator-id>`,describe:`Deletes a specific MFA device for a user. This action is only available if MFA is turned on for the organization.`,builder:cv,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust users mfa authenticators delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}/mfa_authenticators/${e[`authenticator-id`]==null?`<authenticator-id>`:encodeURIComponent(String(e[`authenticator-id`]))}`,pathParams:{"user-id":String(e[`user-id`]??``),"authenticator-id":String(e[`authenticator-id`]??``)},bodyKind:`none`});return}let n=await s(e),a=e.local?h:await r(n);if(e.accountId=a,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>n.zeroTrust.users.mfa.authenticators.delete({account_id:a,user_id:e[`user-id`],authenticator_id:e[`authenticator-id`]})),{successLabel:`Deleted`})}},uv={command:`authenticators`,describe:`Operations for users.mfa.authenticators`,builder:e=>e.command(lv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},dv={command:`mfa`,describe:`Operations for users.mfa`,builder:e=>e.command(uv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},fv={command:`users`,describe:`Operations for users`,builder:e=>e.command(dv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pv(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const mv={command:`create`,describe:`Adds a new identity provider to Access.`,builder:pv,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust zone-identity-providers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Creating`,async()=>t.zeroTrust.zoneIdentityProviders.create({body:r,zone_id:n})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function hv(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const gv={command:`delete <identity-provider-id>`,describe:`Deletes an identity provider from Access.`,builder:hv,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust zone-identity-providers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}u(await f(`Deleting`,async()=>t.zeroTrust.zoneIdentityProviders.delete({zone_id:n,identity_provider_id:e[`identity-provider-id`]})),{successLabel:`Deleted`})}};function _v(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const vv={command:`get <identity-provider-id>`,describe:`Fetches a configured identity provider.`,builder:_v,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust zone-identity-providers get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.zoneIdentityProviders.get({zone_id:n,identity_provider_id:e[`identity-provider-id`]})),{successLabel:`Loaded`})}};function yv(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const bv={command:`list`,describe:`Lists all configured identity providers.`,builder:yv,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust zone-identity-providers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.zoneIdentityProviders.list({zone_id:n})),{successLabel:`Loaded`})}};function xv(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Sv={command:`update <identity-provider-id>`,describe:`Updates a configured identity provider.`,builder:xv,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust zone-identity-providers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``),"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:c(e.body)});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.zoneIdentityProviders.update({body:r,zone_id:n,identity_provider_id:e[`identity-provider-id`]})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Cv={command:`zone-identity-providers`,describe:`Operations for zone-identity-providers`,builder:e=>e.command(mv).command(gv).command(vv).command(bv).command(Sv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function wv(e){return e.option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Tv={command:`create`,describe:`Sets up a Zero Trust organization for your account.`,builder:wv,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust zone-organizations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/organizations`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({auth_domain:p(t[`auth-domain`],`auth-domain`,`text`),is_ui_read_only:t[`is-ui-read-only`],login_design:{background_color:p(t[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(t[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(t[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(t[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(t[`login-design-text-color`],`login-design-text-color`,`text`)},name:p(t.name,`name`,`text`),ui_read_only_toggle_reason:p(t[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(t[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)}):c(t.body)});return}let n=await s(t),r=await a({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=c(t.body);u(await f(`Creating`,async()=>n.zeroTrust.zoneOrganizations.create({...e,zone_id:r})),{successLabel:`Created`});return}t[`auth-domain`]===void 0&&(t[`auth-domain`]=await e(`auth-domain`,`The unique subdomain assigned to your Zero Trust organization.`)),t.name===void 0&&(t.name=await e(`name`,`The name of your Zero Trust organization.`));let i=l({auth_domain:p(t[`auth-domain`],`auth-domain`,`text`),is_ui_read_only:t[`is-ui-read-only`],login_design:{background_color:p(t[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(t[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(t[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(t[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(t[`login-design-text-color`],`login-design-text-color`,`text`)},name:p(t.name,`name`,`text`),ui_read_only_toggle_reason:p(t[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(t[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)});u(await f(`Creating`,async()=>n.zeroTrust.zoneOrganizations.create({...i,zone_id:r})),{successLabel:`Created`})}};function Ev(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dv={command:`get`,describe:`Returns the configuration for your Zero Trust organization.`,builder:Ev,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust zone-organizations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/organizations`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`none`});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,u(await f(`Loading`,async()=>t.zeroTrust.zoneOrganizations.get({zone_id:n})),{successLabel:`Loaded`})}};function Ov(e){return e.option(`email`,{type:`string`,description:`The email of the user to revoke.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const kv={command:`revoke-user-create`,describe:`Revokes a user's access across all applications.`,builder:Ov,handler:async t=>{if(t.dryRun){d({command:`cf zero-trust zone-organizations revoke-user-create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/organizations/revoke_user`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?l({email:p(t.email,`email`,`text`)}):c(t.body)});return}let n=await s(t),r=await a({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,!await i({force:!!t.force,message:`This operation revokes all access tokens for a user, affecting their access to all applications within the zone.`})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=c(t.body);u(await f(`Deleting`,async()=>n.zeroTrust.zoneOrganizations.revokeUserCreate({...e,zone_id:r})),{successLabel:`Deleted`});return}t.email===void 0&&(t.email=await e(`email`,`The email of the user to revoke.`));let o=l({email:p(t.email,`email`,`text`)});u(await f(`Deleting`,async()=>n.zeroTrust.zoneOrganizations.revokeUserCreate({...o,zone_id:r})),{successLabel:`Deleted`})}};function Av(e){return e.option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const jv={command:`update`,describe:`Updates the configuration for your Zero Trust organization.`,builder:Av,handler:async e=>{if(e.dryRun){d({command:`cf zero-trust zone-organizations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zone??e.zoneId??`<zone>`}/access/organizations`,pathParams:{"zone-id":String(e.zone??e[`zone-id`]??``)},bodyKind:`json`,body:e.body===void 0?l({auth_domain:p(e[`auth-domain`],`auth-domain`,`text`),is_ui_read_only:e[`is-ui-read-only`],login_design:{background_color:p(e[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(e[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(e[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(e[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(e[`login-design-text-color`],`login-design-text-color`,`text`)},name:p(e.name,`name`,`text`),ui_read_only_toggle_reason:p(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)}):c(e.body)});return}let t=await s(e),n=await a({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let r=c(e.body);u(await f(`Updating`,async()=>t.zeroTrust.zoneOrganizations.update({...r,zone_id:n})),{successLabel:`Updated`});return}let r=l({auth_domain:p(e[`auth-domain`],`auth-domain`,`text`),is_ui_read_only:e[`is-ui-read-only`],login_design:{background_color:p(e[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:p(e[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:p(e[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:p(e[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:p(e[`login-design-text-color`],`login-design-text-color`,`text`)},name:p(e.name,`name`,`text`),ui_read_only_toggle_reason:p(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:p(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)});u(await f(`Updating`,async()=>t.zeroTrust.zoneOrganizations.update({...r,zone_id:n})),{successLabel:`Updated`})}},Mv={command:`zone-organizations`,describe:`Operations for zone-organizations`,builder:e=>e.command(Tv).command(Dv).command(kv).command(jv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Nv={command:`zero-trust`,describe:`Cloudflare's SASE platform — secure access, device posture, DLP, tunnels, gateway policies, and network segmentation`,builder:e=>e.command(Or).command(ki).command(Gi).command(Xi).command(ic).command(Ll).command(Md).command(Xd).command($p).command(um).command(Om).command(Rh).command(Qh).command(lg).command(Ig).command(zg).command(Xg).command(a_).command(sv).command(fv).command(Cv).command(Mv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{Nv as default};