cf 0.5.0 → 0.7.0

package/dist/cloudforce-one-CG3TT7IN.mjs

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import{O as e,w as t}from"./oauth-DBJ5GSFk.mjs";import{i as n,n as r}from"./auth-CZ0E51rF.mjs";import{t as i}from"./output-B6fBFRqe.mjs";import{n as a,t as o}from"./progress-O88q63Bk.mjs";import{t as s}from"./local-C6TLPAT6.mjs";import{n as c,t as l}from"./body-parser-BO6mfo_W.mjs";import{n as u,t as d}from"./input-validation-BwUR9z8e.mjs";import{n as f,r as p,t as m}from"./prompt-DTAWiEm2.mjs";import{t as h}from"./cli-types-CFw6Xygp.mjs";function ee(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Binary file to be uploaded to the database.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const te={command:`create`,describe:`Uploads a binary file to Cloudforce One's binary database for malware analysis and threat intelligence correlation.`,builder:ee,handler:async c=>{if(c.dryRun){a({command:`cf cloudforce-one binary-storage create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/binary`,pathParams:{},bodyKind:`multipart`,body:{body:c.body,file:c.file}});return}let l=await r(c),f=c.local?s:await t();if(c.accountId=f,c.file!==void 0||c.body!==void 0){let e=new FormData;if(c.file){let t=d(c.file);e.append(`file`,new Blob([t]),c.file.split(/[\\/]/).filter(Boolean).pop())}else c.body!==void 0&&e.append(`file`,c.body);i(await o(`Creating`,async()=>n(l,`POST`,`/accounts/${f}/cloudforce-one/binary`,{body:e})),{successLabel:`Created`});return}if(c.body){let e=u(c.body,`body`,`binary`);i(await o(`Creating`,async()=>n(l,`POST`,`/accounts/${f}/cloudforce-one/binary`,{body:e,headers:{"Content-Type":`multipart/form-data`}})),{successLabel:`Created`});return}if(c.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function g(e){return e.positional(`hash`,{type:`string`,description:`hash of the binary`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _={command:`get <hash>`,describe:`Retrieves a binary file from the Cloudforce One binary storage for analysis.`,builder:g,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one binary-storage get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/binary/${n.hash==null?`<hash>`:encodeURIComponent(String(n.hash))}`,pathParams:{hash:String(n.hash??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.binaryStorage.get({account_id:l,hash:n.hash})),{successLabel:`Loaded`})}},v={command:`binary-storage`,describe:`Upload and retrieve malware samples and suspicious binaries for analysis`,builder:e=>e.command(te).command(_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function y(e){return e.option(`aggregate-by`,{type:`string`,description:`Column(s) to aggregate by - single column or comma-separated list (e.g., 'attacker', 'targetIndustry', 'attacker,targetIndustry')`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID(s) to filter by. Can be a single dataset ID, comma-separated list, or array. If not provided, uses default dataset`}).option(`start-date`,{type:`string`,description:`Start date for filtering (ISO 8601 format, e.g., '2024-01-01')`}).option(`end-date`,{type:`string`,description:`End date for filtering (ISO 8601 format, e.g., '2024-12-31')`}).option(`group-by-date`,{type:`boolean`,description:`Whether to group results by date (daily aggregation)`}).option(`limit`,{type:`number`,description:`Maximum number of results to return`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const b={command:`get`,describe:`Aggregate threat events by one or more columns (e.g., attacker, targetIndustry) with optional date filtering and daily grouping. Supports multi-dimensional aggregation for cross-analysis.`,builder:y,handler:async n=>{let c={aggregateBy:n[`aggregate-by`],datasetId:n[`dataset-id`],startDate:n[`start-date`],endDate:n[`end-date`],groupByDate:n[`group-by-date`],limit:n.limit};if(n.dryRun){a({command:`cf cloudforce-one events aggregate get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/aggregate`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(n),u=n.local?s:await t();n.accountId=u,i(await o(`Loading`,async()=>l.cloudforceOne.events.aggregate.get({account_id:u,...c})),{successLabel:`Loaded`})}},x={command:`aggregate`,describe:`Events operations`,builder:e=>e.command(b).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function S(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const C={command:`get`,describe:`Lists categories`,builder:S,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events categories catalog get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/categories/catalog`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.events.categories.catalog.get({account_id:l})),{successLabel:`Loaded`})}},w={command:`catalog`,describe:`Events operations`,builder:e=>e.command(C).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function T(e){return e.positional(`category-id`,{type:`string`,description:`Category UUID.`,demandOption:!0}).option(`kill-chain`,{type:`number`,description:`The killChain field`}).option(`mitre-attack`,{type:`string`,array:!0,description:`The mitreAttack field`}).option(`mitre-capec`,{type:`string`,array:!0,description:`The mitreCapec field`}).option(`name`,{type:`string`,description:`The name field`}).option(`shortname`,{type:`string`,description:`The shortname field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const E={command:`create <category-id>`,describe:`Updates a category`,builder:T,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events categories create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/categories/${n[`category-id`]==null?`<category-id>`:encodeURIComponent(String(n[`category-id`]))}`,pathParams:{"category-id":String(n[`category-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({killChain:n[`kill-chain`],mitreAttack:n[`mitre-attack`],mitreCapec:n[`mitre-capec`],name:u(n.name,`name`,`text`),shortname:u(n.shortname,`shortname`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.events.categories.create({...e,account_id:f,category_id:n[`category-id`]})),{successLabel:`Created`});return}let p=l({killChain:n[`kill-chain`],mitreAttack:n[`mitre-attack`],mitreCapec:n[`mitre-capec`],name:u(n.name,`name`,`text`),shortname:u(n.shortname,`shortname`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.events.categories.create({...p,account_id:f,category_id:n[`category-id`]})),{successLabel:`Created`})}},D={command:`categories`,describe:`Events operations`,builder:e=>e.command(E).command(w).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function O(e){return e.positional(`event-id`,{type:`string`,description:`Event UUID.`,demandOption:!0}).option(`attacker`,{type:`string`,description:`The attacker field`}).option(`attacker-country`,{type:`string`,description:`The attackerCountry field`}).option(`category`,{type:`string`,description:`The category field`}).option(`created-at`,{type:`string`,description:`The createdAt field`}).option(`dataset-id`,{type:`string`,description:`Dataset ID containing the event to update.`}).option(`date`,{type:`string`,description:`The date field`}).option(`event`,{type:`string`,description:`The event field`}).option(`indicator`,{type:`string`,description:`The indicator field`}).option(`indicator-type`,{type:`string`,description:`The indicatorType field`}).option(`insight`,{type:`string`,description:`The insight field`}).option(`raw-source`,{type:`string`,description:`The raw.source field`}).option(`raw-tlp`,{type:`string`,description:`The raw.tlp field`}).option(`target-country`,{type:`string`,description:`The targetCountry field`}).option(`target-industry`,{type:`string`,description:`The targetIndustry field`}).option(`tlp`,{type:`string`,description:`The tlp field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const k={command:`create <event-id>`,describe:`Updates an event`,builder:O,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/${n[`event-id`]==null?`<event-id>`:encodeURIComponent(String(n[`event-id`]))}`,pathParams:{"event-id":String(n[`event-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({attacker:u(n.attacker,`attacker`,`text`),attackerCountry:u(n[`attacker-country`],`attacker-country`,`text`),category:u(n.category,`category`,`text`),createdAt:u(n[`created-at`],`created-at`,`text`),datasetId:u(n[`dataset-id`],`dataset-id`,`text`),date:u(n.date,`date`,`text`),event:u(n.event,`event`,`text`),indicator:u(n.indicator,`indicator`,`text`),indicatorType:u(n[`indicator-type`],`indicator-type`,`text`),insight:u(n.insight,`insight`,`text`),raw:{source:u(n[`raw-source`],`raw-source`,`text`),tlp:u(n[`raw-tlp`],`raw-tlp`,`text`)},targetCountry:u(n[`target-country`],`target-country`,`text`),targetIndustry:u(n[`target-industry`],`target-industry`,`text`),tlp:u(n.tlp,`tlp`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.events.create({...e,account_id:f,event_id:n[`event-id`]})),{successLabel:`Created`});return}n[`dataset-id`]===void 0&&(n[`dataset-id`]=await p(`dataset-id`,`Dataset ID containing the event to update.`));let m=l({attacker:u(n.attacker,`attacker`,`text`),attackerCountry:u(n[`attacker-country`],`attacker-country`,`text`),category:u(n.category,`category`,`text`),createdAt:u(n[`created-at`],`created-at`,`text`),datasetId:u(n[`dataset-id`],`dataset-id`,`text`),date:u(n.date,`date`,`text`),event:u(n.event,`event`,`text`),indicator:u(n.indicator,`indicator`,`text`),indicatorType:u(n[`indicator-type`],`indicator-type`,`text`),insight:u(n.insight,`insight`,`text`),raw:{source:u(n[`raw-source`],`raw-source`,`text`),tlp:u(n[`raw-tlp`],`raw-tlp`,`text`)},targetCountry:u(n[`target-country`],`target-country`,`text`),targetIndustry:u(n[`target-industry`],`target-industry`,`text`),tlp:u(n.tlp,`tlp`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.events.create({...m,account_id:f,event_id:n[`event-id`]})),{successLabel:`Created`})}};function A(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset UUID.`,demandOption:!0}).option(`keep-raw-data`,{type:`boolean`,description:`If true, copies raw data to the destination dataset. Default is false (raw data is stripped/not copied).`}).option(`dest-dataset-id`,{type:`string`,description:`The destDatasetId field`}).option(`event-ids`,{type:`string`,array:!0,description:`The eventIds field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const j={command:`create <dataset-id>`,describe:`Copies specified events from one dataset to another dataset`,builder:A,handler:async n=>{let d={keepRawData:n[`keep-raw-data`]};if(n.dryRun){a({command:`cf cloudforce-one events dataset copy create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}/copy`,pathParams:{"dataset-id":String(n[`dataset-id`]??``)},query:d,bodyKind:`json`,body:n.body===void 0?l({destDatasetId:u(n[`dest-dataset-id`],`dest-dataset-id`,`text`),eventIds:n[`event-ids`]}):c(n.body)});return}let f=await r(n),m=n.local?s:await t();if(n.accountId=m,n.body){let e=c(n.body);new URLSearchParams(Object.entries(d).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString(),i(await o(`Creating`,async()=>f.cloudforceOne.events.dataset.copy.create({...e,account_id:m,dataset_id:n[`dataset-id`],...d})),{successLabel:`Created`});return}if(n[`dest-dataset-id`]===void 0&&(n[`dest-dataset-id`]=await p(`dest-dataset-id`,`The destDatasetId field`)),n[`event-ids`]===void 0)throw Error(`--event-ids is required (or pass --body with this field set).`);let h=l({destDatasetId:u(n[`dest-dataset-id`],`dest-dataset-id`,`text`),eventIds:n[`event-ids`]});new URLSearchParams(Object.entries(d).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString(),i(await o(`Creating`,async()=>f.cloudforceOne.events.dataset.copy.create({...h,account_id:m,dataset_id:n[`dataset-id`],...d})),{successLabel:`Created`})}},M={command:`copy`,describe:`Events operations`,builder:e=>e.command(j).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function N(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID.`,demandOption:!0}).option(`is-public`,{type:`boolean`,description:`If true, then anyone can search the dataset. If false, then its limited to the account.`}).option(`name`,{type:`string`,description:`Used to describe the dataset within the account context.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const P={command:`create <dataset-id>`,describe:`Updates an existing dataset`,builder:N,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}`,pathParams:{"dataset-id":String(n[`dataset-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({isPublic:n[`is-public`],name:u(n.name,`name`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.events.dataset.create({...e,account_id:f,dataset_id:n[`dataset-id`]})),{successLabel:`Created`});return}if(n[`is-public`]===void 0)throw Error(`--is-public is required (or pass --body with this field set).`);n.name===void 0&&(n.name=await p(`name`,`Used to describe the dataset within the account context.`));let m=l({isPublic:n[`is-public`],name:u(n.name,`name`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.events.dataset.create({...m,account_id:f,dataset_id:n[`dataset-id`]})),{successLabel:`Created`})}};function F(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID to delete`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const I={command:`delete <dataset-id>`,describe:`Soft-deletes a dataset given a datasetId.`,builder:F,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}`,pathParams:{"dataset-id":String(n[`dataset-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();if(n.accountId=l,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>c.cloudforceOne.events.dataset.delete({account_id:l,dataset_id:n[`dataset-id`]})),{successLabel:`Deleted`})}};function L(e){return e.positional(`event-id`,{type:`string`,description:`Event UUID.`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const R={command:`get <event-id>`,describe:`Retrieves a specific event by its UUID.`,builder:L,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset events get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}/events/${n[`event-id`]==null?`<event-id>`:encodeURIComponent(String(n[`event-id`]))}`,pathParams:{"dataset-id":String(n[`dataset-id`]??``),"event-id":String(n[`event-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.events.dataset.events.get({account_id:l,dataset_id:n[`dataset-id`],event_id:n[`event-id`]})),{successLabel:`Loaded`})}},z={command:`events`,describe:`Events operations`,builder:e=>e.command(R).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function B(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const V={command:`create`,describe:`Create a group`,builder:B,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/-/groups`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({description:u(n.description,`description`,`text`),name:u(n.name,`name`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.events.dataset.groups.create({...e,account_id:f})),{successLabel:`Created`});return}n.description===void 0&&(n.description=await p(`description`,`The description field`)),n.name===void 0&&(n.name=await p(`name`,`The name field`));let m=l({description:u(n.description,`description`,`text`),name:u(n.name,`name`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.events.dataset.groups.create({...m,account_id:f})),{successLabel:`Created`})}};function H(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const U={command:`delete <group-id>`,describe:`Delete a group for an account`,builder:H,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/-/groups/${n[`group-id`]==null?`<group-id>`:encodeURIComponent(String(n[`group-id`]))}`,pathParams:{"group-id":String(n[`group-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();if(n.accountId=l,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>c.cloudforceOne.events.dataset.groups.delete({account_id:l,group_id:n[`group-id`]})),{successLabel:`Deleted`})}};function W(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const G={command:`group`,describe:`List groups for an account`,builder:W,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset groups get group`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/-/groups`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.events.dataset.groups.get.group({account_id:l})),{successLabel:`Loaded`})}};function K(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const q={command:`v2 <group-id>`,describe:`Read a group for an account`,builder:K,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset groups get v2`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/-/groups/${n[`group-id`]==null?`<group-id>`:encodeURIComponent(String(n[`group-id`]))}`,pathParams:{"group-id":String(n[`group-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.events.dataset.groups.get.v2({account_id:l,group_id:n[`group-id`]})),{successLabel:`Loaded`})}},J={command:`get`,describe:`Events operations`,builder:e=>e.command(G).command(q).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Y(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`account-tag`,{type:`string`,description:`The accountTag field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const X={command:`create <group-id>`,describe:`Create a group member`,builder:Y,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset groups members create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/-/groups/${n[`group-id`]==null?`<group-id>`:encodeURIComponent(String(n[`group-id`]))}/members`,pathParams:{"group-id":String(n[`group-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({accountTag:u(n[`account-tag`],`account-tag`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.events.dataset.groups.members.create({...e,account_id:f,group_id:n[`group-id`]})),{successLabel:`Created`});return}let p=l({accountTag:u(n[`account-tag`],`account-tag`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.events.dataset.groups.members.create({...p,account_id:f,group_id:n[`group-id`]})),{successLabel:`Created`})}};function Z(e){return e.positional(`member-id`,{type:`string`,description:`Member ID`,demandOption:!0}).option(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Q={command:`delete <member-id>`,describe:`Delete a group member`,builder:Z,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset groups members delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/-/groups/${n[`group-id`]==null?`<group-id>`:encodeURIComponent(String(n[`group-id`]))}/members/${n[`member-id`]==null?`<member-id>`:encodeURIComponent(String(n[`member-id`]))}`,pathParams:{"group-id":String(n[`group-id`]??``),"member-id":String(n[`member-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();if(n.accountId=l,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>c.cloudforceOne.events.dataset.groups.members.delete({account_id:l,group_id:n[`group-id`],member_id:n[`member-id`]})),{successLabel:`Deleted`})}};function ne(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const re={command:`get <group-id>`,describe:`List group members`,builder:ne,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset groups members get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/-/groups/${n[`group-id`]==null?`<group-id>`:encodeURIComponent(String(n[`group-id`]))}/members`,pathParams:{"group-id":String(n[`group-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.events.dataset.groups.members.get({account_id:l,group_id:n[`group-id`]})),{successLabel:`Loaded`})}},ie={command:`members`,describe:`Events operations`,builder:e=>e.command(X).command(Q).command(re).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ae(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const oe={command:`update <group-id>`,describe:`Update a group`,builder:ae,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/-/groups/${n[`group-id`]==null?`<group-id>`:encodeURIComponent(String(n[`group-id`]))}`,pathParams:{"group-id":String(n[`group-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({description:u(n.description,`description`,`text`),name:u(n.name,`name`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Updating`,async()=>d.cloudforceOne.events.dataset.groups.update({...e,account_id:f,group_id:n[`group-id`]})),{successLabel:`Updated`});return}n.description===void 0&&(n.description=await p(`description`,`The description field`)),n.name===void 0&&(n.name=await p(`name`,`The name field`));let m=l({description:u(n.description,`description`,`text`),name:u(n.name,`name`,`text`)});i(await o(`Updating`,async()=>d.cloudforceOne.events.dataset.groups.update({...m,account_id:f,group_id:n[`group-id`]})),{successLabel:`Updated`})}},se={command:`groups`,describe:`Events operations`,builder:e=>e.command(V).command(U).command(oe).command(J).command(ie).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ce(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID.`,demandOption:!0}).option(`description`,{type:`string`,description:`Optional description for the indicator type`}).option(`indicator-type`,{type:`string`,description:`The indicator type to create (e.g., 'DOMAIN', 'IP', 'URL', 'HASH', 'EMAIL')`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const le={command:`create <dataset-id>`,describe:`Creates a new indicator type and initializes its dedicated Durable Object`,builder:ce,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset indicator types create create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}/indicatorTypes/create`,pathParams:{"dataset-id":String(n[`dataset-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({description:u(n.description,`description`,`text`),indicatorType:u(n[`indicator-type`],`indicator-type`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.events.dataset.indicator.types.create.create({...e,account_id:f,dataset_id:n[`dataset-id`]})),{successLabel:`Created`});return}n[`indicator-type`]===void 0&&(n[`indicator-type`]=await p(`indicator-type`,`The indicator type to create (e.g., 'DOMAIN', 'IP', 'URL', 'HASH', 'EMAIL')`));let m=l({description:u(n.description,`description`,`text`),indicatorType:u(n[`indicator-type`],`indicator-type`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.events.dataset.indicator.types.create.create({...m,account_id:f,dataset_id:n[`dataset-id`]})),{successLabel:`Created`})}},ue={command:`create`,describe:`Events operations`,builder:e=>e.command(le).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},de={command:`types`,describe:`Operations for events.dataset.indicator.types`,builder:e=>e.command(ue).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},fe={command:`indicator`,describe:`Operations for events.dataset.indicator`,builder:e=>e.command(de).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pe(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset UUID.`,demandOption:!0}).option(`auto-create-type`,{type:`boolean`,description:`Global flag to automatically create indicator types if they don't exist. Individual indicators can override this with their own autoCreateType flag.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const me={command:`create <dataset-id>`,describe:`Creates multiple indicators at once with their respective types and related datasets.`,builder:pe,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset indicators bulk create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}/indicators/bulk`,pathParams:{"dataset-id":String(n[`dataset-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({autoCreateType:n[`auto-create-type`]}):c(n.body)});return}let u=await r(n),d=n.local?s:await t();if(n.accountId=d,n.body){let e=c(n.body);i(await o(`Creating`,async()=>u.cloudforceOne.events.dataset.indicators.bulk.create({...e,account_id:d,dataset_id:n[`dataset-id`]})),{successLabel:`Created`});return}let f=l({autoCreateType:n[`auto-create-type`]});i(await o(`Creating`,async()=>u.cloudforceOne.events.dataset.indicators.bulk.create({...f,account_id:d,dataset_id:n[`dataset-id`]})),{successLabel:`Created`})}},he={command:`bulk`,describe:`Events operations`,builder:e=>e.command(me).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ge(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset UUID.`,demandOption:!0}).option(`auto-create-type`,{type:`boolean`,description:`If true, automatically create the indicator type if it doesn't exist. If false (default), throw an error when the indicator type doesn't exist.`}).option(`indicator-type`,{type:`string`,description:`The indicatorType field`}).option(`value`,{type:`string`,description:`The value field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _e={command:`create <dataset-id>`,describe:`Creates a new indicator with the specified type and related datasets.`,builder:ge,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset indicators create create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}/indicators/create`,pathParams:{"dataset-id":String(n[`dataset-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({autoCreateType:n[`auto-create-type`],indicatorType:u(n[`indicator-type`],`indicator-type`,`text`),value:u(n.value,`value`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.events.dataset.indicators.create.create({...e,account_id:f,dataset_id:n[`dataset-id`]})),{successLabel:`Created`});return}n[`indicator-type`]===void 0&&(n[`indicator-type`]=await p(`indicator-type`,`The indicatorType field`)),n.value===void 0&&(n.value=await p(`value`,`The value field`));let m=l({autoCreateType:n[`auto-create-type`],indicatorType:u(n[`indicator-type`],`indicator-type`,`text`),value:u(n.value,`value`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.events.dataset.indicators.create.create({...m,account_id:f,dataset_id:n[`dataset-id`]})),{successLabel:`Created`})}},ve={command:`create`,describe:`Events operations`,builder:e=>e.command(_e).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ye(e){return e.positional(`indicator-id`,{type:`string`,description:`Indicator UUID.`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const be={command:`delete <indicator-id>`,describe:`Deletes a specific indicator by its UUID.`,builder:ye,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset indicators delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}/indicators/${n[`indicator-id`]==null?`<indicator-id>`:encodeURIComponent(String(n[`indicator-id`]))}`,pathParams:{"dataset-id":String(n[`dataset-id`]??``),"indicator-id":String(n[`indicator-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();if(n.accountId=l,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>c.cloudforceOne.events.dataset.indicators.delete({account_id:l,dataset_id:n[`dataset-id`],indicator_id:n[`indicator-id`]})),{successLabel:`Deleted`})}};function xe(e){return e.positional(`indicator-id`,{type:`string`,description:`Indicator UUID.`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Se={command:`indicator <indicator-id>`,describe:`Retrieves a specific indicator by its UUID.`,builder:xe,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset indicators get indicator`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}/indicators/${n[`indicator-id`]==null?`<indicator-id>`:encodeURIComponent(String(n[`indicator-id`]))}`,pathParams:{"dataset-id":String(n[`dataset-id`]??``),"indicator-id":String(n[`indicator-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.events.dataset.indicators.get.indicator({account_id:l,dataset_id:n[`dataset-id`],indicator_id:n[`indicator-id`]})),{successLabel:`Loaded`})}},Ce={command:`get`,describe:`Events operations`,builder:e=>e.command(Se).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function we(e){return e.positional(`indicator-id`,{type:`string`,description:`Indicator UUID.`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID.`,demandOption:!0}).option(`indicator-type`,{type:`string`,description:`The indicatorType field`}).option(`value`,{type:`string`,description:`The value field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Te={command:`patch <indicator-id>`,describe:`Updates an existing indicator's properties.`,builder:we,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset indicators patch`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}/indicators/${n[`indicator-id`]==null?`<indicator-id>`:encodeURIComponent(String(n[`indicator-id`]))}`,pathParams:{"dataset-id":String(n[`dataset-id`]??``),"indicator-id":String(n[`indicator-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({indicatorType:u(n[`indicator-type`],`indicator-type`,`text`),value:u(n.value,`value`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Updating`,async()=>d.cloudforceOne.events.dataset.indicators.patch({...e,account_id:f,dataset_id:n[`dataset-id`],indicator_id:n[`indicator-id`]})),{successLabel:`Updated`});return}let p=l({indicatorType:u(n[`indicator-type`],`indicator-type`,`text`),value:u(n.value,`value`,`text`)});i(await o(`Updating`,async()=>d.cloudforceOne.events.dataset.indicators.patch({...p,account_id:f,dataset_id:n[`dataset-id`],indicator_id:n[`indicator-id`]})),{successLabel:`Updated`})}};function Ee(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const De={command:`get <dataset-id>`,describe:`Returns all mirrored tags from the indicator dataset (DO mirror table). No pagination.`,builder:Ee,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset indicators tags get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}/indicators/tags`,pathParams:{"dataset-id":String(n[`dataset-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.events.dataset.indicators.tags.get({account_id:l,dataset_id:n[`dataset-id`]})),{successLabel:`Loaded`})}},Oe={command:`tags`,describe:`Events operations`,builder:e=>e.command(De).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ke={command:`indicators`,describe:`Events operations`,builder:e=>e.command(be).command(Te).command(he).command(ve).command(Ce).command(Oe).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ae(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset UUID.`,demandOption:!0}).option(`keep-raw-data`,{type:`boolean`,description:`If true, copies raw data to the destination dataset. Default is false (raw data is stripped/not copied). Raw data is always deleted from the source.`}).option(`dest-dataset-id`,{type:`string`,description:`The destDatasetId field`}).option(`event-ids`,{type:`string`,array:!0,description:`The eventIds field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const je={command:`create <dataset-id>`,describe:`Moves specified events from one dataset to another dataset`,builder:Ae,handler:async n=>{let d={keepRawData:n[`keep-raw-data`]};if(n.dryRun){a({command:`cf cloudforce-one events dataset move create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}/move`,pathParams:{"dataset-id":String(n[`dataset-id`]??``)},query:d,bodyKind:`json`,body:n.body===void 0?l({destDatasetId:u(n[`dest-dataset-id`],`dest-dataset-id`,`text`),eventIds:n[`event-ids`]}):c(n.body)});return}let f=await r(n),m=n.local?s:await t();if(n.accountId=m,n.body){let e=c(n.body);new URLSearchParams(Object.entries(d).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString(),i(await o(`Creating`,async()=>f.cloudforceOne.events.dataset.move.create({...e,account_id:m,dataset_id:n[`dataset-id`],...d})),{successLabel:`Created`});return}if(n[`dest-dataset-id`]===void 0&&(n[`dest-dataset-id`]=await p(`dest-dataset-id`,`The destDatasetId field`)),n[`event-ids`]===void 0)throw Error(`--event-ids is required (or pass --body with this field set).`);let h=l({destDatasetId:u(n[`dest-dataset-id`],`dest-dataset-id`,`text`),eventIds:n[`event-ids`]});new URLSearchParams(Object.entries(d).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString(),i(await o(`Creating`,async()=>f.cloudforceOne.events.dataset.move.create({...h,account_id:m,dataset_id:n[`dataset-id`],...d})),{successLabel:`Created`})}},Me={command:`move`,describe:`Events operations`,builder:e=>e.command(je).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ne(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset UUID.`,demandOption:!0}).option(`role`,{type:`string`,description:`The role field`,choices:[`read`,`write`]}).option(`subject-id`,{type:`string`,description:`The subjectId field`}).option(`subject-type`,{type:`string`,description:`The subjectType field`,choices:[`account`,`group`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Pe={command:`create <dataset-id>`,describe:`Create a permission`,builder:Ne,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset permissions create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}/permissions`,pathParams:{"dataset-id":String(n[`dataset-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({role:u(n.role,`role`,`text`),subjectId:u(n[`subject-id`],`subject-id`,`text`),subjectType:u(n[`subject-type`],`subject-type`,`text`)}):c(n.body)});return}let d=await r(n),m=n.local?s:await t();if(n.accountId=m,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.events.dataset.permissions.create({...e,account_id:m,dataset_id:n[`dataset-id`]})),{successLabel:`Created`});return}n.role===void 0&&(n.role=await f(`role`,`The role field`,[`read`,`write`])),n[`subject-id`]===void 0&&(n[`subject-id`]=await p(`subject-id`,`The subjectId field`)),n[`subject-type`]===void 0&&(n[`subject-type`]=await f(`subject-type`,`The subjectType field`,[`account`,`group`]));let h=l({role:u(n.role,`role`,`text`),subjectId:u(n[`subject-id`],`subject-id`,`text`),subjectType:u(n[`subject-type`],`subject-type`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.events.dataset.permissions.create({...h,account_id:m,dataset_id:n[`dataset-id`]})),{successLabel:`Created`})}};function Fe(e){return e.positional(`grant-id`,{type:`string`,description:`Grant ID`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ie={command:`delete <grant-id>`,describe:`Delete a permission`,builder:Fe,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset permissions delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}/permissions/${n[`grant-id`]==null?`<grant-id>`:encodeURIComponent(String(n[`grant-id`]))}`,pathParams:{"dataset-id":String(n[`dataset-id`]??``),"grant-id":String(n[`grant-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();if(n.accountId=l,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>c.cloudforceOne.events.dataset.permissions.delete({account_id:l,dataset_id:n[`dataset-id`],grant_id:n[`grant-id`]})),{successLabel:`Deleted`})}};function Le(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Re={command:`get <dataset-id>`,describe:`List permissions`,builder:Le,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset permissions get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}/permissions`,pathParams:{"dataset-id":String(n[`dataset-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.events.dataset.permissions.get({account_id:l,dataset_id:n[`dataset-id`]})),{successLabel:`Loaded`})}};function ze(e){return e.positional(`grant-id`,{type:`string`,description:`Grant ID`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset UUID.`,demandOption:!0}).option(`role`,{type:`string`,description:`The role field`,choices:[`read`,`write`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Be={command:`update <grant-id>`,describe:`Update a permission`,builder:ze,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset permissions update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}/permissions/${n[`grant-id`]==null?`<grant-id>`:encodeURIComponent(String(n[`grant-id`]))}`,pathParams:{"dataset-id":String(n[`dataset-id`]??``),"grant-id":String(n[`grant-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({role:u(n.role,`role`,`text`)}):c(n.body)});return}let d=await r(n),p=n.local?s:await t();if(n.accountId=p,n.body){let e=c(n.body);i(await o(`Updating`,async()=>d.cloudforceOne.events.dataset.permissions.update({...e,account_id:p,dataset_id:n[`dataset-id`],grant_id:n[`grant-id`]})),{successLabel:`Updated`});return}n.role===void 0&&(n.role=await f(`role`,`The role field`,[`read`,`write`]));let m=l({role:u(n.role,`role`,`text`)});i(await o(`Updating`,async()=>d.cloudforceOne.events.dataset.permissions.update({...m,account_id:p,dataset_id:n[`dataset-id`],grant_id:n[`grant-id`]})),{successLabel:`Updated`})}},Ve={command:`permissions`,describe:`Events operations`,builder:e=>e.command(Pe).command(Ie).command(Re).command(Be).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function He(e){return e.positional(`tag-uuid`,{type:`string`,description:`Tag UUID.`,demandOption:!0}).option(`dataset-ids`,{type:`string`,description:`Dataset UUIDs to scope to (repeat the param for multiple), or 'all' / '*' for every readable indicator dataset. Omit to search all readable datasets.`}).option(`page`,{type:`number`,description:`Page`}).option(`page-size`,{type:`number`,description:`PageSize`}).option(`indicator-type`,{type:`string`,description:`IndicatorType`}).option(`related-event`,{type:`string`,description:`Filter indicators by related event UUID(s). Multiple UUIDs can be provided by repeating the parameter.`}).option(`search`,{type:`string`,description:`Structured search as a JSON array of {field, op, value} objects. Searchable fields: value, indicatorType. Multiple conditions are AND'd together. Max 10 conditions per request.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ue={command:`get <tag-uuid>`,describe:`Returns indicators associated with the provided tag UUID, with pagination. By default fans out across every indicator dataset the account can read; pass datasetIds to scope to specific datasets.`,builder:h(He),handler:async n=>{let c={datasetIds:n[`dataset-ids`],page:n.page,pageSize:n[`page-size`],indicatorType:n[`indicator-type`],relatedEvent:n[`related-event`],search:n.search};if(n.dryRun){a({command:`cf cloudforce-one events dataset tags indicators get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/tags/${n[`tag-uuid`]==null?`<tag-uuid>`:encodeURIComponent(String(n[`tag-uuid`]))}/indicators`,pathParams:{"tag-uuid":String(n[`tag-uuid`]??``)},query:c,bodyKind:`none`});return}let l=await r(n),u=n.local?s:await t();n.accountId=u,i(await o(`Loading`,async()=>l.cloudforceOne.events.dataset.tags.indicators.get({account_id:u,tag_uuid:n[`tag-uuid`],...c})),{successLabel:`Loaded`})}},We={command:`indicators`,describe:`Events operations`,builder:e=>e.command(Ue).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ge={command:`tags`,describe:`Operations for events.dataset.tags`,builder:e=>e.command(We).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ke(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qe={command:`get <dataset-id>`,describe:`Lists all target industries for a specific dataset`,builder:Ke,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events dataset target industries get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}/targetIndustries`,pathParams:{"dataset-id":String(n[`dataset-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.events.dataset.target.industries.get({account_id:l,dataset_id:n[`dataset-id`]})),{successLabel:`Loaded`})}},Je={command:`industries`,describe:`Events operations`,builder:e=>e.command(qe).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ye={command:`target`,describe:`Operations for events.dataset.target`,builder:e=>e.command(Je).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Xe={command:`dataset`,describe:`Events operations`,builder:e=>e.command(P).command(I).command(M).command(z).command(se).command(fe).command(ke).command(Me).command(Ve).command(Ge).command(Ye).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ze(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qe={command:`create`,describe:`Populate dataset-specific lookup tables from existing Events data with batch processing`,builder:Ze,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events datasets populate create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/datasets/populate`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Creating`,async()=>c.cloudforceOne.events.datasets.populate.create({account_id:l})),{successLabel:`Created`})}},$e={command:`populate`,describe:`Events operations`,builder:e=>e.command(Qe).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},et={command:`datasets`,describe:`Operations for events.datasets`,builder:e=>e.command($e).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function tt(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset UUID.`,demandOption:!0}).option(`event-ids`,{type:`string`,description:`Array of Event IDs to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const nt={command:`delete <dataset-id>`,describe:`Deletes one or more events`,builder:tt,handler:async n=>{let c={eventIds:n[`event-ids`]};if(n.dryRun){a({command:`cf cloudforce-one events delete delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}/delete`,pathParams:{"dataset-id":String(n[`dataset-id`]??``)},query:c,bodyKind:`none`});return}let l=await r(n),u=n.local?s:await t();if(n.accountId=u,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>l.cloudforceOne.events.delete.delete({account_id:u,dataset_id:n[`dataset-id`],...c})),{successLabel:`Deleted`})}},rt={command:`delete`,describe:`Events operations`,builder:e=>e.command(nt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function it(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const at={command:`ql`,describe:`Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation.`,builder:it,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events graphql create graph ql`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/graphql`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Creating`,async()=>c.cloudforceOne.events.graphql.create.graph.ql({account_id:l})),{successLabel:`Created`})}};function ot(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const st={command:`qlv2`,describe:`Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation.`,builder:ot,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events graphql create graph qlv2`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/v2/events/graphql`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Creating`,async()=>c.cloudforceOne.events.graphql.create.graph.qlv2({account_id:l})),{successLabel:`Created`})}},ct={command:`graph`,describe:`Events operations`,builder:e=>e.command(at).command(st).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},lt={command:`create`,describe:`Operations for events.graphql.create`,builder:e=>e.command(ct).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ut={command:`graphql`,describe:`Operations for events.graphql`,builder:e=>e.command(lt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function dt(e){return e.option(`dataset-ids`,{type:`string`,description:`Array of dataset IDs to query indicator types from. If not provided, queries all datasets for the account.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ft={command:`get`,describe:`Lists indicator types across multiple datasets`,builder:dt,handler:async n=>{let c={datasetIds:n[`dataset-ids`]};if(n.dryRun){a({command:`cf cloudforce-one events indicator types get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/indicator-types`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(n),u=n.local?s:await t();n.accountId=u,i(await o(`Loading`,async()=>l.cloudforceOne.events.indicator.types.get({account_id:u,...c})),{successLabel:`Loaded`})}},pt={command:`types`,describe:`Events operations`,builder:e=>e.command(ft).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},mt={command:`indicator`,describe:`Operations for events.indicator`,builder:e=>e.command(pt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ht(e){return e.option(`dataset-ids`,{type:`string`,description:`Dataset IDs to query indicators from (array of UUIDs), or special value 'all' or '*' to query all datasets. If not provided, uses the default dataset.`}).option(`page`,{type:`number`,description:`Page`}).option(`page-size`,{type:`number`,description:`PageSize`}).option(`search`,{type:`string`,description:`Structured search as a JSON array of {field, op, value} objects. Searchable fields: value, indicatorType, uuid. Supports operators: equals, not, contains, startsWith, endsWith, gt, lt, gte, lte, like, in, find. Use the 'in' operator with an array value to bulk-check up to 100 indicators in a single request, e.g. search=[{"field":"value","op":"in","value":["evil.com","bad.org"]}]. Multiple conditions are AND'd together. Max 10 conditions per request.`}).option(`name`,{type:`string`,description:`Filter indicators by value using substring match (LIKE). Legacy alternative to structured search.`}).option(`indicator-type`,{type:`string`,description:`IndicatorType`}).option(`related-events`,{type:`string`,description:`Filter by related event IDs`}).option(`tags`,{type:`string`,description:`Filter by tag values or UUIDs. Indicators must have at least one of the specified tags (OR logic). Supports both tag UUID and tag value.`}).option(`tag-search`,{type:`string`,description:'Structured tag-metadata filter as a JSON array of {field, op, value} objects. Operates against the per-dataset IndicatorTag mirror so you can find indicators by tag attributes (origin country, motive, sophistication, priority, etc.) without a separate Tags lookup. Common dashboard usage: drill from a country into indicators, e.g. tagSearch=[{"field":"originCountryISO","op":"in","value":["IR","CN"]}]. Country values may be passed as alpha-2, alpha-3, name, or alias (e.g. "iran"). Operators: equals, not, gt/gte/lt/lte (numeric only), contains/like/find/startsWith/endsWith (string only), in. AND-joined across entries; combined with `tags`, a matching tag must satisfy both. Max 10 entries per request, max 100 values per \'in\'. Performance notes: `originCountryISO` uses its B-tree index for equals/not/in. `priority` uses its B-tree index for numeric comparisons. Other string columns (`actorCategory`, `motive`, etc.) are case-insensitive and unindexed; current catalog size makes this a non-issue. `endsWith` and `aliasGroupNames` contains/like are leading-wildcard scans and slow on large result sets. `aliasGroupNames` matches on the JSON-encoded text, so substrings can cross alias boundaries ("apt28" also matches "apt280" when both appear in the same tag\'s alias list).'}).option(`created-after`,{type:`string`,description:`Filter indicators created on or after this date. Must use ISO 8601 format (e.g., '2024-01-15T00:00:00Z').`}).option(`created-before`,{type:`string`,description:`Filter indicators created on or before this date. Must use ISO 8601 format (e.g., '2024-12-31T23:59:59Z').`}).option(`related-events-limit`,{type:`number`,description:`Limit the number of related events returned per indicator. Default: 2. Set to 0 for none, -1 for all events.`}).option(`include-tags`,{type:`boolean`,description:`Whether to include full tag details for each indicator. Defaults to true.`}).option(`include-total-count`,{type:`boolean`,description:`Whether to compute total count via COUNT(*). Defaults to false for performance. total_count is null unless this is true and the complete fan-out succeeds.`}).option(`format`,{type:`string`,description:`Output format for indicator data. 'json' returns the default format, 'stix2' returns STIX 2.1 Indicator SDOs, 'taxii' returns a TAXII 2.1 Envelope with Content-Type application/taxii+json;version=2.1.`,choices:[`json`,`stix2`,`taxii`]}).option(`cache`,{type:`string`,description:"Cache strategy. 'from-graph' serves results from the graph-node KV cache when all requested UUIDs are cached; falls back to normal path on partial/zero hit. Cannot be combined with `cursor`.",choices:[`from-graph`]}).option(`cursor`,{type:`string`,description:"Opaque cursor from a previous response's `pagination.cursor`. When provided, all filters, datasetIds, page, `pageSize`, `includeTags` and `relatedEventsLimit` come from the cursor — do not resend them. Sending any filter, `page`, `pageSize`, `includeTags`, `relatedEventsLimit`, `includeTotalCount=true`, or `cache=from-graph` alongside a cursor yields a 400 `CursorFilterConflictError`. A cursor issued for a different entity, an unsupported version, or a dataset that has since been reconfigured as analytics-only yields a 400 `InvalidCursorError`."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gt={command:`get`,describe:`Retrieves indicators across specified datasets, ordered by createdAt descending then UUID, dataset ID, and shard ID ascending. Use datasetIds=all or datasetIds=* to query all datasets for the account. If no datasetIds provided, uses the default dataset.`,builder:h(ht),handler:async n=>{let c={datasetIds:n[`dataset-ids`],page:n.page,pageSize:n[`page-size`],search:n.search,name:n.name,indicatorType:n[`indicator-type`],relatedEvents:n[`related-events`],tags:n.tags,tagSearch:n[`tag-search`],createdAfter:n[`created-after`],createdBefore:n[`created-before`],relatedEventsLimit:n[`related-events-limit`],includeTags:n[`include-tags`],includeTotalCount:n[`include-total-count`],format:n.format,cache:n.cache,cursor:n.cursor};if(n.dryRun){a({command:`cf cloudforce-one events indicators get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/indicators`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(n),u=n.local?s:await t();n.accountId=u,i(await o(`Loading`,async()=>l.cloudforceOne.events.indicators.get({account_id:u,...c})),{successLabel:`Loaded`})}},_t={command:`indicators`,describe:`Events operations`,builder:e=>e.command(gt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function vt(e){return e.option(`alert-enabled`,{type:`boolean`,description:`Enable alerts for this query`}).option(`alert-rollup-enabled`,{type:`boolean`,description:`Enable alert rollup for this query`}).option(`name`,{type:`string`,description:`Unique name for the saved query`}).option(`query-json`,{type:`string`,description:`JSON string containing the query parameters`}).option(`rule-enabled`,{type:`boolean`,description:`Enable rule for this query`}).option(`rule-scope`,{type:`string`,description:`Scope for the rule`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const yt={command:`create-create`,describe:`Create a new saved event query for the account`,builder:vt,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events queries create-create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/queries/create`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({alert_enabled:n[`alert-enabled`],alert_rollup_enabled:n[`alert-rollup-enabled`],name:u(n.name,`name`,`text`),query_json:u(n[`query-json`],`query-json`,`text`),rule_enabled:n[`rule-enabled`],rule_scope:u(n[`rule-scope`],`rule-scope`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.events.queries.createCreate({...e,account_id:f})),{successLabel:`Created`});return}if(n[`alert-enabled`]===void 0)throw Error(`--alert-enabled is required (or pass --body with this field set).`);if(n[`alert-rollup-enabled`]===void 0)throw Error(`--alert-rollup-enabled is required (or pass --body with this field set).`);if(n.name===void 0&&(n.name=await p(`name`,`Unique name for the saved query`)),n[`query-json`]===void 0&&(n[`query-json`]=await p(`query-json`,`JSON string containing the query parameters`)),n[`rule-enabled`]===void 0)throw Error(`--rule-enabled is required (or pass --body with this field set).`);let m=l({alert_enabled:n[`alert-enabled`],alert_rollup_enabled:n[`alert-rollup-enabled`],name:u(n.name,`name`,`text`),query_json:u(n[`query-json`],`query-json`,`text`),rule_enabled:n[`rule-enabled`],rule_scope:u(n[`rule-scope`],`rule-scope`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.events.queries.createCreate({...m,account_id:f})),{successLabel:`Created`})}};function bt(e){return e.positional(`query-id`,{type:`string`,description:`Event query ID`,demandOption:!0}).option(`alert-enabled`,{type:`boolean`,description:`Enable alerts for this query`}).option(`alert-rollup-enabled`,{type:`boolean`,description:`Enable alert rollup for this query`}).option(`name`,{type:`string`,description:`Unique name for the saved query`}).option(`query-json`,{type:`string`,description:`JSON string containing the query parameters`}).option(`rule-enabled`,{type:`boolean`,description:`Enable rule for this query`}).option(`rule-scope`,{type:`string`,description:`Scope for the rule`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xt={command:`create <query-id>`,describe:`Update an existing saved event query by its ID`,builder:h(bt),handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events queries create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/queries/${n[`query-id`]==null?`<query-id>`:encodeURIComponent(String(n[`query-id`]))}`,pathParams:{"query-id":String(n[`query-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({alert_enabled:n[`alert-enabled`],alert_rollup_enabled:n[`alert-rollup-enabled`],name:u(n.name,`name`,`text`),query_json:u(n[`query-json`],`query-json`,`text`),rule_enabled:n[`rule-enabled`],rule_scope:u(n[`rule-scope`],`rule-scope`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.events.queries.create({...e,account_id:f,query_id:n[`query-id`]})),{successLabel:`Created`});return}let p=l({alert_enabled:n[`alert-enabled`],alert_rollup_enabled:n[`alert-rollup-enabled`],name:u(n.name,`name`,`text`),query_json:u(n[`query-json`],`query-json`,`text`),rule_enabled:n[`rule-enabled`],rule_scope:u(n[`rule-scope`],`rule-scope`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.events.queries.create({...p,account_id:f,query_id:n[`query-id`]})),{successLabel:`Created`})}};function St(e){return e.positional(`query-id`,{type:`string`,description:`Event query ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ct={command:`delete <query-id>`,describe:`Delete a saved event query by its ID`,builder:h(St),handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events queries delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/queries/${n[`query-id`]==null?`<query-id>`:encodeURIComponent(String(n[`query-id`]))}`,pathParams:{"query-id":String(n[`query-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();if(n.accountId=l,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>c.cloudforceOne.events.queries.delete({account_id:l,query_id:n[`query-id`]})),{successLabel:`Deleted`})}};function wt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Tt={command:`event`,describe:`Retrieve all saved event queries for the account`,builder:wt,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events queries get event`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/queries`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.events.queries.get.event({account_id:l})),{successLabel:`Loaded`})}};function Et(e){return e.positional(`query-id`,{type:`string`,description:`Event query ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dt={command:`v2 <query-id>`,describe:`Retrieve a saved event query by its ID`,builder:h(Et),handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events queries get v2`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/queries/${n[`query-id`]==null?`<query-id>`:encodeURIComponent(String(n[`query-id`]))}`,pathParams:{"query-id":String(n[`query-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.events.queries.get.v2({account_id:l,query_id:n[`query-id`]})),{successLabel:`Loaded`})}},Ot={command:`get`,describe:`Events operations`,builder:e=>e.command(Tt).command(Dt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function kt(e){return e.positional(`query-id`,{type:`string`,description:`Event query ID`,demandOption:!0}).option(`alert-enabled`,{type:`boolean`,description:`Enable alerts for this query`}).option(`alert-rollup-enabled`,{type:`boolean`,description:`Enable alert rollup for this query`}).option(`name`,{type:`string`,description:`Unique name for the saved query`}).option(`query-json`,{type:`string`,description:`JSON string containing the query parameters`}).option(`rule-enabled`,{type:`boolean`,description:`Enable rule for this query`}).option(`rule-scope`,{type:`string`,description:`Scope for the rule`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const At={command:`patch <query-id>`,describe:`Update an existing saved event query by its ID`,builder:h(kt),handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events queries patch`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/queries/${n[`query-id`]==null?`<query-id>`:encodeURIComponent(String(n[`query-id`]))}`,pathParams:{"query-id":String(n[`query-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({alert_enabled:n[`alert-enabled`],alert_rollup_enabled:n[`alert-rollup-enabled`],name:u(n.name,`name`,`text`),query_json:u(n[`query-json`],`query-json`,`text`),rule_enabled:n[`rule-enabled`],rule_scope:u(n[`rule-scope`],`rule-scope`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Updating`,async()=>d.cloudforceOne.events.queries.patch({...e,account_id:f,query_id:n[`query-id`]})),{successLabel:`Updated`});return}let p=l({alert_enabled:n[`alert-enabled`],alert_rollup_enabled:n[`alert-rollup-enabled`],name:u(n.name,`name`,`text`),query_json:u(n[`query-json`],`query-json`,`text`),rule_enabled:n[`rule-enabled`],rule_scope:u(n[`rule-scope`],`rule-scope`,`text`)});i(await o(`Updating`,async()=>d.cloudforceOne.events.queries.patch({...p,account_id:f,query_id:n[`query-id`]})),{successLabel:`Updated`})}},jt={command:`queries`,describe:`Events operations`,builder:e=>e.command(xt).command(yt).command(Ct).command(At).command(Ot).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Mt(e){return e.positional(`raw-id`,{type:`string`,description:`Raw Event UUID.`,demandOption:!0}).option(`event-id`,{type:`string`,description:`Event UUID.`,demandOption:!0}).option(`source`,{type:`string`,description:`The source field`}).option(`tlp`,{type:`string`,description:`The tlp field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Nt={command:`create <raw-id>`,describe:`Updates a raw event`,builder:Mt,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events raw create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/${n[`event-id`]==null?`<event-id>`:encodeURIComponent(String(n[`event-id`]))}/raw/${n[`raw-id`]==null?`<raw-id>`:encodeURIComponent(String(n[`raw-id`]))}`,pathParams:{"event-id":String(n[`event-id`]??``),"raw-id":String(n[`raw-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({source:u(n.source,`source`,`text`),tlp:u(n.tlp,`tlp`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.events.raw.create({...e,account_id:f,event_id:n[`event-id`],raw_id:n[`raw-id`]})),{successLabel:`Created`});return}let p=l({source:u(n.source,`source`,`text`),tlp:u(n.tlp,`tlp`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.events.raw.create({...p,account_id:f,event_id:n[`event-id`],raw_id:n[`raw-id`]})),{successLabel:`Created`})}},Pt={command:`raw`,describe:`Events operations`,builder:e=>e.command(Nt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ft(e){return e.positional(`event-id`,{type:`string`,description:`Event UUID.`,demandOption:!0}).option(`events`,{type:`string`,array:!0,description:`The events field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const It={command:`create <event-id>`,describe:`Creates event references for a event`,builder:Ft,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events relate create create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/relate/${n[`event-id`]==null?`<event-id>`:encodeURIComponent(String(n[`event-id`]))}/create`,pathParams:{"event-id":String(n[`event-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({events:n.events}):c(n.body)});return}let u=await r(n),d=n.local?s:await t();if(n.accountId=d,n.body){let e=c(n.body);i(await o(`Creating`,async()=>u.cloudforceOne.events.relate.create.create({...e,account_id:d,event_id:n[`event-id`]})),{successLabel:`Created`});return}if(n.events===void 0)throw Error(`--events is required (or pass --body with this field set).`);let f=l({events:n.events});i(await o(`Creating`,async()=>u.cloudforceOne.events.relate.create.create({...f,account_id:d,event_id:n[`event-id`]})),{successLabel:`Created`})}},Lt={command:`create`,describe:`Events operations`,builder:e=>e.command(It).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Rt={command:`relate`,describe:`Operations for events.relate`,builder:e=>e.command(Lt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function zt(e){return e.option(`child-ids`,{type:`string`,array:!0,description:`Array of UUIDs for child events. Single child = 1:1 relationship, multiple = 1:many relationships`}).option(`dataset-id`,{type:`string`,description:`Dataset identifier where the events are stored`}).option(`parent-id`,{type:`string`,description:`UUID of the parent event that will be the source of the relationship`}).option(`relationship-type`,{type:`string`,description:`Type of relationship to create between parent and child events`,choices:[`related_to`,`caused_by`,`attributed_to`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Bt={command:`create`,describe:`Creates a directed relationship between two events. The relationship is from parent to child with a specified type.`,builder:zt,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events relationships create create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/relationships/create`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({childIds:n[`child-ids`],datasetId:u(n[`dataset-id`],`dataset-id`,`text`),parentId:u(n[`parent-id`],`parent-id`,`text`),relationshipType:u(n[`relationship-type`],`relationship-type`,`text`)}):c(n.body)});return}let d=await r(n),m=n.local?s:await t();if(n.accountId=m,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.events.relationships.create.create({...e,account_id:m})),{successLabel:`Created`});return}if(n[`child-ids`]===void 0)throw Error(`--child-ids is required (or pass --body with this field set).`);n[`dataset-id`]===void 0&&(n[`dataset-id`]=await p(`dataset-id`,`Dataset identifier where the events are stored`)),n[`parent-id`]===void 0&&(n[`parent-id`]=await p(`parent-id`,`UUID of the parent event that will be the source of the relationship`)),n[`relationship-type`]===void 0&&(n[`relationship-type`]=await f(`relationship-type`,`Type of relationship to create between parent and child events`,[`related_to`,`caused_by`,`attributed_to`]));let h=l({childIds:n[`child-ids`],datasetId:u(n[`dataset-id`],`dataset-id`,`text`),parentId:u(n[`parent-id`],`parent-id`,`text`),relationshipType:u(n[`relationship-type`],`relationship-type`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.events.relationships.create.create({...h,account_id:m})),{successLabel:`Created`})}},Vt={command:`create`,describe:`Events operations`,builder:e=>e.command(Bt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ht(e){return e.positional(`event-id`,{type:`string`,description:`Event UUID.`,demandOption:!0}).option(`direction`,{type:`string`,description:`The direction to traverse the graph. Defaults to 'both' to search all.`,choices:[`ancestors`,`descendants`,`both`]}).option(`max-depth`,{type:`number`,description:`The maximum depth to traverse. Defaults to 5.`}).option(`relationship-types`,{type:`string`,description:`An optional array of relationship types to filter by.`}).option(`indicator-type-ids`,{type:`string`,description:`An optional array of indicator type IDs to filter the results by.`}).option(`dataset-id`,{type:`string`,description:`The dataset ID to search within.`,demandOption:!0}).option(`include-parent`,{type:`boolean`,description:`Whether to include the starting event in the results. Defaults to true.`}).option(`page`,{type:`number`,description:`Page`}).option(`page-size`,{type:`number`,description:`PageSize`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ut={command:`get <event-id>`,describe:"The `event_id` must be defined (to list existing events (and their IDs), use the [`Filter and List Events`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/list/) endpoint). Also, must provide query parameters.",builder:h(Ht),handler:async n=>{let c={direction:n.direction,maxDepth:n[`max-depth`],relationshipTypes:n[`relationship-types`],indicatorTypeIds:n[`indicator-type-ids`],datasetId:n[`dataset-id`],includeParent:n[`include-parent`],page:n.page,pageSize:n[`page-size`]};if(n.dryRun){a({command:`cf cloudforce-one events relationships get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/${n[`event-id`]==null?`<event-id>`:encodeURIComponent(String(n[`event-id`]))}/relationships`,pathParams:{"event-id":String(n[`event-id`]??``)},query:c,bodyKind:`none`});return}let l=await r(n),u=n.local?s:await t();n.accountId=u,i(await o(`Loading`,async()=>l.cloudforceOne.events.relationships.get({account_id:u,event_id:n[`event-id`],...c})),{successLabel:`Loaded`})}},Wt={command:`relationships`,describe:`Events operations`,builder:e=>e.command(Ut).command(Vt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Gt(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Kt={command:`create`,describe:`Creates a new Source-of-Truth tag category for an account.`,builder:Gt,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events tags categories create create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/tags/categories/create`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({description:u(n.description,`description`,`text`),name:u(n.name,`name`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.events.tags.categories.create.create({...e,account_id:f})),{successLabel:`Created`});return}n.name===void 0&&(n.name=await p(`name`,`The name field`));let m=l({description:u(n.description,`description`,`text`),name:u(n.name,`name`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.events.tags.categories.create.create({...m,account_id:f})),{successLabel:`Created`})}},qt={command:`create`,describe:`Events operations`,builder:e=>e.command(Kt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Jt(e){return e.positional(`category-uuid`,{type:`string`,description:`Tag Category UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Yt={command:`delete <category-uuid>`,describe:`Deletes a Source-of-Truth tag category by UUID.`,builder:Jt,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events tags categories delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/tags/categories/${n[`category-uuid`]==null?`<category-uuid>`:encodeURIComponent(String(n[`category-uuid`]))}`,pathParams:{"category-uuid":String(n[`category-uuid`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();if(n.accountId=l,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>c.cloudforceOne.events.tags.categories.delete({account_id:l,category_uuid:n[`category-uuid`]})),{successLabel:`Deleted`})}};function Xt(e){return e.option(`search`,{type:`string`,description:`Search`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zt={command:`get`,describe:`Returns all Source-of-Truth tag categories for an account.`,builder:Xt,handler:async n=>{let c={search:n.search};if(n.dryRun){a({command:`cf cloudforce-one events tags categories get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/tags/categories`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(n),u=n.local?s:await t();n.accountId=u,i(await o(`Loading`,async()=>l.cloudforceOne.events.tags.categories.get({account_id:u,...c})),{successLabel:`Loaded`})}};function Qt(e){return e.positional(`category-uuid`,{type:`string`,description:`Tag Category UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const $t={command:`patch <category-uuid>`,describe:`Updates a Source-of-Truth tag category by UUID.`,builder:Qt,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events tags categories patch`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/tags/categories/${n[`category-uuid`]==null?`<category-uuid>`:encodeURIComponent(String(n[`category-uuid`]))}`,pathParams:{"category-uuid":String(n[`category-uuid`]??``)},bodyKind:`json`,body:n.body===void 0?l({description:u(n.description,`description`,`text`),name:u(n.name,`name`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Updating`,async()=>d.cloudforceOne.events.tags.categories.patch({...e,account_id:f,category_uuid:n[`category-uuid`]})),{successLabel:`Updated`});return}let p=l({description:u(n.description,`description`,`text`),name:u(n.name,`name`,`text`)});i(await o(`Updating`,async()=>d.cloudforceOne.events.tags.categories.patch({...p,account_id:f,category_uuid:n[`category-uuid`]})),{successLabel:`Updated`})}},en={command:`categories`,describe:`Events operations`,builder:e=>e.command(Yt).command(Zt).command($t).command(qt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function tn(e){return e.positional(`tag-uuid`,{type:`string`,description:`Tag UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const nn={command:`delete <tag-uuid>`,describe:`Deletes a Source-of-Truth tag by UUID.`,builder:tn,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events tags delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/tags/${n[`tag-uuid`]==null?`<tag-uuid>`:encodeURIComponent(String(n[`tag-uuid`]))}`,pathParams:{"tag-uuid":String(n[`tag-uuid`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();if(n.accountId=l,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>c.cloudforceOne.events.tags.delete({account_id:l,tag_uuid:n[`tag-uuid`]})),{successLabel:`Deleted`})}};function rn(e){return e.option(`page`,{type:`number`,description:`Page`}).option(`page-size`,{type:`number`,description:`PageSize`}).option(`search`,{type:`string`,description:`Legacy free-text substring match on tag value.`}).option(`category-uuid`,{type:`string`,description:`CategoryUuid`}).option(`filters`,{type:`string`,description:'Structured filters as a JSON array of {field, op, value} objects. Searchable fields: uuid, value, actorCategory, actorCategoryConfidence, aliasGroupNames, attributionConfidence, attributionConfidenceScore, attributionOrganization, categoryName, motive, motiveConfidence, opsecLevel, originCountryISO, originCountryConfidence, sophisticationLevel, priority, analyticPriority. Operators: equals, not, contains, startsWith, endsWith, gt, lt, gte, lte, like, in, find. Use \'in\' for bulk OR within a single field, e.g. filters=[{"field":"originCountryISO","op":"in","value":["IR","CN"]}]. Multiple entries are AND-joined. Max 10 entries per request, max 100 values per \'in\'. Per-field notes: `uuid` accepts only \'equals\' and \'in\' (other operators throw ValidationError) — matched against the canonical lowercase storage but callers may pass either case (the server lowercases before comparison); index-backed by the column\'s UNIQUE constraint and intended for batched UUID → tag resolution. `originCountryISO` uses its B-tree index for equals/not/in. `priority` uses its B-tree index for numeric comparisons. Other string columns (`actorCategory`, `motive`, etc.) are case-insensitive and unindexed; current catalog size makes this a non-issue. `endsWith` and `aliasGroupNames` contains/like are leading-wildcard scans and slow on large result sets. `aliasGroupNames` matches on the JSON-encoded text, so substrings can cross alias boundaries (a search for "apt28" will also match "apt280" if both appear in the same tag\'s alias list).'}).option(`cache`,{type:`string`,description:`Cache strategy. 'from-graph' serves results from the graph-node KV cache when all requested UUIDs are cached; falls back to normal path on partial/zero hit.`,choices:[`from-graph`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const an={command:`get`,describe:"Returns all Source-of-Truth tags for an account. Supports legacy free-text `search` on tag value and `categoryUuid` exact match, plus a structured `filters` JSON array for filtering by metadata fields (originCountryISO, actorCategory, motive, priority, etc.). Country values may be passed as alpha-2, alpha-3, name, or common alias.",builder:h(rn),handler:async n=>{let c={page:n.page,pageSize:n[`page-size`],search:n.search,categoryUuid:n[`category-uuid`],filters:n.filters,cache:n.cache};if(n.dryRun){a({command:`cf cloudforce-one events tags get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/tags`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(n),u=n.local?s:await t();n.accountId=u,i(await o(`Loading`,async()=>l.cloudforceOne.events.tags.get({account_id:u,...c})),{successLabel:`Loaded`})}};function on(e){return e.positional(`tag-uuid`,{type:`string`,description:`Tag UUID.`,demandOption:!0}).option(`active-duration`,{type:`string`,description:`The activeDuration field`}).option(`actor-category`,{type:`string`,description:`Actor variety. Allowed values: Activist, Competitor, Customer, Crime Syndicate, Former Employee, Nation State, Organized Crime, Nation State Affiliated, Terrorist, Unaffiliated.`}).option(`actor-category-confidence`,{type:`number`,description:`Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.`}).option(`alias-group-names`,{type:`string`,array:!0,description:`The aliasGroupNames field`}).option(`alias-group-names-internal`,{type:`string`,array:!0,description:`The aliasGroupNamesInternal field`}).option(`analytic-priority`,{type:`number`,description:`The analyticPriority field`}).option(`attribution-confidence`,{type:`string`,description:`The attributionConfidence field`}).option(`attribution-confidence-score`,{type:`number`,description:`The attributionConfidenceScore field`}).option(`attribution-organization`,{type:`string`,description:`The attributionOrganization field`}).option(`category-uuid`,{type:`string`,description:`The categoryUuid field`}).option(`date-of-discovery`,{type:`string`,description:`Date the actor was discovered (ISO YYYY-MM-DD).`}).option(`external-reference-links`,{type:`string`,array:!0,description:`The externalReferenceLinks field`}).option(`internal-description`,{type:`string`,description:`The internalDescription field`}).option(`motive`,{type:`string`,description:`Actor motive. Allowed values: Convenience, Fear, Fun, Financial, Grudge, Ideology, Espionage.`}).option(`motive-confidence`,{type:`number`,description:`Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.`}).option(`opsec-level`,{type:`string`,description:`The opsecLevel field`}).option(`origin-country-confidence`,{type:`number`,description:`Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.`}).option(`origin-country-iso`,{type:`string`,description:`The originCountryISO field`}).option(`origin-country-tlp`,{type:`string`,description:`TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.`,choices:[`red`,`amber`,`green`,`white`]}).option(`priority`,{type:`number`,description:`The priority field`}).option(`sophistication-level`,{type:`string`,description:`The sophisticationLevel field`}).option(`value`,{type:`string`,description:`The value field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const sn={command:`patch <tag-uuid>`,describe:`Updates a Source-of-Truth tag by UUID.`,builder:on,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events tags patch`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/tags/${n[`tag-uuid`]==null?`<tag-uuid>`:encodeURIComponent(String(n[`tag-uuid`]))}`,pathParams:{"tag-uuid":String(n[`tag-uuid`]??``)},bodyKind:`json`,body:n.body===void 0?l({activeDuration:u(n[`active-duration`],`active-duration`,`text`),actorCategory:u(n[`actor-category`],`actor-category`,`text`),actorCategoryConfidence:n[`actor-category-confidence`],aliasGroupNames:n[`alias-group-names`],aliasGroupNamesInternal:n[`alias-group-names-internal`],analyticPriority:n[`analytic-priority`],attributionConfidence:u(n[`attribution-confidence`],`attribution-confidence`,`text`),attributionConfidenceScore:n[`attribution-confidence-score`],attributionOrganization:u(n[`attribution-organization`],`attribution-organization`,`text`),categoryUuid:u(n[`category-uuid`],`category-uuid`,`text`),dateOfDiscovery:u(n[`date-of-discovery`],`date-of-discovery`,`text`),externalReferenceLinks:n[`external-reference-links`],internalDescription:u(n[`internal-description`],`internal-description`,`text`),motive:u(n.motive,`motive`,`text`),motiveConfidence:n[`motive-confidence`],opsecLevel:u(n[`opsec-level`],`opsec-level`,`text`),originCountryConfidence:n[`origin-country-confidence`],originCountryISO:u(n[`origin-country-iso`],`origin-country-iso`,`text`),originCountryTlp:u(n[`origin-country-tlp`],`origin-country-tlp`,`text`),priority:n.priority,sophisticationLevel:u(n[`sophistication-level`],`sophistication-level`,`text`),value:u(n.value,`value`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Updating`,async()=>d.cloudforceOne.events.tags.patch({...e,account_id:f,tag_uuid:n[`tag-uuid`]})),{successLabel:`Updated`});return}let p=l({activeDuration:u(n[`active-duration`],`active-duration`,`text`),actorCategory:u(n[`actor-category`],`actor-category`,`text`),actorCategoryConfidence:n[`actor-category-confidence`],aliasGroupNames:n[`alias-group-names`],aliasGroupNamesInternal:n[`alias-group-names-internal`],analyticPriority:n[`analytic-priority`],attributionConfidence:u(n[`attribution-confidence`],`attribution-confidence`,`text`),attributionConfidenceScore:n[`attribution-confidence-score`],attributionOrganization:u(n[`attribution-organization`],`attribution-organization`,`text`),categoryUuid:u(n[`category-uuid`],`category-uuid`,`text`),dateOfDiscovery:u(n[`date-of-discovery`],`date-of-discovery`,`text`),externalReferenceLinks:n[`external-reference-links`],internalDescription:u(n[`internal-description`],`internal-description`,`text`),motive:u(n.motive,`motive`,`text`),motiveConfidence:n[`motive-confidence`],opsecLevel:u(n[`opsec-level`],`opsec-level`,`text`),originCountryConfidence:n[`origin-country-confidence`],originCountryISO:u(n[`origin-country-iso`],`origin-country-iso`,`text`),originCountryTlp:u(n[`origin-country-tlp`],`origin-country-tlp`,`text`),priority:n.priority,sophisticationLevel:u(n[`sophistication-level`],`sophistication-level`,`text`),value:u(n.value,`value`,`text`)});i(await o(`Updating`,async()=>d.cloudforceOne.events.tags.patch({...p,account_id:f,tag_uuid:n[`tag-uuid`]})),{successLabel:`Updated`})}},cn={command:`tags`,describe:`Events operations`,builder:e=>e.command(nn).command(an).command(sn).command(en).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ln(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const un={command:`get`,describe:`Lists all target industries from industry map catalog`,builder:ln,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events target industries catalog get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/targetIndustries/catalog`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.events.target.industries.catalog.get({account_id:l})),{successLabel:`Loaded`})}},dn={command:`catalog`,describe:`Events operations`,builder:e=>e.command(un).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},fn={command:`industries`,describe:`Operations for events.target.industries`,builder:e=>e.command(dn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},pn={command:`target`,describe:`Operations for events.target`,builder:e=>e.command(fn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function mn(e){return e.option(`dataset-id`,{type:`string`,description:`Dataset ID containing the events to update. Required to prevent cross-account modifications.`}).option(`event-ids`,{type:`string`,array:!0,description:`List of event UUIDs to update (1-100)`}).option(`updates-attacker`,{type:`string`,description:`The updates.attacker field`}).option(`updates-attacker-country`,{type:`string`,description:`The updates.attackerCountry field`}).option(`updates-category`,{type:`string`,description:`The updates.category field`}).option(`updates-created-at`,{type:`string`,description:`The updates.createdAt field`}).option(`updates-event`,{type:`string`,description:`The updates.event field`}).option(`updates-indicator`,{type:`string`,description:`The updates.indicator field`}).option(`updates-indicator-type`,{type:`string`,description:`The updates.indicatorType field`}).option(`updates-insight`,{type:`string`,description:`The updates.insight field`}).option(`updates-raw-source`,{type:`string`,description:`The updates.raw.source field`}).option(`updates-raw-tlp`,{type:`string`,description:`The updates.raw.tlp field`}).option(`updates-target-country`,{type:`string`,description:`The updates.targetCountry field`}).option(`updates-target-industry`,{type:`string`,description:`The updates.targetIndustry field`}).option(`updates-tlp`,{type:`string`,description:`The updates.tlp field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const hn={command:`patch`,describe:`Updates multiple events with the same field values. Maximum 100 events per request.`,builder:mn,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one events update bulk patch`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/update/bulk`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({datasetId:u(n[`dataset-id`],`dataset-id`,`text`),eventIds:n[`event-ids`],updates:{attacker:u(n[`updates-attacker`],`updates-attacker`,`text`),attackerCountry:u(n[`updates-attacker-country`],`updates-attacker-country`,`text`),category:u(n[`updates-category`],`updates-category`,`text`),createdAt:u(n[`updates-created-at`],`updates-created-at`,`text`),event:u(n[`updates-event`],`updates-event`,`text`),indicator:u(n[`updates-indicator`],`updates-indicator`,`text`),indicatorType:u(n[`updates-indicator-type`],`updates-indicator-type`,`text`),insight:u(n[`updates-insight`],`updates-insight`,`text`),raw:{source:u(n[`updates-raw-source`],`updates-raw-source`,`text`),tlp:u(n[`updates-raw-tlp`],`updates-raw-tlp`,`text`)},targetCountry:u(n[`updates-target-country`],`updates-target-country`,`text`),targetIndustry:u(n[`updates-target-industry`],`updates-target-industry`,`text`),tlp:u(n[`updates-tlp`],`updates-tlp`,`text`)}}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Updating`,async()=>d.cloudforceOne.events.update.bulk.patch({...e,account_id:f})),{successLabel:`Updated`});return}if(n[`dataset-id`]===void 0&&(n[`dataset-id`]=await p(`dataset-id`,`Dataset ID containing the events to update. Required to prevent cross-account modifications.`)),n[`event-ids`]===void 0)throw Error(`--event-ids is required (or pass --body with this field set).`);let m=l({datasetId:u(n[`dataset-id`],`dataset-id`,`text`),eventIds:n[`event-ids`],updates:{attacker:u(n[`updates-attacker`],`updates-attacker`,`text`),attackerCountry:u(n[`updates-attacker-country`],`updates-attacker-country`,`text`),category:u(n[`updates-category`],`updates-category`,`text`),createdAt:u(n[`updates-created-at`],`updates-created-at`,`text`),event:u(n[`updates-event`],`updates-event`,`text`),indicator:u(n[`updates-indicator`],`updates-indicator`,`text`),indicatorType:u(n[`updates-indicator-type`],`updates-indicator-type`,`text`),insight:u(n[`updates-insight`],`updates-insight`,`text`),raw:{source:u(n[`updates-raw-source`],`updates-raw-source`,`text`),tlp:u(n[`updates-raw-tlp`],`updates-raw-tlp`,`text`)},targetCountry:u(n[`updates-target-country`],`updates-target-country`,`text`),targetIndustry:u(n[`updates-target-industry`],`updates-target-industry`,`text`),tlp:u(n[`updates-tlp`],`updates-tlp`,`text`)}});i(await o(`Updating`,async()=>d.cloudforceOne.events.update.bulk.patch({...m,account_id:f})),{successLabel:`Updated`})}},gn={command:`bulk`,describe:`Events operations`,builder:e=>e.command(hn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},_n={command:`update`,describe:`Operations for events.update`,builder:e=>e.command(gn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},vn={command:`events`,describe:`Events operations`,builder:e=>e.command(k).command(x).command(D).command(Xe).command(et).command(rt).command(ut).command(mt).command(_t).command(jt).command(Pt).command(Rt).command(Wt).command(cn).command(pn).command(_n).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function yn(e){return e.positional(`request-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`}).option(`source`,{type:`string`,description:`Asset file to upload.`})}const bn={command:`create <request-id>`,describe:`Uploads a new asset to a Cloudforce One intelligence request.`,builder:yn,handler:async c=>{if(c.dryRun){a({command:`cf cloudforce-one requests asset-new create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/${c[`request-id`]==null?`<request-id>`:encodeURIComponent(String(c[`request-id`]))}/asset/new`,pathParams:{"request-id":String(c[`request-id`]??``)},bodyKind:`multipart`,body:{body:c.body,file:c.file,source:c.source}});return}let l=await r(c),f=c.local?s:await t();if(c.accountId=f,c.file!==void 0||c.body!==void 0||c.source!==void 0){let e=new FormData;if(c.file){let t=d(c.file);e.append(`file`,new Blob([t]),c.file.split(/[\\/]/).filter(Boolean).pop())}else c.body!==void 0&&e.append(`file`,c.body);c.source!==void 0&&e.append(`source`,String(u(c.source,`source`,`text`)??``)),i(await o(`Creating`,async()=>n(l,`POST`,`/accounts/${f}/cloudforce-one/requests/${encodeURIComponent(String(c[`request-id`]))}/asset/new`,{body:e})),{successLabel:`Created`});return}if(c.body){let e=u(c.body,`body`,`binary`);i(await o(`Creating`,async()=>n(l,`POST`,`/accounts/${f}/cloudforce-one/requests/${encodeURIComponent(String(c[`request-id`]))}/asset/new`,{body:e,headers:{"Content-Type":`multipart/form-data`}})),{successLabel:`Created`});return}i(await o(`Creating`,async()=>l.cloudforceOne.requests.assetNew.create({account_id:f,request_id:c[`request-id`]})),{successLabel:`Created`})}},xn={command:`asset-new`,describe:`Additional request operations — priority listing and asset creation`,builder:e=>e.command(bn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Sn(e){return e.positional(`request-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Cn={command:`create <request-id>`,describe:`Lists assets attached to a Cloudforce One intelligence request.`,builder:Sn,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests assets create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/${n[`request-id`]==null?`<request-id>`:encodeURIComponent(String(n[`request-id`]))}/asset`,pathParams:{"request-id":String(n[`request-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({page:n.page,per_page:n[`per-page`]}):c(n.body)});return}let u=await r(n),d=n.local?s:await t();if(n.accountId=d,n.body){let e=c(n.body);i(await o(`Creating`,async()=>u.cloudforceOne.requests.assets.create({...e,account_id:d,request_id:n[`request-id`]})),{successLabel:`Created`});return}if(n.page===void 0)throw Error(`--page is required (or pass --body with this field set).`);if(n[`per-page`]===void 0)throw Error(`--per-page is required (or pass --body with this field set).`);let f=l({page:n.page,per_page:n[`per-page`]});i(await o(`Creating`,async()=>u.cloudforceOne.requests.assets.create({...f,account_id:d,request_id:n[`request-id`]})),{successLabel:`Created`})}};function wn(e){return e.positional(`asset-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`request-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Tn={command:`delete <asset-id>`,describe:`Removes an asset from a Cloudforce One intelligence request.`,builder:wn,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests assets delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/${n[`request-id`]==null?`<request-id>`:encodeURIComponent(String(n[`request-id`]))}/asset/${n[`asset-id`]==null?`<asset-id>`:encodeURIComponent(String(n[`asset-id`]))}`,pathParams:{"request-id":String(n[`request-id`]??``),"asset-id":String(n[`asset-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();if(n.accountId=l,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>c.cloudforceOne.requests.assets.delete({account_id:l,request_id:n[`request-id`],asset_id:n[`asset-id`]})),{successLabel:`Deleted`})}};function En(e){return e.positional(`asset-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`request-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dn={command:`get <asset-id>`,describe:`Retrieves an asset attached to a Cloudforce One intelligence request.`,builder:En,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests assets get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/${n[`request-id`]==null?`<request-id>`:encodeURIComponent(String(n[`request-id`]))}/asset/${n[`asset-id`]==null?`<asset-id>`:encodeURIComponent(String(n[`asset-id`]))}`,pathParams:{"request-id":String(n[`request-id`]??``),"asset-id":String(n[`asset-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.requests.assets.get({account_id:l,request_id:n[`request-id`],asset_id:n[`asset-id`]})),{successLabel:`Loaded`})}};function On(e){return e.positional(`asset-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`request-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`source`,{type:`string`,description:`Asset file to upload.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const kn={command:`update <asset-id>`,describe:`Updates an asset in a Cloudforce One intelligence request.`,builder:On,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests assets update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/${n[`request-id`]==null?`<request-id>`:encodeURIComponent(String(n[`request-id`]))}/asset/${n[`asset-id`]==null?`<asset-id>`:encodeURIComponent(String(n[`asset-id`]))}`,pathParams:{"request-id":String(n[`request-id`]??``),"asset-id":String(n[`asset-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({source:u(n.source,`source`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Updating`,async()=>d.cloudforceOne.requests.assets.update({...e,account_id:f,request_id:n[`request-id`],asset_id:n[`asset-id`]})),{successLabel:`Updated`});return}let p=l({source:u(n.source,`source`,`text`)});i(await o(`Updating`,async()=>d.cloudforceOne.requests.assets.update({...p,account_id:f,request_id:n[`request-id`],asset_id:n[`asset-id`]})),{successLabel:`Updated`})}},An={command:`assets`,describe:`Threat investigation requests — submit, track, and receive analyst findings`,builder:e=>e.command(Cn).command(Tn).command(Dn).command(kn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function jn(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Mn={command:`constants`,describe:`Retrieves constant values used in Cloudforce One requests, including valid statuses and types.`,builder:jn,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests constants`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/constants`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.requests.constants({account_id:l})),{successLabel:`Loaded`})}};function Nn(e){return e.option(`content`,{type:`string`,description:`Request content.`}).option(`priority`,{type:`string`,description:`Priority for analyzing the request.`}).option(`request-type`,{type:`string`,description:`Requested information from request.`}).option(`summary`,{type:`string`,description:`Brief description of the request.`}).option(`tlp`,{type:`string`,description:`The CISA defined Traffic Light Protocol (TLP).`,choices:[`clear`,`amber`,`amber-strict`,`green`,`red`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Pn={command:`create`,describe:`Creating a request adds the request into the Cloudforce One queue for analysis. In addition to the content, a short title, type, priority, and releasability should be provided. If one is not provided, a default will be assigned.`,builder:Nn,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/new`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({content:u(n.content,`content`,`text`),priority:u(n.priority,`priority`,`text`),request_type:u(n[`request-type`],`request-type`,`text`),summary:u(n.summary,`summary`,`text`),tlp:u(n.tlp,`tlp`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.requests.create({body:e,account_id:f})),{successLabel:`Created`});return}let p=l({content:u(n.content,`content`,`text`),priority:u(n.priority,`priority`,`text`),request_type:u(n[`request-type`],`request-type`,`text`),summary:u(n.summary,`summary`,`text`),tlp:u(n.tlp,`tlp`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.requests.create({body:p,account_id:f})),{successLabel:`Created`})}};function Fn(e){return e.positional(`request-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const In={command:`delete <request-id>`,describe:`Deletes a Cloudforce One intelligence request and all associated data.`,builder:Fn,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/${n[`request-id`]==null?`<request-id>`:encodeURIComponent(String(n[`request-id`]))}`,pathParams:{"request-id":String(n[`request-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();if(n.accountId=l,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>c.cloudforceOne.requests.delete({account_id:l,request_id:n[`request-id`]})),{successLabel:`Deleted`})}};function Ln(e){return e.positional(`request-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Rn={command:`get <request-id>`,describe:`Retrieves details for a specific Cloudforce One intelligence request.`,builder:Ln,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/${n[`request-id`]==null?`<request-id>`:encodeURIComponent(String(n[`request-id`]))}`,pathParams:{"request-id":String(n[`request-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.requests.get({account_id:l,request_id:n[`request-id`]})),{successLabel:`Loaded`})}};function zn(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`request-type`,{type:`string`,description:`Requested information from request.`}).option(`sort-by`,{type:`string`,description:`Field to sort results by.`}).option(`sort-order`,{type:`string`,description:`Sort order (asc or desc).`,choices:[`asc`,`desc`]}).option(`status`,{type:`string`,description:`Request Status.`,choices:[`open`,`accepted`,`reported`,`approved`,`completed`,`declined`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const $={command:`list`,describe:`Lists Cloudforce One intelligence requests with filtering and pagination.`,builder:zn,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests list`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({page:n.page,per_page:n[`per-page`],request_type:u(n[`request-type`],`request-type`,`text`),sort_by:u(n[`sort-by`],`sort-by`,`text`),sort_order:u(n[`sort-order`],`sort-order`,`text`),status:u(n.status,`status`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.requests.list({...e,account_id:f})),{successLabel:`Created`});return}if(n.page===void 0)throw Error(`--page is required (or pass --body with this field set).`);if(n[`per-page`]===void 0)throw Error(`--per-page is required (or pass --body with this field set).`);let p=l({page:n.page,per_page:n[`per-page`],request_type:u(n[`request-type`],`request-type`,`text`),sort_by:u(n[`sort-by`],`sort-by`,`text`),sort_order:u(n[`sort-order`],`sort-order`,`text`),status:u(n.status,`status`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.requests.list({...p,account_id:f})),{successLabel:`Created`})}};function Bn(e){return e.positional(`request-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`content`,{type:`string`,description:`Content of message.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Vn={command:`create <request-id>`,describe:`Adds a message to a Cloudforce One intelligence request conversation.`,builder:Bn,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests message create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/${n[`request-id`]==null?`<request-id>`:encodeURIComponent(String(n[`request-id`]))}/message/new`,pathParams:{"request-id":String(n[`request-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({content:u(n.content,`content`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.requests.message.create({body:e,account_id:f,request_id:n[`request-id`]})),{successLabel:`Created`});return}let p=l({content:u(n.content,`content`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.requests.message.create({body:p,account_id:f,request_id:n[`request-id`]})),{successLabel:`Created`})}};function Hn(e){return e.positional(`message-id`,{type:`string`,description:`Message ID`,demandOption:!0}).option(`request-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Un={command:`delete <message-id>`,describe:`Removes a message from a Cloudforce One intelligence request thread.`,builder:h(Hn),handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests message delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/${n[`request-id`]==null?`<request-id>`:encodeURIComponent(String(n[`request-id`]))}/message/${n[`message-id`]==null?`<message-id>`:encodeURIComponent(String(n[`message-id`]))}`,pathParams:{"request-id":String(n[`request-id`]??``),"message-id":String(n[`message-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();if(n.accountId=l,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>c.cloudforceOne.requests.message.delete({account_id:l,request_id:n[`request-id`],message_id:n[`message-id`]})),{successLabel:`Deleted`})}};function Wn(e){return e.positional(`request-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`sort-by`,{type:`string`,description:`Field to sort results by.`}).option(`sort-order`,{type:`string`,description:`Sort order (asc or desc).`,choices:[`asc`,`desc`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Gn={command:`get <request-id>`,describe:`Lists messages in a Cloudforce One intelligence request conversation.`,builder:Wn,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests message get`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/${n[`request-id`]==null?`<request-id>`:encodeURIComponent(String(n[`request-id`]))}/message`,pathParams:{"request-id":String(n[`request-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({page:n.page,per_page:n[`per-page`],sort_by:u(n[`sort-by`],`sort-by`,`text`),sort_order:u(n[`sort-order`],`sort-order`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.requests.message.get({...e,account_id:f,request_id:n[`request-id`]})),{successLabel:`Created`});return}if(n.page===void 0)throw Error(`--page is required (or pass --body with this field set).`);if(n[`per-page`]===void 0)throw Error(`--per-page is required (or pass --body with this field set).`);let p=l({page:n.page,per_page:n[`per-page`],sort_by:u(n[`sort-by`],`sort-by`,`text`),sort_order:u(n[`sort-order`],`sort-order`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.requests.message.get({...p,account_id:f,request_id:n[`request-id`]})),{successLabel:`Created`})}};function Kn(e){return e.positional(`message-id`,{type:`string`,description:`Message ID`,demandOption:!0}).option(`request-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`content`,{type:`string`,description:`Content of message.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const qn={command:`update <message-id>`,describe:`Updates a message in a Cloudforce One intelligence request thread.`,builder:h(Kn),handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests message update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/${n[`request-id`]==null?`<request-id>`:encodeURIComponent(String(n[`request-id`]))}/message/${n[`message-id`]==null?`<message-id>`:encodeURIComponent(String(n[`message-id`]))}`,pathParams:{"request-id":String(n[`request-id`]??``),"message-id":String(n[`message-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({content:u(n.content,`content`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Updating`,async()=>d.cloudforceOne.requests.message.update({body:e,account_id:f,request_id:n[`request-id`],message_id:n[`message-id`]})),{successLabel:`Updated`});return}let p=l({content:u(n.content,`content`,`text`)});i(await o(`Updating`,async()=>d.cloudforceOne.requests.message.update({body:p,account_id:f,request_id:n[`request-id`],message_id:n[`message-id`]})),{successLabel:`Updated`})}},Jn={command:`message`,describe:`Threat investigation requests — submit, track, and receive analyst findings`,builder:e=>e.command(Vn).command(Un).command(Gn).command(qn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Yn(e){return e.option(`labels`,{type:`string`,array:!0,description:`List of labels.`}).option(`priority`,{type:`number`,description:`Priority.`}).option(`requirement`,{type:`string`,description:`Requirement.`}).option(`tlp`,{type:`string`,description:`The CISA defined Traffic Light Protocol (TLP).`,choices:[`clear`,`amber`,`amber-strict`,`green`,`red`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Xn={command:`create`,describe:`Creates a new priority intelligence request in Cloudforce One.`,builder:Yn,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests priority create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/priority/new`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({labels:n.labels,priority:n.priority,requirement:u(n.requirement,`requirement`,`text`),tlp:u(n.tlp,`tlp`,`text`)}):c(n.body)});return}let d=await r(n),m=n.local?s:await t();if(n.accountId=m,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.requests.priority.create({body:e,account_id:m})),{successLabel:`Created`});return}if(n.labels===void 0)throw Error(`--labels is required (or pass --body with this field set).`);if(n.priority===void 0)throw Error(`--priority is required (or pass --body with this field set).`);n.requirement===void 0&&(n.requirement=await p(`requirement`,`Requirement.`)),n.tlp===void 0&&(n.tlp=await f(`tlp`,`The CISA defined Traffic Light Protocol (TLP).`,[`clear`,`amber`,`amber-strict`,`green`,`red`]));let h=l({labels:n.labels,priority:n.priority,requirement:u(n.requirement,`requirement`,`text`),tlp:u(n.tlp,`tlp`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.requests.priority.create({body:h,account_id:m})),{successLabel:`Created`})}};function Zn(e){return e.positional(`priority-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Qn={command:`delete <priority-id>`,describe:`Deletes a priority intelligence request from Cloudforce One.`,builder:Zn,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests priority delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/priority/${n[`priority-id`]==null?`<priority-id>`:encodeURIComponent(String(n[`priority-id`]))}`,pathParams:{"priority-id":String(n[`priority-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();if(n.accountId=l,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>c.cloudforceOne.requests.priority.delete({account_id:l,priority_id:n[`priority-id`]})),{successLabel:`Deleted`})}};function $n(e){return e.positional(`priority-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const er={command:`get <priority-id>`,describe:`Retrieves a specific priority intelligence request from Cloudforce One.`,builder:$n,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests priority get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/priority/${n[`priority-id`]==null?`<priority-id>`:encodeURIComponent(String(n[`priority-id`]))}`,pathParams:{"priority-id":String(n[`priority-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.requests.priority.get({account_id:l,priority_id:n[`priority-id`]})),{successLabel:`Loaded`})}};function tr(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const nr={command:`list`,describe:`Lists priority intelligence requests in Cloudforce One.`,builder:tr,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests priority list`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/priority`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({page:n.page,per_page:n[`per-page`]}):c(n.body)});return}let u=await r(n),d=n.local?s:await t();if(n.accountId=d,n.body){let e=c(n.body);i(await o(`Creating`,async()=>u.cloudforceOne.requests.priority.list({...e,account_id:d})),{successLabel:`Created`});return}if(n.page===void 0)throw Error(`--page is required (or pass --body with this field set).`);if(n[`per-page`]===void 0)throw Error(`--per-page is required (or pass --body with this field set).`);let f=l({page:n.page,per_page:n[`per-page`]});i(await o(`Creating`,async()=>u.cloudforceOne.requests.priority.list({...f,account_id:d})),{successLabel:`Created`})}};function rr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ir={command:`quota`,describe:`Retrieves quota usage for Cloudforce One priority requests.`,builder:rr,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests priority quota`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/priority/quota`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.requests.priority.quota({account_id:l})),{successLabel:`Loaded`})}};function ar(e){return e.positional(`priority-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`labels`,{type:`string`,array:!0,description:`List of labels.`}).option(`priority`,{type:`number`,description:`Priority.`}).option(`requirement`,{type:`string`,description:`Requirement.`}).option(`tlp`,{type:`string`,description:`The CISA defined Traffic Light Protocol (TLP).`,choices:[`clear`,`amber`,`amber-strict`,`green`,`red`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const or={command:`update <priority-id>`,describe:`Updates a priority intelligence request in Cloudforce One.`,builder:ar,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests priority update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/priority/${n[`priority-id`]==null?`<priority-id>`:encodeURIComponent(String(n[`priority-id`]))}`,pathParams:{"priority-id":String(n[`priority-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({labels:n.labels,priority:n.priority,requirement:u(n.requirement,`requirement`,`text`),tlp:u(n.tlp,`tlp`,`text`)}):c(n.body)});return}let d=await r(n),m=n.local?s:await t();if(n.accountId=m,n.body){let e=c(n.body);i(await o(`Updating`,async()=>d.cloudforceOne.requests.priority.update({body:e,account_id:m,priority_id:n[`priority-id`]})),{successLabel:`Updated`});return}if(n.labels===void 0)throw Error(`--labels is required (or pass --body with this field set).`);if(n.priority===void 0)throw Error(`--priority is required (or pass --body with this field set).`);n.requirement===void 0&&(n.requirement=await p(`requirement`,`Requirement.`)),n.tlp===void 0&&(n.tlp=await f(`tlp`,`The CISA defined Traffic Light Protocol (TLP).`,[`clear`,`amber`,`amber-strict`,`green`,`red`]));let h=l({labels:n.labels,priority:n.priority,requirement:u(n.requirement,`requirement`,`text`),tlp:u(n.tlp,`tlp`,`text`)});i(await o(`Updating`,async()=>d.cloudforceOne.requests.priority.update({body:h,account_id:m,priority_id:n[`priority-id`]})),{successLabel:`Updated`})}},sr={command:`priority`,describe:`Threat investigation requests — submit, track, and receive analyst findings`,builder:e=>e.command(Xn).command(Qn).command(er).command(nr).command(ir).command(or).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lr={command:`quota`,describe:`Retrieves quota usage for Cloudforce One standard requests.`,builder:cr,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests quota`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/quota`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.requests.quota({account_id:l})),{successLabel:`Loaded`})}};function ur(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dr={command:`types`,describe:`Lists available request types for Cloudforce One intelligence requests.`,builder:ur,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests types`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/types`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.requests.types({account_id:l})),{successLabel:`Loaded`})}};function fr(e){return e.positional(`request-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`content`,{type:`string`,description:`Request content.`}).option(`priority`,{type:`string`,description:`Priority for analyzing the request.`}).option(`request-type`,{type:`string`,description:`Requested information from request.`}).option(`summary`,{type:`string`,description:`Brief description of the request.`}).option(`tlp`,{type:`string`,description:`The CISA defined Traffic Light Protocol (TLP).`,choices:[`clear`,`amber`,`amber-strict`,`green`,`red`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pr={command:`update <request-id>`,describe:`Updating a request alters the request in the Cloudforce One queue. This API may be used to update any attributes of the request after the initial submission. Only fields that you choose to update need to be add to the request body.`,builder:fr,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one requests update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/requests/${n[`request-id`]==null?`<request-id>`:encodeURIComponent(String(n[`request-id`]))}`,pathParams:{"request-id":String(n[`request-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({content:u(n.content,`content`,`text`),priority:u(n.priority,`priority`,`text`),request_type:u(n[`request-type`],`request-type`,`text`),summary:u(n.summary,`summary`,`text`),tlp:u(n.tlp,`tlp`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Updating`,async()=>d.cloudforceOne.requests.update({body:e,account_id:f,request_id:n[`request-id`]})),{successLabel:`Updated`});return}let p=l({content:u(n.content,`content`,`text`),priority:u(n.priority,`priority`,`text`),request_type:u(n[`request-type`],`request-type`,`text`),summary:u(n.summary,`summary`,`text`),tlp:u(n.tlp,`tlp`,`text`)});i(await o(`Updating`,async()=>d.cloudforceOne.requests.update({body:p,account_id:f,request_id:n[`request-id`]})),{successLabel:`Updated`})}},mr={command:`requests`,describe:`Threat investigation requests — submit, track, and receive analyst findings`,builder:e=>e.command(Mn).command(Pn).command(In).command(Rn).command($).command(lr).command(dr).command(pr).command(xn).command(An).command(Jn).command(sr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function hr(e){return e.positional(`id`,{type:`string`,description:`The unique identifier for the approval.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gr={command:`get <id>`,describe:`Get a single rule approval with current rule data`,builder:hr,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules approvals get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/approvals/${n.id==null?`<id>`:encodeURIComponent(String(n.id))}`,pathParams:{id:String(n.id??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.rules.approvals.get({account_id:l,id:n.id})),{successLabel:`Loaded`})}};function _r(e){return e.option(`status`,{type:`string`,description:`Filter by status. Repeat the parameter to OR-match statuses (for example, status=pending&status=rejected). Use status=all alone to disable status filtering.`,choices:[`pending`,`approved`,`rejected`,`all`]}).option(`latest-only`,{type:`string`,description:`When true, return only the latest revision in each approval chain (rows not superseded by another approval).`,choices:[`true`,`false`]}).option(`limit`,{type:`number`,description:`Limit`}).option(`offset`,{type:`number`,description:`Offset`}).option(`reviewer-scope`,{type:`string`,description:`Filter approvals by reviewer scope.`,choices:[`default`,`email`,`unresolved`]}).option(`change-type`,{type:`string`,description:`Filter approvals by proposed mutation type.`,choices:[`create`,`update`,`delete`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const vr={command:`list`,describe:`List rule approvals with optional status, revision, reviewer-scope, and mutation-type filtering.`,builder:h(_r),handler:async n=>{let c={status:n.status,latest_only:n[`latest-only`],limit:n.limit,offset:n.offset,reviewer_scope:n[`reviewer-scope`],change_type:n[`change-type`]};if(n.dryRun){a({command:`cf cloudforce-one rules approvals list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/approvals`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(n),u=n.local?s:await t();n.accountId=u,i(await o(`Loading`,async()=>l.cloudforceOne.rules.approvals.list({account_id:u,...c})),{successLabel:`Loaded`})}},yr={command:`approvals`,describe:`Operations for rules.approvals`,builder:e=>e.command(gr).command(vr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function br(e){return e.option(`commit-message`,{type:`string`,description:`Human-readable justification for this change. Required for internal-account submissions; optional for customer accounts and automated sync.`}).option(`content`,{type:`string`,description:`The content field`}).option(`description`,{type:`string`,description:`Human-readable description of the rule. Auto-extracted from YARA meta if present.`}).option(`enabled`,{type:`boolean`,description:`Whether this rule is active for dice consumers.`,default:!0}).option(`is-public`,{type:`boolean`,description:`Whether this rule is visible to other internal accounts.`,default:!1}).option(`name`,{type:`string`,description:`The name field`}).option(`namespaces`,{type:`string`,array:!0,description:`Optional WfP deployment tags (customer rules only). Internal rules leave empty.`}).option(`path`,{type:`string`,description:`The path field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xr={command:`create`,describe:`Create a new detection rule.`,builder:br,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({commit_message:u(n[`commit-message`],`commit-message`,`text`),content:u(n.content,`content`,`text`),description:u(n.description,`description`,`text`),enabled:n.enabled,is_public:n[`is-public`],name:u(n.name,`name`,`text`),namespaces:n.namespaces,path:u(n.path,`path`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.rules.create({...e,account_id:f})),{successLabel:`Created`});return}n.content===void 0&&(n.content=await p(`content`,`The content field`)),n.name===void 0&&(n.name=await p(`name`,`The name field`)),n.path===void 0&&(n.path=await p(`path`,`The path field`));let m=l({commit_message:u(n[`commit-message`],`commit-message`,`text`),content:u(n.content,`content`,`text`),description:u(n.description,`description`,`text`),enabled:n.enabled,is_public:n[`is-public`],name:u(n.name,`name`,`text`),namespaces:n.namespaces,path:u(n.path,`path`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.rules.create({...m,account_id:f})),{successLabel:`Created`})}};function Sr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Cr={command:`rules`,describe:`Delete all rules in an account.`,builder:Sr,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules delete all rules`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();if(n.accountId=l,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>c.cloudforceOne.rules.delete.all.rules({account_id:l})),{successLabel:`Deleted`})}},wr={command:`all`,describe:`Rules operations`,builder:e=>e.command(Cr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Tr(e){return e.positional(`id`,{type:`string`,description:`The unique identifier for the rule.`,demandOption:!0}).option(`commit-message`,{type:`string`,description:`Human-readable justification for the deletion. Required for internal-account submissions; optional for customer accounts and automated sync.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Er={command:`rule <id>`,describe:`Delete an existing rule.`,builder:Tr,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules delete one rule`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/${n.id==null?`<id>`:encodeURIComponent(String(n.id))}`,pathParams:{id:String(n.id??``)},bodyKind:`json`,body:n.body===void 0?l({commit_message:u(n[`commit-message`],`commit-message`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}if(n.body){let e=c(n.body);i(await o(`Deleting`,async()=>d.cloudforceOne.rules.delete.one.rule({...e,account_id:f,id:n.id})),{successLabel:`Deleted`});return}let p=l({commit_message:u(n[`commit-message`],`commit-message`,`text`)});i(await o(`Deleting`,async()=>d.cloudforceOne.rules.delete.one.rule({...p,account_id:f,id:n.id})),{successLabel:`Deleted`})}},Dr={command:`one`,describe:`Rules operations`,builder:e=>e.command(Er).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Or={command:`delete`,describe:`Operations for rules.delete`,builder:e=>e.command(wr).command(Dr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function kr(e){return e.option(`condition-operator`,{type:`string`,description:`The condition.operator field`,choices:[`and`,`or`]}).option(`condition-type`,{type:`string`,description:`The condition.type field`,choices:[`group`]}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`,default:!0}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ar={command:`create`,describe:`Create a structured email rule.`,builder:kr,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules email create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/structured`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({condition:{operator:u(n[`condition-operator`],`condition-operator`,`text`),type:u(n[`condition-type`],`condition-type`,`text`)},description:u(n.description,`description`,`text`),enabled:n.enabled,name:u(n.name,`name`,`text`)}):c(n.body)});return}let d=await r(n),m=n.local?s:await t();if(n.accountId=m,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.rules.email.create({...e,account_id:m})),{successLabel:`Created`});return}n[`condition-operator`]===void 0&&(n[`condition-operator`]=await f(`condition-operator`,`The condition.operator field`,[`and`,`or`])),n[`condition-type`]===void 0&&(n[`condition-type`]=await f(`condition-type`,`The condition.type field`,[`group`])),n.name===void 0&&(n.name=await p(`name`,`The name field`));let h=l({condition:{operator:u(n[`condition-operator`],`condition-operator`,`text`),type:u(n[`condition-type`],`condition-type`,`text`)},description:u(n.description,`description`,`text`),enabled:n.enabled,name:u(n.name,`name`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.rules.email.create({...h,account_id:m})),{successLabel:`Created`})}};function jr(e){return e.positional(`id`,{type:`string`,description:`The unique identifier for the rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Mr={command:`delete <id>`,describe:`Delete an existing structured email rule.`,builder:jr,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules email delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/structured/${n.id==null?`<id>`:encodeURIComponent(String(n.id))}`,pathParams:{id:String(n.id??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();if(n.accountId=l,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>c.cloudforceOne.rules.email.delete({account_id:l,id:n.id})),{successLabel:`Deleted`})}};function Nr(e){return e.positional(`id`,{type:`string`,description:`The unique identifier for the rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pr={command:`get <id>`,describe:`Get a structured email rule by ID.`,builder:Nr,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules email get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/structured/${n.id==null?`<id>`:encodeURIComponent(String(n.id))}`,pathParams:{id:String(n.id??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.rules.email.get({account_id:l,id:n.id})),{successLabel:`Loaded`})}};function Fr(e){return e.option(`limit`,{type:`number`,description:`Limit`}).option(`offset`,{type:`number`,description:`Offset`}).option(`search`,{type:`string`,description:`Search`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ir={command:`list`,describe:`List structured email rules.`,builder:Fr,handler:async n=>{let c={limit:n.limit,offset:n.offset,search:n.search};if(n.dryRun){a({command:`cf cloudforce-one rules email list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/structured`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(n),u=n.local?s:await t();n.accountId=u,i(await o(`Loading`,async()=>l.cloudforceOne.rules.email.list({account_id:u,...c})),{successLabel:`Loaded`})}};function Lr(e){return e.positional(`id`,{type:`string`,description:`The unique identifier for the rule.`,demandOption:!0}).option(`sample-json`,{type:`string`,description:`The sample_json field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Rr={command:`test <id>`,describe:`Test a structured email rule against sample email JSON.`,builder:Lr,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules email test`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/structured/${n.id==null?`<id>`:encodeURIComponent(String(n.id))}/test`,pathParams:{id:String(n.id??``)},bodyKind:`json`,body:n.body===void 0?l({sample_json:u(n[`sample-json`],`sample-json`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.rules.email.test({...e,account_id:f,id:n.id})),{successLabel:`Created`});return}n[`sample-json`]===void 0&&(n[`sample-json`]=await p(`sample-json`,`The sample_json field`));let m=l({sample_json:u(n[`sample-json`],`sample-json`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.rules.email.test({...m,account_id:f,id:n.id})),{successLabel:`Created`})}};function zr(e){return e.positional(`id`,{type:`string`,description:`The unique identifier for the rule.`,demandOption:!0}).option(`condition-operator`,{type:`string`,description:`The condition.operator field`,choices:[`and`,`or`]}).option(`condition-type`,{type:`string`,description:`The condition.type field`,choices:[`group`]}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`condition-operator`,`condition-type`].some(t=>e[t]!==void 0)){let t=[`condition-operator`,`condition-type`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --condition-* flag is set`)}return!0})}const Br={command:`update <id>`,describe:`Update an existing structured email rule.`,builder:zr,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules email update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/structured/${n.id==null?`<id>`:encodeURIComponent(String(n.id))}`,pathParams:{id:String(n.id??``)},bodyKind:`json`,body:n.body===void 0?l({condition:{operator:u(n[`condition-operator`],`condition-operator`,`text`),type:u(n[`condition-type`],`condition-type`,`text`)},description:u(n.description,`description`,`text`),enabled:n.enabled,name:u(n.name,`name`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Updating`,async()=>d.cloudforceOne.rules.email.update({...e,account_id:f,id:n.id})),{successLabel:`Updated`});return}let p=l({condition:{operator:u(n[`condition-operator`],`condition-operator`,`text`),type:u(n[`condition-type`],`condition-type`,`text`)},description:u(n.description,`description`,`text`),enabled:n.enabled,name:u(n.name,`name`,`text`)});i(await o(`Updating`,async()=>d.cloudforceOne.rules.email.update({...p,account_id:f,id:n.id})),{successLabel:`Updated`})}};function Vr(e){return e.option(`condition-operator`,{type:`string`,description:`The condition.operator field`,choices:[`and`,`or`]}).option(`condition-type`,{type:`string`,description:`The condition.type field`,choices:[`group`]}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`,default:!0}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Hr={command:`validate`,describe:`Validate structured email rule syntax and metadata.`,builder:Vr,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules email validate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/structured/validate`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({condition:{operator:u(n[`condition-operator`],`condition-operator`,`text`),type:u(n[`condition-type`],`condition-type`,`text`)},description:u(n.description,`description`,`text`),enabled:n.enabled,name:u(n.name,`name`,`text`)}):c(n.body)});return}let d=await r(n),m=n.local?s:await t();if(n.accountId=m,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.rules.email.validate({...e,account_id:m})),{successLabel:`Created`});return}n[`condition-operator`]===void 0&&(n[`condition-operator`]=await f(`condition-operator`,`The condition.operator field`,[`and`,`or`])),n[`condition-type`]===void 0&&(n[`condition-type`]=await f(`condition-type`,`The condition.type field`,[`group`])),n.name===void 0&&(n.name=await p(`name`,`The name field`));let h=l({condition:{operator:u(n[`condition-operator`],`condition-operator`,`text`),type:u(n[`condition-type`],`condition-type`,`text`)},description:u(n.description,`description`,`text`),enabled:n.enabled,name:u(n.name,`name`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.rules.email.validate({...h,account_id:m})),{successLabel:`Created`})}},Ur={command:`email`,describe:`Operations for rules.email`,builder:e=>e.command(Ar).command(Mr).command(Pr).command(Ir).command(Rr).command(Br).command(Hr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Wr(e){return e.option(`namespace`,{type:`string`,array:!0,description:`The namespace field`}).option(`tag-match`,{type:`string`,array:!0,description:`The tag_match field`}).option(`worker-name`,{type:`string`,array:!0,description:`The worker_name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Gr={command:`create`,describe:`Add regex patterns to per-account exemption rules (union semantics). Missing keys leave that type untouched; duplicates are silently deduped.`,builder:Wr,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules exemptions create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/exemptions`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({namespace:n.namespace,tag_match:n[`tag-match`],worker_name:n[`worker-name`]}):c(n.body)});return}let u=await r(n),d=n.local?s:await t();if(n.accountId=d,n.body){let e=c(n.body);i(await o(`Creating`,async()=>u.cloudforceOne.rules.exemptions.create({body:e,account_id:d})),{successLabel:`Created`});return}let f=l({namespace:n.namespace,tag_match:n[`tag-match`],worker_name:n[`worker-name`]});i(await o(`Creating`,async()=>u.cloudforceOne.rules.exemptions.create({body:f,account_id:d})),{successLabel:`Created`})}};function Kr(e){return e.option(`namespace`,{type:`string`,array:!0,description:`The namespace field`}).option(`tag-match`,{type:`string`,array:!0,description:`The tag_match field`}).option(`worker-name`,{type:`string`,array:!0,description:`The worker_name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const qr={command:`delete`,describe:`Remove regex patterns from per-account exemption rules. Missing keys leave that type untouched; non-existent patterns are silently skipped.`,builder:Kr,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules exemptions delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/exemptions`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({namespace:n.namespace,tag_match:n[`tag-match`],worker_name:n[`worker-name`]}):c(n.body)});return}let u=await r(n),d=n.local?s:await t();if(n.accountId=d,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}if(n.body){let e=c(n.body);i(await o(`Deleting`,async()=>u.cloudforceOne.rules.exemptions.delete({body:e,account_id:d})),{successLabel:`Deleted`});return}let f=l({namespace:n.namespace,tag_match:n[`tag-match`],worker_name:n[`worker-name`]});i(await o(`Deleting`,async()=>u.cloudforceOne.rules.exemptions.delete({body:f,account_id:d})),{successLabel:`Deleted`})}};function Jr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yr={command:`get`,describe:`Get all exemption rule patterns for the account, grouped by type.`,builder:Jr,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules exemptions get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/exemptions`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.rules.exemptions.get({account_id:l})),{successLabel:`Loaded`})}};function Xr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Zr={command:`update`,describe:`Replace existing exemption patterns with new values. Each key maps to an array of {old_pattern, new_pattern} entries. Missing keys leave that type untouched. Fails if any old pattern is not found or any new pattern already exists.`,builder:Xr,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules exemptions update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/exemptions`,pathParams:{},bodyKind:`json`,body:n.body===void 0?void 0:c(n.body)});return}let l=await r(n),u=n.local?s:await t();if(n.accountId=u,n.body){let e=c(n.body);i(await o(`Updating`,async()=>l.cloudforceOne.rules.exemptions.update({...e,account_id:u})),{successLabel:`Updated`});return}i(await o(`Updating`,async()=>l.cloudforceOne.rules.exemptions.update({account_id:u})),{successLabel:`Updated`})}},Qr={command:`exemptions`,describe:`Operations for rules.exemptions`,builder:e=>e.command(Gr).command(qr).command(Yr).command(Zr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $r(e){return e.positional(`id`,{type:`string`,description:`The unique identifier for the rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ei={command:`get <id>`,describe:`Get a single rule by ID.`,builder:$r,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/${n.id==null?`<id>`:encodeURIComponent(String(n.id))}`,pathParams:{id:String(n.id??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.rules.get({account_id:l,id:n.id})),{successLabel:`Loaded`})}};function ti(e){return e.option(`namespace`,{type:`string`,description:`Filter by namespace. Repeat the parameter to filter by multiple namespaces (e.g. namespace=foo&namespace=bar).`}).option(`path`,{type:`string`,description:"Filter by path using exact-match semantics (no descendant matching). Omit the parameter to return rules from all paths. Pass an empty string (path=) to return only rules with an empty/uncategorized path. Pass a non-empty value (e.g. path=yara) for an exact match against that path. Repeat the parameter (e.g. path=yara&path=expr) to OR-match across multiple paths (SQL `IN (...)` semantics). Note: the `recursive` flag does NOT affect path filtering — it only affects namespace filtering for customer accounts."}).option(`recursive`,{type:`string`,description:`Customer accounts only: when true, namespace filtering matches descendants. Does NOT affect path filtering (paths are always exact-match).`,choices:[`true`,`false`]}).option(`search`,{type:`string`,description:`Search`}).option(`is-public`,{type:`string`,description:`Filter by public visibility.`,choices:[`true`,`false`]}).option(`limit`,{type:`number`,description:`Limit`}).option(`offset`,{type:`number`,description:`Offset`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ni={command:`list`,describe:`List all rules for an account with optional filtering.`,builder:h(ti),handler:async n=>{let c={namespace:n.namespace,path:n.path,recursive:n.recursive,search:n.search,is_public:n[`is-public`],limit:n.limit,offset:n.offset};if(n.dryRun){a({command:`cf cloudforce-one rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(n),u=n.local?s:await t();n.accountId=u,i(await o(`Loading`,async()=>l.cloudforceOne.rules.list({account_id:u,...c})),{successLabel:`Loaded`})}};function ri(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ii={command:`get`,describe:`Get DFP managed rule metadata (name and description) from YARA rules.`,builder:ri,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules managed get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/managed`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.rules.managed.get({account_id:l})),{successLabel:`Loaded`})}},ai={command:`managed`,describe:`Operations for rules.managed`,builder:e=>e.command(ii).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function oi(e){return e.option(`namespace`,{type:`string`,description:`Filter by namespace. Repeat the parameter to filter by multiple namespaces (e.g. namespace=foo&namespace=bar).`}).option(`path`,{type:`string`,description:"Filter by path using exact-match semantics (no descendant matching). Omit the parameter to return rules from all paths. Pass an empty string (path=) to return only rules with an empty/uncategorized path. Pass a non-empty value (e.g. path=yara) for an exact match against that path. Repeat the parameter (e.g. path=yara&path=expr) to OR-match across multiple paths (SQL `IN (...)` semantics). Note: the `recursive` flag does NOT affect path filtering — it only affects namespace filtering for customer accounts."}).option(`recursive`,{type:`string`,description:`Customer accounts only: when true, namespace filtering matches descendants. Does NOT affect path filtering (paths are always exact-match).`,choices:[`true`,`false`]}).option(`search`,{type:`string`,description:`Search`}).option(`is-public`,{type:`string`,description:`Filter by public visibility.`,choices:[`true`,`false`]}).option(`limit`,{type:`number`,description:`Limit`}).option(`offset`,{type:`number`,description:`Offset`}).option(`query`,{type:`string`,description:`Natural-language or keyword search query.`,demandOption:!0}).option(`mode`,{type:`string`,description:`Retrieval strategy used for the query.`,choices:[`exact`,`hybrid`,`vector`,`keyword`]}).option(`language`,{type:`string`,description:`Filter results by rule language.`,choices:[`yara`,`js`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const si={command:`search`,describe:`Search rules using hybrid, vector, keyword, or exact retrieval, backed by AI Search with a SQL fallback.`,builder:h(oi),handler:async n=>{let c={namespace:n.namespace,path:n.path,recursive:n.recursive,search:n.search,is_public:n[`is-public`],limit:n.limit,offset:n.offset,query:n.query,mode:n.mode,language:n.language};if(n.dryRun){a({command:`cf cloudforce-one rules search`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/search`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(n),u=n.local?s:await t();n.accountId=u,i(await o(`Loading`,async()=>l.cloudforceOne.rules.search({account_id:u,...c})),{successLabel:`Loaded`})}};function ci(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const li={command:`get`,describe:`Get statistics about rules for the dashboard.`,builder:ci,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules stats get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/stats`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.rules.stats.get({account_id:l})),{successLabel:`Loaded`})}},ui={command:`stats`,describe:`Rules operations`,builder:e=>e.command(li).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function di(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fi={command:`get`,describe:`Get the folder tree structure for rules navigation.`,builder:di,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules tree get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/tree`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.rules.tree.get({account_id:l})),{successLabel:`Loaded`})}},pi={command:`tree`,describe:`Rules operations`,builder:e=>e.command(fi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function mi(e){return e.positional(`id`,{type:`string`,description:`The unique identifier for the rule.`,demandOption:!0}).option(`commit-message`,{type:`string`,description:`Human-readable justification for this change. Required for internal-account submissions; optional for customer accounts and automated sync.`}).option(`content`,{type:`string`,description:`The content field`}).option(`description`,{type:`string`,description:`Human-readable description of the rule. Auto-extracted from YARA meta if present.`}).option(`enabled`,{type:`boolean`,description:`Whether this rule is active for dice consumers.`}).option(`is-public`,{type:`boolean`,description:`Whether this rule is visible to other internal accounts.`}).option(`name`,{type:`string`,description:`The name field`}).option(`namespaces`,{type:`string`,array:!0,description:`The namespaces field`}).option(`path`,{type:`string`,description:`Path change goes through approval workflow.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const hi={command:`update <id>`,describe:`Update an existing rule.`,builder:mi,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/${n.id==null?`<id>`:encodeURIComponent(String(n.id))}`,pathParams:{id:String(n.id??``)},bodyKind:`json`,body:n.body===void 0?l({commit_message:u(n[`commit-message`],`commit-message`,`text`),content:u(n.content,`content`,`text`),description:u(n.description,`description`,`text`),enabled:n.enabled,is_public:n[`is-public`],name:u(n.name,`name`,`text`),namespaces:n.namespaces,path:u(n.path,`path`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Updating`,async()=>d.cloudforceOne.rules.update({...e,account_id:f,id:n.id})),{successLabel:`Updated`});return}let p=l({commit_message:u(n[`commit-message`],`commit-message`,`text`),content:u(n.content,`content`,`text`),description:u(n.description,`description`,`text`),enabled:n.enabled,is_public:n[`is-public`],name:u(n.name,`name`,`text`),namespaces:n.namespaces,path:u(n.path,`path`,`text`)});i(await o(`Updating`,async()=>d.cloudforceOne.rules.update({...p,account_id:f,id:n.id})),{successLabel:`Updated`})}};function gi(e){return e.option(`content`,{type:`string`,description:`The content field`}).option(`exclude-rule-id`,{type:`string`,description:`The excludeRuleId field`}).option(`name`,{type:`string`,description:`The name field`}).option(`namespaces`,{type:`string`,array:!0,description:`The namespaces field`}).option(`path`,{type:`string`,description:`The path field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _i={command:`create`,describe:`Validate rule syntax, name uniqueness, namespace, and meta checks.`,builder:gi,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one rules validate create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/rules/validate`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({content:u(n.content,`content`,`text`),excludeRuleId:u(n[`exclude-rule-id`],`exclude-rule-id`,`text`),name:u(n.name,`name`,`text`),namespaces:n.namespaces,path:u(n.path,`path`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.rules.validate.create({...e,account_id:f})),{successLabel:`Created`});return}n.content===void 0&&(n.content=await p(`content`,`The content field`)),n.name===void 0&&(n.name=await p(`name`,`The name field`));let m=l({content:u(n.content,`content`,`text`),excludeRuleId:u(n[`exclude-rule-id`],`exclude-rule-id`,`text`),name:u(n.name,`name`,`text`),namespaces:n.namespaces,path:u(n.path,`path`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.rules.validate.create({...m,account_id:f})),{successLabel:`Created`})}},vi={command:`validate`,describe:`Rules operations`,builder:e=>e.command(_i).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},yi={command:`rules`,describe:`Rules operations`,builder:e=>e.command(xr).command(ei).command(ni).command(si).command(hi).command(yr).command(Or).command(Ur).command(Qr).command(ai).command(ui).command(pi).command(vi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bi(e){return e.option(`frequency`,{type:`number`,description:`Defines the number of days between each scan (0 = One-off scan).`}).option(`ips`,{type:`string`,array:!0,description:`Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.`}).option(`ports`,{type:`string`,array:!0,description:`Defines a list of ports to scan. Valid values are:"default", "all", or a comma-separated list of ports or range of ports (e.g. ["1-80", "443"]). "default" scans the 100 most commonly open ports.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xi={command:`create`,describe:`Create a new Scan Config`,builder:bi,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one scans config create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/scans/config`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({frequency:n.frequency,ips:n.ips,ports:n.ports}):c(n.body)});return}let u=await r(n),d=n.local?s:await t();if(n.accountId=d,n.body){let e=c(n.body);i(await o(`Creating`,async()=>u.cloudforceOne.scans.config.create({...e,account_id:d})),{successLabel:`Created`});return}if(n.ips===void 0)throw Error(`--ips is required (or pass --body with this field set).`);let f=l({frequency:n.frequency,ips:n.ips,ports:n.ports});i(await o(`Creating`,async()=>u.cloudforceOne.scans.config.create({...f,account_id:d})),{successLabel:`Created`})}};function Si(e){return e.positional(`config-id`,{type:`string`,description:`Defines the Config ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ci={command:`delete <config-id>`,describe:`Delete a Scan Config`,builder:Si,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one scans config delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/scans/config/${n[`config-id`]==null?`<config-id>`:encodeURIComponent(String(n[`config-id`]))}`,pathParams:{"config-id":String(n[`config-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();if(n.accountId=l,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>c.cloudforceOne.scans.config.delete({account_id:l,config_id:n[`config-id`]})),{successLabel:`Deleted`})}};function wi(e){return e.positional(`config-id`,{type:`string`,description:`Defines the Config ID.`,demandOption:!0}).option(`frequency`,{type:`number`,description:`Defines the number of days between each scan (0 = One-off scan).`}).option(`ips`,{type:`string`,array:!0,description:`Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.`}).option(`ports`,{type:`string`,array:!0,description:`Defines a list of ports to scan. Valid values are:"default", "all", or a comma-separated list of ports or range of ports (e.g. ["1-80", "443"]). "default" scans the 100 most commonly open ports.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ti={command:`edit <config-id>`,describe:`Update an existing Scan Config`,builder:wi,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one scans config edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/scans/config/${n[`config-id`]==null?`<config-id>`:encodeURIComponent(String(n[`config-id`]))}`,pathParams:{"config-id":String(n[`config-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({frequency:n.frequency,ips:n.ips,ports:n.ports}):c(n.body)});return}let u=await r(n),d=n.local?s:await t();if(n.accountId=d,n.body){let e=c(n.body);i(await o(`Updating`,async()=>u.cloudforceOne.scans.config.edit({...e,account_id:d,config_id:n[`config-id`]})),{successLabel:`Updated`});return}let f=l({frequency:n.frequency,ips:n.ips,ports:n.ports});i(await o(`Updating`,async()=>u.cloudforceOne.scans.config.edit({...f,account_id:d,config_id:n[`config-id`]})),{successLabel:`Updated`})}};function Ei(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Di={command:`list`,describe:`List Scan Configs`,builder:Ei,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one scans config list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/scans/config`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.scans.config.list({account_id:l})),{successLabel:`Loaded`})}},Oi={command:`config`,describe:`Scan URLs, IPs, and domains for threat intelligence indicators`,builder:e=>e.command(xi).command(Ci).command(Ti).command(Di).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ki(e){return e.positional(`config-id`,{type:`string`,description:`Defines the Config ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ai={command:`get <config-id>`,describe:`Get the Latest Scan Result`,builder:ki,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one scans results get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/scans/results/${n[`config-id`]==null?`<config-id>`:encodeURIComponent(String(n[`config-id`]))}`,pathParams:{"config-id":String(n[`config-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.scans.results.get({account_id:l,config_id:n[`config-id`]})),{successLabel:`Loaded`})}},ji={command:`results`,describe:`Scan URLs, IPs, and domains for threat intelligence indicators`,builder:e=>e.command(Ai).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Mi={command:`scans`,describe:`Operations for scans`,builder:e=>e.command(Oi).command(ji).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ni(e){return e.option(`dataset-ids`,{type:`string`,description:`Array of dataset IDs to query attackers from. If not provided, uses the default dataset.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pi={command:`list`,describe:`Lists known threat attackers tracked in Cloudforce One threat intelligence.`,builder:Ni,handler:async n=>{let c={datasetIds:n[`dataset-ids`]};if(n.dryRun){a({command:`cf cloudforce-one threat-events attackers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/attackers`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(n),u=n.local?s:await t();n.accountId=u,i(await o(`Loading`,async()=>l.cloudforceOne.threatEvents.attackers.list({account_id:u,...c})),{successLabel:`Loaded`})}},Fi={command:`attackers`,describe:`Threat event feed — structured intelligence on attacks, campaigns, and indicators of compromise`,builder:e=>e.command(Pi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ii(e){return e.option(`dataset-id`,{type:`string`,description:`The datasetId field`}).option(`include-created-events`,{type:`boolean`,description:`When true, response includes array of created event UUIDs and shard IDs. Useful for tracking which events were created and where.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Li={command:`bulk-create`,describe:"The `datasetId` parameter must be defined. To list existing datasets (and their IDs) in your account, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint.",builder:Ii,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events bulk-create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/create/bulk`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({datasetId:u(n[`dataset-id`],`dataset-id`,`text`),includeCreatedEvents:n[`include-created-events`]}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.threatEvents.bulkCreate({...e,account_id:f})),{successLabel:`Created`});return}n[`dataset-id`]===void 0&&(n[`dataset-id`]=await p(`dataset-id`,`The datasetId field`));let m=l({datasetId:u(n[`dataset-id`],`dataset-id`,`text`),includeCreatedEvents:n[`include-created-events`]});i(await o(`Creating`,async()=>d.cloudforceOne.threatEvents.bulkCreate({...m,account_id:f})),{successLabel:`Created`})}};function Ri(e){return e.option(`kill-chain`,{type:`number`,description:`The killChain field`}).option(`mitre-attack`,{type:`string`,array:!0,description:`The mitreAttack field`}).option(`mitre-capec`,{type:`string`,array:!0,description:`The mitreCapec field`}).option(`name`,{type:`string`,description:`The name field`}).option(`shortname`,{type:`string`,description:`The shortname field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const zi={command:`create`,describe:`Creates a new threat event category in Cloudforce One for organizing and classifying threat events.`,builder:Ri,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events categories create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/categories/create`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({killChain:n[`kill-chain`],mitreAttack:n[`mitre-attack`],mitreCapec:n[`mitre-capec`],name:u(n.name,`name`,`text`),shortname:u(n.shortname,`shortname`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.threatEvents.categories.create({...e,account_id:f})),{successLabel:`Created`});return}if(n[`kill-chain`]===void 0)throw Error(`--kill-chain is required (or pass --body with this field set).`);n.name===void 0&&(n.name=await p(`name`,`The name field`));let m=l({killChain:n[`kill-chain`],mitreAttack:n[`mitre-attack`],mitreCapec:n[`mitre-capec`],name:u(n.name,`name`,`text`),shortname:u(n.shortname,`shortname`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.threatEvents.categories.create({...m,account_id:f})),{successLabel:`Created`})}};function Bi(e){return e.positional(`category-id`,{type:`string`,description:`Category UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Vi={command:`delete <category-id>`,describe:`Removes a threat event category from Cloudforce One.`,builder:Bi,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events categories delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/categories/${n[`category-id`]==null?`<category-id>`:encodeURIComponent(String(n[`category-id`]))}`,pathParams:{"category-id":String(n[`category-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();if(n.accountId=l,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}i(await o(`Deleting`,async()=>c.cloudforceOne.threatEvents.categories.delete({account_id:l,category_id:n[`category-id`]})),{successLabel:`Deleted`})}};function Hi(e){return e.positional(`category-id`,{type:`string`,description:`Category UUID.`,demandOption:!0}).option(`kill-chain`,{type:`number`,description:`The killChain field`}).option(`mitre-attack`,{type:`string`,array:!0,description:`The mitreAttack field`}).option(`mitre-capec`,{type:`string`,array:!0,description:`The mitreCapec field`}).option(`name`,{type:`string`,description:`The name field`}).option(`shortname`,{type:`string`,description:`The shortname field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ui={command:`edit <category-id>`,describe:`Partially updates a threat event category in Cloudforce One, modifying specific fields without replacing the entire category.`,builder:Hi,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events categories edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/categories/${n[`category-id`]==null?`<category-id>`:encodeURIComponent(String(n[`category-id`]))}`,pathParams:{"category-id":String(n[`category-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({killChain:n[`kill-chain`],mitreAttack:n[`mitre-attack`],mitreCapec:n[`mitre-capec`],name:u(n.name,`name`,`text`),shortname:u(n.shortname,`shortname`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Updating`,async()=>d.cloudforceOne.threatEvents.categories.edit({...e,account_id:f,category_id:n[`category-id`]})),{successLabel:`Updated`});return}let p=l({killChain:n[`kill-chain`],mitreAttack:n[`mitre-attack`],mitreCapec:n[`mitre-capec`],name:u(n.name,`name`,`text`),shortname:u(n.shortname,`shortname`,`text`)});i(await o(`Updating`,async()=>d.cloudforceOne.threatEvents.categories.edit({...p,account_id:f,category_id:n[`category-id`]})),{successLabel:`Updated`})}};function Wi(e){return e.positional(`category-id`,{type:`string`,description:`Category UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gi={command:`get <category-id>`,describe:`Retrieves details for a specific threat event category.`,builder:Wi,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events categories get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/categories/${n[`category-id`]==null?`<category-id>`:encodeURIComponent(String(n[`category-id`]))}`,pathParams:{"category-id":String(n[`category-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.threatEvents.categories.get({account_id:l,category_id:n[`category-id`]})),{successLabel:`Loaded`})}};function Ki(e){return e.option(`dataset-ids`,{type:`string`,description:`Array of dataset IDs to query categories from. If not provided, uses the default dataset.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qi={command:`list`,describe:`Lists all threat event categories configured for classifying and organizing threat events.`,builder:Ki,handler:async n=>{let c={datasetIds:n[`dataset-ids`]};if(n.dryRun){a({command:`cf cloudforce-one threat-events categories list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/categories`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(n),u=n.local?s:await t();n.accountId=u,i(await o(`Loading`,async()=>l.cloudforceOne.threatEvents.categories.list({account_id:u,...c})),{successLabel:`Loaded`})}},Ji={command:`categories`,describe:`Threat event feed — structured intelligence on attacks, campaigns, and indicators of compromise`,builder:e=>e.command(zi).command(Vi).command(Ui).command(Gi).command(qi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Yi(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xi={command:`list`,describe:`Lists countries referenced in Cloudforce One threat intelligence data.`,builder:Yi,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events countries list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/countries`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.threatEvents.countries.list({account_id:l})),{successLabel:`Loaded`})}},Zi={command:`countries`,describe:`Threat event feed — structured intelligence on attacks, campaigns, and indicators of compromise`,builder:e=>e.command(Xi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qi(e){return e.option(`attacker`,{type:`string`,description:`The attacker field`}).option(`attacker-country`,{type:`string`,description:`The attackerCountry field`}).option(`category`,{type:`string`,description:`The category field`}).option(`dataset-id`,{type:`string`,description:`The datasetId field`}).option(`date`,{type:`string`,description:`The date field`}).option(`event`,{type:`string`,description:`The event field`}).option(`indicator`,{type:`string`,description:`The indicator field`}).option(`indicator-type`,{type:`string`,description:`The indicatorType field`}).option(`insight`,{type:`string`,description:`The insight field`}).option(`raw-source`,{type:`string`,description:`The raw.source field`}).option(`raw-tlp`,{type:`string`,description:`The raw.tlp field`}).option(`tags`,{type:`string`,array:!0,description:`The tags field`}).option(`target-country`,{type:`string`,description:`The targetCountry field`}).option(`target-industry`,{type:`string`,description:`The targetIndustry field`}).option(`tlp`,{type:`string`,description:`The tlp field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const $i={command:`create`,describe:"To create a dataset, see the [`Create Dataset`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create/) endpoint. When `datasetId` parameter is unspecified, it will be created in a default dataset named `Cloudforce One Threat Events`.",builder:Qi,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/create`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({attacker:u(n.attacker,`attacker`,`text`),attackerCountry:u(n[`attacker-country`],`attacker-country`,`text`),category:u(n.category,`category`,`text`),datasetId:u(n[`dataset-id`],`dataset-id`,`text`),date:u(n.date,`date`,`text`),event:u(n.event,`event`,`text`),indicator:u(n.indicator,`indicator`,`text`),indicatorType:u(n[`indicator-type`],`indicator-type`,`text`),insight:u(n.insight,`insight`,`text`),raw:{source:u(n[`raw-source`],`raw-source`,`text`),tlp:u(n[`raw-tlp`],`raw-tlp`,`text`)},tags:n.tags,targetCountry:u(n[`target-country`],`target-country`,`text`),targetIndustry:u(n[`target-industry`],`target-industry`,`text`),tlp:u(n.tlp,`tlp`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.threatEvents.create({...e,account_id:f})),{successLabel:`Created`});return}n.category===void 0&&(n.category=await p(`category`,`The category field`)),n.date===void 0&&(n.date=await p(`date`,`The date field`)),n.event===void 0&&(n.event=await p(`event`,`The event field`)),n.tlp===void 0&&(n.tlp=await p(`tlp`,`The tlp field`));let m=l({attacker:u(n.attacker,`attacker`,`text`),attackerCountry:u(n[`attacker-country`],`attacker-country`,`text`),category:u(n.category,`category`,`text`),datasetId:u(n[`dataset-id`],`dataset-id`,`text`),date:u(n.date,`date`,`text`),event:u(n.event,`event`,`text`),indicator:u(n.indicator,`indicator`,`text`),indicatorType:u(n[`indicator-type`],`indicator-type`,`text`),insight:u(n.insight,`insight`,`text`),raw:{source:u(n[`raw-source`],`raw-source`,`text`),tlp:u(n[`raw-tlp`],`raw-tlp`,`text`)},tags:n.tags,targetCountry:u(n[`target-country`],`target-country`,`text`),targetIndustry:u(n[`target-industry`],`target-industry`,`text`),tlp:u(n.tlp,`tlp`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.threatEvents.create({...m,account_id:f})),{successLabel:`Created`})}};function ea(e){return e.option(`is-public`,{type:`boolean`,description:`If true, then anyone can search the dataset. If false, then its limited to the account.`}).option(`name`,{type:`string`,description:`Used to describe the dataset within the account context.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ta={command:`create`,describe:`Creates a new threat event dataset in Cloudforce One for organizing related threat events.`,builder:ea,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events datasets create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/create`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({isPublic:n[`is-public`],name:u(n.name,`name`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.threatEvents.datasets.create({...e,account_id:f})),{successLabel:`Created`});return}if(n[`is-public`]===void 0)throw Error(`--is-public is required (or pass --body with this field set).`);n.name===void 0&&(n.name=await p(`name`,`Used to describe the dataset within the account context.`));let m=l({isPublic:n[`is-public`],name:u(n.name,`name`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.threatEvents.datasets.create({...m,account_id:f})),{successLabel:`Created`})}};function na(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID.`,demandOption:!0}).option(`is-public`,{type:`boolean`,description:`If true, then anyone can search the dataset. If false, then its limited to the account.`}).option(`name`,{type:`string`,description:`Used to describe the dataset within the account context.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ra={command:`edit <dataset-id>`,describe:`Partially updates a threat event dataset in Cloudforce One, modifying specific fields without replacing the entire dataset configuration.`,builder:na,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events datasets edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}`,pathParams:{"dataset-id":String(n[`dataset-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({isPublic:n[`is-public`],name:u(n.name,`name`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Updating`,async()=>d.cloudforceOne.threatEvents.datasets.edit({...e,account_id:f,dataset_id:n[`dataset-id`]})),{successLabel:`Updated`});return}if(n[`is-public`]===void 0)throw Error(`--is-public is required (or pass --body with this field set).`);n.name===void 0&&(n.name=await p(`name`,`Used to describe the dataset within the account context.`));let m=l({isPublic:n[`is-public`],name:u(n.name,`name`,`text`)});i(await o(`Updating`,async()=>d.cloudforceOne.threatEvents.datasets.edit({...m,account_id:f,dataset_id:n[`dataset-id`]})),{successLabel:`Updated`})}};function ia(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const aa={command:`get <dataset-id>`,describe:`Retrieves details for a specific threat event dataset.`,builder:ia,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events datasets get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}`,pathParams:{"dataset-id":String(n[`dataset-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.threatEvents.datasets.get({account_id:l,dataset_id:n[`dataset-id`]})),{successLabel:`Loaded`})}};function oa(e){return e.option(`include-deleted`,{type:`boolean`,description:"When true, include soft-deleted datasets in the response. Each item includes a `deletedAt` field (ISO 8601 or null). Default: false."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sa={command:`list`,describe:`Lists all threat event datasets configured in Cloudforce One.`,builder:oa,handler:async n=>{let c={includeDeleted:n[`include-deleted`]};if(n.dryRun){a({command:`cf cloudforce-one threat-events datasets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/dataset`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(n),u=n.local?s:await t();n.accountId=u,i(await o(`Loading`,async()=>l.cloudforceOne.threatEvents.datasets.list({account_id:u,...c})),{successLabel:`Loaded`})}};function ca(e){return e.positional(`event-id`,{type:`string`,description:`Event ID.`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const la={command:`raw <event-id>`,describe:`Retrieves the raw data associated with an event. Searches across all shards in the dataset.`,builder:ca,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events datasets raw`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/raw/${n[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(n[`dataset-id`]))}/${n[`event-id`]==null?`<event-id>`:encodeURIComponent(String(n[`event-id`]))}`,pathParams:{"event-id":String(n[`event-id`]??``),"dataset-id":String(n[`dataset-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.threatEvents.datasets.raw({account_id:l,dataset_id:n[`dataset-id`],event_id:n[`event-id`]})),{successLabel:`Loaded`})}},ua={command:`datasets`,describe:`Threat event feed — structured intelligence on attacks, campaigns, and indicators of compromise`,builder:e=>e.command(ta).command(ra).command(aa).command(sa).command(la).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function da(e){return e.positional(`event-id`,{type:`string`,description:`Event UUID.`,demandOption:!0}).option(`attacker`,{type:`string`,description:`The attacker field`}).option(`attacker-country`,{type:`string`,description:`The attackerCountry field`}).option(`category`,{type:`string`,description:`The category field`}).option(`created-at`,{type:`string`,description:`The createdAt field`}).option(`dataset-id`,{type:`string`,description:`Dataset ID containing the event to update.`}).option(`date`,{type:`string`,description:`The date field`}).option(`event`,{type:`string`,description:`The event field`}).option(`indicator`,{type:`string`,description:`The indicator field`}).option(`indicator-type`,{type:`string`,description:`The indicatorType field`}).option(`insight`,{type:`string`,description:`The insight field`}).option(`raw-source`,{type:`string`,description:`The raw.source field`}).option(`raw-tlp`,{type:`string`,description:`The raw.tlp field`}).option(`target-country`,{type:`string`,description:`The targetCountry field`}).option(`target-industry`,{type:`string`,description:`The targetIndustry field`}).option(`tlp`,{type:`string`,description:`The tlp field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const fa={command:`edit <event-id>`,describe:`Partially updates a threat event in Cloudforce One, modifying specific fields without replacing the entire event.`,builder:da,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/${n[`event-id`]==null?`<event-id>`:encodeURIComponent(String(n[`event-id`]))}`,pathParams:{"event-id":String(n[`event-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({attacker:u(n.attacker,`attacker`,`text`),attackerCountry:u(n[`attacker-country`],`attacker-country`,`text`),category:u(n.category,`category`,`text`),createdAt:u(n[`created-at`],`created-at`,`text`),datasetId:u(n[`dataset-id`],`dataset-id`,`text`),date:u(n.date,`date`,`text`),event:u(n.event,`event`,`text`),indicator:u(n.indicator,`indicator`,`text`),indicatorType:u(n[`indicator-type`],`indicator-type`,`text`),insight:u(n.insight,`insight`,`text`),raw:{source:u(n[`raw-source`],`raw-source`,`text`),tlp:u(n[`raw-tlp`],`raw-tlp`,`text`)},targetCountry:u(n[`target-country`],`target-country`,`text`),targetIndustry:u(n[`target-industry`],`target-industry`,`text`),tlp:u(n.tlp,`tlp`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Updating`,async()=>d.cloudforceOne.threatEvents.edit({...e,account_id:f,event_id:n[`event-id`]})),{successLabel:`Updated`});return}n[`dataset-id`]===void 0&&(n[`dataset-id`]=await p(`dataset-id`,`Dataset ID containing the event to update.`));let m=l({attacker:u(n.attacker,`attacker`,`text`),attackerCountry:u(n[`attacker-country`],`attacker-country`,`text`),category:u(n.category,`category`,`text`),createdAt:u(n[`created-at`],`created-at`,`text`),datasetId:u(n[`dataset-id`],`dataset-id`,`text`),date:u(n.date,`date`,`text`),event:u(n.event,`event`,`text`),indicator:u(n.indicator,`indicator`,`text`),indicatorType:u(n[`indicator-type`],`indicator-type`,`text`),insight:u(n.insight,`insight`,`text`),raw:{source:u(n[`raw-source`],`raw-source`,`text`),tlp:u(n[`raw-tlp`],`raw-tlp`,`text`)},targetCountry:u(n[`target-country`],`target-country`,`text`),targetIndustry:u(n[`target-industry`],`target-industry`,`text`),tlp:u(n.tlp,`tlp`,`text`)});i(await o(`Updating`,async()=>d.cloudforceOne.threatEvents.edit({...m,account_id:f,event_id:n[`event-id`]})),{successLabel:`Updated`})}};function pa(e){return e.positional(`event-id`,{type:`string`,description:`Event UUID.`,demandOption:!0}).option(`tags`,{type:`string`,array:!0,description:`The tags field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ma={command:`create <event-id>`,describe:`Adds a tag to a threat event in Cloudforce One for classification and filtering.`,builder:pa,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events event-tags create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/event_tag/${n[`event-id`]==null?`<event-id>`:encodeURIComponent(String(n[`event-id`]))}/create`,pathParams:{"event-id":String(n[`event-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({tags:n.tags}):c(n.body)});return}let u=await r(n),d=n.local?s:await t();if(n.accountId=d,n.body){let e=c(n.body);i(await o(`Creating`,async()=>u.cloudforceOne.threatEvents.eventTags.create({...e,account_id:d,event_id:n[`event-id`]})),{successLabel:`Created`});return}if(n.tags===void 0)throw Error(`--tags is required (or pass --body with this field set).`);let f=l({tags:n.tags});i(await o(`Creating`,async()=>u.cloudforceOne.threatEvents.eventTags.create({...f,account_id:d,event_id:n[`event-id`]})),{successLabel:`Created`})}};function ha(e){return e.positional(`event-id`,{type:`string`,description:`Event UUID.`,demandOption:!0}).option(`tags`,{type:`string`,array:!0,description:`The tags field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ga={command:`delete <event-id>`,describe:`Removes a tag from a threat event in Cloudforce One.`,builder:ha,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events event-tags delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/event_tag/${n[`event-id`]==null?`<event-id>`:encodeURIComponent(String(n[`event-id`]))}`,pathParams:{"event-id":String(n[`event-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({tags:n.tags}):c(n.body)});return}let u=await r(n),d=n.local?s:await t();if(n.accountId=d,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}if(n.body){let e=c(n.body);i(await o(`Deleting`,async()=>u.cloudforceOne.threatEvents.eventTags.delete({...e,account_id:d,event_id:n[`event-id`]})),{successLabel:`Deleted`});return}if(n.tags===void 0)throw Error(`--tags is required (or pass --body with this field set).`);let f=l({tags:n.tags});i(await o(`Deleting`,async()=>u.cloudforceOne.threatEvents.eventTags.delete({...f,account_id:d,event_id:n[`event-id`]})),{successLabel:`Deleted`})}},_a={command:`event-tags`,describe:`Threat event feed — structured intelligence on attacks, campaigns, and indicators of compromise`,builder:e=>e.command(ma).command(ga).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function va(e){return e.positional(`event-id`,{type:`string`,description:`Event UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ya={command:`get <event-id>`,describe:`This Method is deprecated. Please use /events/dataset/:dataset_id/events/:event_id instead.`,builder:va,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/${n[`event-id`]==null?`<event-id>`:encodeURIComponent(String(n[`event-id`]))}`,pathParams:{"event-id":String(n[`event-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.threatEvents.get({account_id:l,event_id:n[`event-id`]})),{successLabel:`Loaded`})}};function ba(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xa={command:`list`,describe:`This Method is deprecated. Please use /events/dataset/:dataset_id/indicatorTypes instead.`,builder:ba,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events indicator-types list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/indicatorTypes`,pathParams:{},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.threatEvents.indicatorTypes.list({account_id:l})),{successLabel:`Loaded`})}},Sa={command:`indicator-types`,describe:`Threat event feed — structured intelligence on attacks, campaigns, and indicators of compromise`,builder:e=>e.command(xa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ca(e){return e.option(`cursor`,{type:`string`,description:`Cursor for pagination. When provided, filters are embedded in the cursor so you only need to pass cursor and pageSize. Returned in the previous response's result_info.cursor field. Use cursor-based pagination for deep pagination (beyond 100,000 records) or for optimal performance.`}).option(`search`,{type:`string`,description:`Search`}).option(`page`,{type:`number`,description:`Page number (1-indexed) for offset-based pagination. Limited to offset of 100,000 records. For deep pagination, use cursor-based pagination instead.`}).option(`page-size`,{type:`number`,description:`Number of results per page. Maximum 25,000.`}).option(`order-by`,{type:`string`,description:`OrderBy`}).option(`order`,{type:`string`,description:`Order`,choices:[`asc`,`desc`]}).option(`dataset-id`,{type:`string`,description:`Dataset IDs to query events from (array of UUIDs), or special value 'all' or '*' to query all event datasets for the account. If not provided, uses the default dataset.`}).option(`force-refresh`,{type:`boolean`,description:`ForceRefresh`}).option(`format`,{type:`string`,description:`Format`,choices:[`json`,`stix2`,`taxii`]}).option(`cache`,{type:`string`,description:`Cache strategy. 'from-graph' serves results from the graph-node KV cache when all requested UUIDs are cached; falls back to normal path on partial/zero hit.`,choices:[`from-graph`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wa={command:`list`,describe:"Use `datasetId=all` or `datasetId=*` to query all event datasets for the account (limited to 50). When `datasetId` is unspecified, events are listed from the default Cloudforce One Threat Events dataset. To list existing datasets, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint.",builder:h(Ca),handler:async n=>{let c={cursor:n.cursor,search:n.search,page:n.page,pageSize:n[`page-size`],orderBy:n[`order-by`],order:n.order,datasetId:n[`dataset-id`],forceRefresh:n[`force-refresh`],format:n.format,cache:n.cache};if(n.dryRun){a({command:`cf cloudforce-one threat-events list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(n),u=n.local?s:await t();n.accountId=u,i(await o(`Loading`,async()=>l.cloudforceOne.threatEvents.list({account_id:u,...c})),{successLabel:`Loaded`})}};function Ta(e){return e.positional(`raw-id`,{type:`string`,description:`Raw Event UUID.`,demandOption:!0}).option(`event-id`,{type:`string`,description:`Event UUID.`,demandOption:!0}).option(`source`,{type:`string`,description:`The source field`}).option(`tlp`,{type:`string`,description:`The tlp field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ea={command:`edit <raw-id>`,describe:`Partially updates raw threat event data in Cloudforce One, modifying specific fields of the event.`,builder:Ta,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events raw edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/${n[`event-id`]==null?`<event-id>`:encodeURIComponent(String(n[`event-id`]))}/raw/${n[`raw-id`]==null?`<raw-id>`:encodeURIComponent(String(n[`raw-id`]))}`,pathParams:{"event-id":String(n[`event-id`]??``),"raw-id":String(n[`raw-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({source:u(n.source,`source`,`text`),tlp:u(n.tlp,`tlp`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Updating`,async()=>d.cloudforceOne.threatEvents.raw.edit({...e,account_id:f,event_id:n[`event-id`],raw_id:n[`raw-id`]})),{successLabel:`Updated`});return}let p=l({source:u(n.source,`source`,`text`),tlp:u(n.tlp,`tlp`,`text`)});i(await o(`Updating`,async()=>d.cloudforceOne.threatEvents.raw.edit({...p,account_id:f,event_id:n[`event-id`],raw_id:n[`raw-id`]})),{successLabel:`Updated`})}};function Da(e){return e.positional(`raw-id`,{type:`string`,description:`Raw Event UUID.`,demandOption:!0}).option(`event-id`,{type:`string`,description:`Event UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Oa={command:`get <raw-id>`,describe:`Retrieves raw threat event data for a specific event in Cloudforce One.`,builder:Da,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events raw get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/${n[`event-id`]==null?`<event-id>`:encodeURIComponent(String(n[`event-id`]))}/raw/${n[`raw-id`]==null?`<raw-id>`:encodeURIComponent(String(n[`raw-id`]))}`,pathParams:{"event-id":String(n[`event-id`]??``),"raw-id":String(n[`raw-id`]??``)},bodyKind:`none`});return}let c=await r(n),l=n.local?s:await t();n.accountId=l,i(await o(`Loading`,async()=>c.cloudforceOne.threatEvents.raw.get({account_id:l,event_id:n[`event-id`],raw_id:n[`raw-id`]})),{successLabel:`Loaded`})}},ka={command:`raw`,describe:`Threat event feed — structured intelligence on attacks, campaigns, and indicators of compromise`,builder:e=>e.command(Ea).command(Oa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Aa(e){return e.positional(`event-id`,{type:`string`,description:`Event UUID.`,demandOption:!0}).option(`events`,{type:`string`,array:!0,description:`The events field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ja={command:`delete <event-id>`,describe:`Removes a reference link between related threat events in Cloudforce One.`,builder:Aa,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events relate delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/relate/${n[`event-id`]==null?`<event-id>`:encodeURIComponent(String(n[`event-id`]))}`,pathParams:{"event-id":String(n[`event-id`]??``)},bodyKind:`json`,body:n.body===void 0?l({events:n.events}):c(n.body)});return}let u=await r(n),d=n.local?s:await t();if(n.accountId=d,!await m({force:!!n.force})){process.stderr.write(`Aborted.
+`);return}if(n.body){let e=c(n.body);i(await o(`Deleting`,async()=>u.cloudforceOne.threatEvents.relate.delete({...e,account_id:d,event_id:n[`event-id`]})),{successLabel:`Deleted`});return}if(n.events===void 0)throw Error(`--events is required (or pass --body with this field set).`);let f=l({events:n.events});i(await o(`Deleting`,async()=>u.cloudforceOne.threatEvents.relate.delete({...f,account_id:d,event_id:n[`event-id`]})),{successLabel:`Deleted`})}},Ma={command:`relate`,describe:`Threat event feed — structured intelligence on attacks, campaigns, and indicators of compromise`,builder:e=>e.command(ja).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Na(e){return e.option(`active-duration`,{type:`string`,description:`The activeDuration field`}).option(`actor-category`,{type:`string`,description:`Actor variety. Allowed values: Activist, Competitor, Customer, Crime Syndicate, Former Employee, Nation State, Organized Crime, Nation State Affiliated, Terrorist, Unaffiliated.`}).option(`actor-category-confidence`,{type:`number`,description:`Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.`}).option(`alias-group-names`,{type:`string`,array:!0,description:`The aliasGroupNames field`}).option(`alias-group-names-internal`,{type:`string`,array:!0,description:`The aliasGroupNamesInternal field`}).option(`analytic-priority`,{type:`number`,description:`The analyticPriority field`}).option(`attribution-confidence`,{type:`string`,description:`The attributionConfidence field`}).option(`attribution-confidence-score`,{type:`number`,description:`The attributionConfidenceScore field`}).option(`attribution-organization`,{type:`string`,description:`The attributionOrganization field`}).option(`category-uuid`,{type:`string`,description:`The categoryUuid field`}).option(`date-of-discovery`,{type:`string`,description:`Date the actor was discovered (ISO YYYY-MM-DD).`}).option(`external-reference-links`,{type:`string`,array:!0,description:`The externalReferenceLinks field`}).option(`internal-description`,{type:`string`,description:`The internalDescription field`}).option(`motive`,{type:`string`,description:`Actor motive. Allowed values: Convenience, Fear, Fun, Financial, Grudge, Ideology, Espionage.`}).option(`motive-confidence`,{type:`number`,description:`Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.`}).option(`opsec-level`,{type:`string`,description:`The opsecLevel field`}).option(`origin-country-confidence`,{type:`number`,description:`Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.`}).option(`origin-country-iso`,{type:`string`,description:`The originCountryISO field`}).option(`origin-country-tlp`,{type:`string`,description:`TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.`,choices:[`red`,`amber`,`green`,`white`]}).option(`priority`,{type:`number`,description:`The priority field`}).option(`sophistication-level`,{type:`string`,description:`The sophisticationLevel field`}).option(`value`,{type:`string`,description:`The value field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Pa={command:`create`,describe:`Creates a new tag to be used accross threat events.`,builder:Na,handler:async n=>{if(n.dryRun){a({command:`cf cloudforce-one threat-events tags create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/tags/create`,pathParams:{},bodyKind:`json`,body:n.body===void 0?l({activeDuration:u(n[`active-duration`],`active-duration`,`text`),actorCategory:u(n[`actor-category`],`actor-category`,`text`),actorCategoryConfidence:n[`actor-category-confidence`],aliasGroupNames:n[`alias-group-names`],aliasGroupNamesInternal:n[`alias-group-names-internal`],analyticPriority:n[`analytic-priority`],attributionConfidence:u(n[`attribution-confidence`],`attribution-confidence`,`text`),attributionConfidenceScore:n[`attribution-confidence-score`],attributionOrganization:u(n[`attribution-organization`],`attribution-organization`,`text`),categoryUuid:u(n[`category-uuid`],`category-uuid`,`text`),dateOfDiscovery:u(n[`date-of-discovery`],`date-of-discovery`,`text`),externalReferenceLinks:n[`external-reference-links`],internalDescription:u(n[`internal-description`],`internal-description`,`text`),motive:u(n.motive,`motive`,`text`),motiveConfidence:n[`motive-confidence`],opsecLevel:u(n[`opsec-level`],`opsec-level`,`text`),originCountryConfidence:n[`origin-country-confidence`],originCountryISO:u(n[`origin-country-iso`],`origin-country-iso`,`text`),originCountryTlp:u(n[`origin-country-tlp`],`origin-country-tlp`,`text`),priority:n.priority,sophisticationLevel:u(n[`sophistication-level`],`sophistication-level`,`text`),value:u(n.value,`value`,`text`)}):c(n.body)});return}let d=await r(n),f=n.local?s:await t();if(n.accountId=f,n.body){let e=c(n.body);i(await o(`Creating`,async()=>d.cloudforceOne.threatEvents.tags.create({...e,account_id:f})),{successLabel:`Created`});return}n.value===void 0&&(n.value=await p(`value`,`The value field`));let m=l({activeDuration:u(n[`active-duration`],`active-duration`,`text`),actorCategory:u(n[`actor-category`],`actor-category`,`text`),actorCategoryConfidence:n[`actor-category-confidence`],aliasGroupNames:n[`alias-group-names`],aliasGroupNamesInternal:n[`alias-group-names-internal`],analyticPriority:n[`analytic-priority`],attributionConfidence:u(n[`attribution-confidence`],`attribution-confidence`,`text`),attributionConfidenceScore:n[`attribution-confidence-score`],attributionOrganization:u(n[`attribution-organization`],`attribution-organization`,`text`),categoryUuid:u(n[`category-uuid`],`category-uuid`,`text`),dateOfDiscovery:u(n[`date-of-discovery`],`date-of-discovery`,`text`),externalReferenceLinks:n[`external-reference-links`],internalDescription:u(n[`internal-description`],`internal-description`,`text`),motive:u(n.motive,`motive`,`text`),motiveConfidence:n[`motive-confidence`],opsecLevel:u(n[`opsec-level`],`opsec-level`,`text`),originCountryConfidence:n[`origin-country-confidence`],originCountryISO:u(n[`origin-country-iso`],`origin-country-iso`,`text`),originCountryTlp:u(n[`origin-country-tlp`],`origin-country-tlp`,`text`),priority:n.priority,sophisticationLevel:u(n[`sophistication-level`],`sophistication-level`,`text`),value:u(n.value,`value`,`text`)});i(await o(`Creating`,async()=>d.cloudforceOne.threatEvents.tags.create({...m,account_id:f})),{successLabel:`Created`})}},Fa={command:`tags`,describe:`Threat event feed — structured intelligence on attacks, campaigns, and indicators of compromise`,builder:e=>e.command(Pa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ia(e){return e.option(`dataset-ids`,{type:`string`,description:`Array of dataset IDs to query target industries from. If not provided, uses the default dataset.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const La={command:`list`,describe:`Retrieves the catalog of industry classifications used in Cloudforce One threat intelligence.`,builder:Ia,handler:async n=>{let c={datasetIds:n[`dataset-ids`]};if(n.dryRun){a({command:`cf cloudforce-one threat-events target-industries list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await e()??`<account-id>`}/cloudforce-one/events/targetIndustries`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(n),u=n.local?s:await t();n.accountId=u,i(await o(`Loading`,async()=>l.cloudforceOne.threatEvents.targetIndustries.list({account_id:u,...c})),{successLabel:`Loaded`})}},Ra={command:`target-industries`,describe:`Threat event feed — structured intelligence on attacks, campaigns, and indicators of compromise`,builder:e=>e.command(La).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},za={command:`threat-events`,describe:`Threat event feed — structured intelligence on attacks, campaigns, and indicators of compromise`,builder:e=>e.command(Li).command($i).command(fa).command(ya).command(wa).command(Fi).command(Ji).command(Zi).command(ua).command(_a).command(Sa).command(ka).command(Ma).command(Fa).command(Ra).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ba={command:`cloudforce-one`,describe:`Threat intelligence platform — request investigations, scan indicators, and track threat events`,builder:e=>e.command(v).command(vn).command(mr).command(yi).command(Mi).command(za).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{Ba as default};