cf 0.5.0 → 0.7.0

package/dist/zero-trust-DAZoa-Aj.mjs

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+import{D as e,O as t,w as n}from"./oauth-DBJ5GSFk.mjs";import{i as r,n as i}from"./auth-CZ0E51rF.mjs";import{t as a}from"./output-B6fBFRqe.mjs";import{n as o,t as s}from"./progress-O88q63Bk.mjs";import{t as c}from"./local-C6TLPAT6.mjs";import{n as l,r as u,t as d}from"./body-parser-BO6mfo_W.mjs";import{n as f,t as p}from"./input-validation-BwUR9z8e.mjs";import{n as m,r as h,t as g}from"./prompt-DTAWiEm2.mjs";import{t as _}from"./cli-types-CFw6Xygp.mjs";import{n as v,t as ee}from"./raw-fetch-DgezeshQ.mjs";function te(e){return e.option(`allow-code-mode`,{type:`boolean`,description:"Deprecated: use `code_mode` for new integrations. `true` maps to any non-off Code Mode policy; `false` maps to `code_mode: off`. If both fields are sent, they must be consistent or the request returns a 400."}).option(`code-mode`,{type:`string`,description:"Code Mode policy for this portal. `off`: Code Mode is unavailable; query parameters are ignored. `opt_in`: Code Mode is off by default; clients turn it on with `?codemode=search_and_execute`. `default_on`: Code Mode is on by default; clients can opt out with `?codemode=off`. `enforced`: Code Mode is always on; query parameters are ignored. Defaults to `opt_in` when omitted on create. If both `code_mode` and `allow_code_mode` are sent, they must be consistent or the request returns a 400.",choices:[`off`,`opt_in`,`default_on`,`enforced`]}).option(`description`,{type:`string`,description:`Optional description of the MCP portal.`}).option(`hostname`,{type:`string`,description:`Hostname where the MCP portal is available.`}).option(`id`,{type:`string`,description:`Unique identifier for the MCP portal.`}).option(`name`,{type:`string`,description:`Display name for the MCP portal.`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound MCP traffic through Zero Trust Secure Web Gateway.`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const y={command:`create`,describe:`Creates a new MCP portal for managing AI tool access through Cloudflare Access.`,builder:te,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access ai-controls mcp portals create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/ai-controls/mcp/portals`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({allow_code_mode:e[`allow-code-mode`],code_mode:f(e[`code-mode`],`code-mode`,`text`),description:f(e.description,`description`,`text`),hostname:f(e.hostname,`hostname`,`text`),id:f(e.id,`id`,`text`),name:f(e.name,`name`,`text`),secure_web_gateway:e[`secure-web-gateway`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.access.aiControls.mcp.portals.create({...t,account_id:u})),{successLabel:`Created`});return}e.hostname===void 0&&(e.hostname=await h(`hostname`,`Hostname where the MCP portal is available.`)),e.id===void 0&&(e.id=await h(`id`,`Unique identifier for the MCP portal.`)),e.name===void 0&&(e.name=await h(`name`,`Display name for the MCP portal.`));let p=d({allow_code_mode:e[`allow-code-mode`],code_mode:f(e[`code-mode`],`code-mode`,`text`),description:f(e.description,`description`,`text`),hostname:f(e.hostname,`hostname`,`text`),id:f(e.id,`id`,`text`),name:f(e.name,`name`,`text`),secure_web_gateway:e[`secure-web-gateway`]});a(await s(`Creating`,async()=>r.zeroTrust.access.aiControls.mcp.portals.create({...p,account_id:u})),{successLabel:`Created`})}};function b(e){return e.positional(`id`,{type:`string`,description:`Unique identifier for the MCP portal.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const x={command:`delete <id>`,describe:`Deletes an MCP portal from the account.`,builder:b,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access ai-controls mcp portals delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/ai-controls/mcp/portals/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force,message:`This operation permanently deletes the MCP portal.`})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.access.aiControls.mcp.portals.delete({account_id:l,id:e.id})),{successLabel:`Deleted`})}};function S(e){return e.option(`page`,{type:`number`,description:`Page`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`search`,{type:`string`,description:`Search by id, name, hostname`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const C={command:`list`,describe:`Lists all MCP portals configured for the account.`,builder:S,handler:async e=>{let r={page:e.page,per_page:e[`per-page`],search:e.search};if(e.dryRun){o({command:`cf zero-trust access ai-controls mcp portals list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/ai-controls/mcp/portals`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.access.aiControls.mcp.portals.list({account_id:u,...r})),{successLabel:`Loaded`})}};function w(e){return e.positional(`id`,{type:`string`,description:`Unique identifier for the MCP portal.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const T={command:`read <id>`,describe:`Read the details of a single MCP Portal, including its configured servers.`,builder:w,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access ai-controls mcp portals read`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/ai-controls/mcp/portals/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.aiControls.mcp.portals.read({account_id:l,id:e.id})),{successLabel:`Loaded`})}};function E(e){return e.positional(`id`,{type:`string`,description:`Unique identifier for the MCP portal.`,demandOption:!0}).option(`allow-code-mode`,{type:`boolean`,description:"Deprecated: use `code_mode` for new integrations. `true` maps to any non-off Code Mode policy; `false` maps to `code_mode: off`. If both fields are sent, they must be consistent or the request returns a 400."}).option(`code-mode`,{type:`string`,description:"Code Mode policy for this portal. `off`: Code Mode is unavailable; query parameters are ignored. `opt_in`: Code Mode is off by default; clients turn it on with `?codemode=search_and_execute`. `default_on`: Code Mode is on by default; clients can opt out with `?codemode=off`. `enforced`: Code Mode is always on; query parameters are ignored. Defaults to `opt_in` when omitted on create. If both `code_mode` and `allow_code_mode` are sent, they must be consistent or the request returns a 400.",choices:[`off`,`opt_in`,`default_on`,`enforced`]}).option(`description`,{type:`string`,description:`Optional description of the MCP portal.`}).option(`hostname`,{type:`string`,description:`Hostname where the MCP portal is available.`}).option(`name`,{type:`string`,description:`Display name for the MCP portal.`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound MCP traffic through Zero Trust Secure Web Gateway.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const D={command:`update <id>`,describe:`Updates an MCP portal configuration.`,builder:E,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access ai-controls mcp portals update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/ai-controls/mcp/portals/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`json`,body:e.body===void 0?d({allow_code_mode:e[`allow-code-mode`],code_mode:f(e[`code-mode`],`code-mode`,`text`),description:f(e.description,`description`,`text`),hostname:f(e.hostname,`hostname`,`text`),name:f(e.name,`name`,`text`),secure_web_gateway:e[`secure-web-gateway`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.access.aiControls.mcp.portals.update({...t,account_id:u,id:e.id})),{successLabel:`Updated`});return}let p=d({allow_code_mode:e[`allow-code-mode`],code_mode:f(e[`code-mode`],`code-mode`,`text`),description:f(e.description,`description`,`text`),hostname:f(e.hostname,`hostname`,`text`),name:f(e.name,`name`,`text`),secure_web_gateway:e[`secure-web-gateway`]});a(await s(`Updating`,async()=>r.zeroTrust.access.aiControls.mcp.portals.update({...p,account_id:u,id:e.id})),{successLabel:`Updated`})}},O={command:`portals`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(y).command(x).command(C).command(T).command(D).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function k(e){return e.option(`auth-credentials`,{type:`string`,description:'Static credential for the upstream MCP server. For auth_type "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as `Authorization: Bearer <token>`, or a JSON-encoded object of the form `{"headers":{"Header-Name":"value",...}}` for custom or multiple static headers (e.g. Cloudflare Access service tokens: `{"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}`).'}).option(`auth-type`,{type:`string`,description:`Authentication method used to connect to the upstream MCP server.`,choices:[`oauth`,`bearer`,`unauthenticated`]}).option(`client-secret`,{type:`string`,description:`Pre-registered OAuth client_secret. Write-only - accepted on create/update when auth_credentials.auth_mode is 'manual'. Stored AES-GCM-encrypted in server_oauth_secrets; never returned by read endpoints.`}).option(`description`,{type:`string`,description:`Optional description of the MCP server.`}).option(`hostname`,{type:`string`,description:`URL of the upstream MCP endpoint.`}).option(`id`,{type:`string`,description:`Unique identifier for the MCP server.`}).option(`is-shared-oauth-callback-enabled`,{type:`boolean`,description:`When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.`,default:!1}).option(`name`,{type:`string`,description:`Display name for the MCP server.`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const A={command:`create`,describe:`Creates a new MCP server for connecting to an upstream MCP endpoint.`,builder:k,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access ai-controls mcp servers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/ai-controls/mcp/servers`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({auth_credentials:f(e[`auth-credentials`],`auth-credentials`,`text`),auth_type:f(e[`auth-type`],`auth-type`,`text`),client_secret:f(e[`client-secret`],`client-secret`,`text`),description:f(e.description,`description`,`text`),hostname:f(e.hostname,`hostname`,`text`),id:f(e.id,`id`,`text`),is_shared_oauth_callback_enabled:e[`is-shared-oauth-callback-enabled`],name:f(e.name,`name`,`text`),secure_web_gateway:e[`secure-web-gateway`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.access.aiControls.mcp.servers.create({...t,account_id:u})),{successLabel:`Created`});return}e[`auth-type`]===void 0&&(e[`auth-type`]=await m(`auth-type`,`Authentication method used to connect to the upstream MCP server.`,[`oauth`,`bearer`,`unauthenticated`])),e.hostname===void 0&&(e.hostname=await h(`hostname`,`URL of the upstream MCP endpoint.`)),e.id===void 0&&(e.id=await h(`id`,`Unique identifier for the MCP server.`)),e.name===void 0&&(e.name=await h(`name`,`Display name for the MCP server.`));let p=d({auth_credentials:f(e[`auth-credentials`],`auth-credentials`,`text`),auth_type:f(e[`auth-type`],`auth-type`,`text`),client_secret:f(e[`client-secret`],`client-secret`,`text`),description:f(e.description,`description`,`text`),hostname:f(e.hostname,`hostname`,`text`),id:f(e.id,`id`,`text`),is_shared_oauth_callback_enabled:e[`is-shared-oauth-callback-enabled`],name:f(e.name,`name`,`text`),secure_web_gateway:e[`secure-web-gateway`]});a(await s(`Creating`,async()=>r.zeroTrust.access.aiControls.mcp.servers.create({...p,account_id:u})),{successLabel:`Created`})}};function j(e){return e.positional(`id`,{type:`string`,description:`Unique identifier for the MCP server.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const M={command:`delete <id>`,describe:`Deletes an MCP server from the account.`,builder:j,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access ai-controls mcp servers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/ai-controls/mcp/servers/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force,message:`This operation permanently deletes the MCP server, removes it from every portal, and deletes its stored OAuth secrets.`})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.access.aiControls.mcp.servers.delete({account_id:l,id:e.id})),{successLabel:`Deleted`})}};function N(e){return e.option(`page`,{type:`number`,description:`Page`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`search`,{type:`string`,description:`Search by id, name`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const P={command:`list`,describe:`Lists all MCP servers configured for the account.`,builder:N,handler:async e=>{let r={page:e.page,per_page:e[`per-page`],search:e.search};if(e.dryRun){o({command:`cf zero-trust access ai-controls mcp servers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/ai-controls/mcp/servers`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.access.aiControls.mcp.servers.list({account_id:u,...r})),{successLabel:`Loaded`})}};function F(e){return e.positional(`id`,{type:`string`,description:`Unique identifier for the MCP server.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const I={command:`read <id>`,describe:`Retrieves an MCP server's configuration and capability sync state.`,builder:F,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access ai-controls mcp servers read`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/ai-controls/mcp/servers/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.aiControls.mcp.servers.read({account_id:l,id:e.id})),{successLabel:`Loaded`})}};function L(e){return e.positional(`id`,{type:`string`,description:`Unique identifier for the MCP server.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const R={command:`sync <id>`,describe:`Syncs an MCP server's capabilities and returns the updated server state, including any connection errors.`,builder:L,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access ai-controls mcp servers sync`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/ai-controls/mcp/servers/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}/sync`,pathParams:{id:String(e.id??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Creating`,async()=>r.zeroTrust.access.aiControls.mcp.servers.sync({account_id:l,id:e.id})),{successLabel:`Created`})}};function z(e){return e.positional(`id`,{type:`string`,description:`Unique identifier for the MCP server.`,demandOption:!0}).option(`auth-credentials`,{type:`string`,description:'Static credential for the upstream MCP server. For auth_type "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as `Authorization: Bearer <token>`, or a JSON-encoded object of the form `{"headers":{"Header-Name":"value",...}}` for custom or multiple static headers (e.g. Cloudflare Access service tokens: `{"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}`).'}).option(`client-secret`,{type:`string`,description:`Pre-registered OAuth client_secret. Write-only - accepted on create/update when auth_credentials.auth_mode is 'manual'. Stored AES-GCM-encrypted in server_oauth_secrets; never returned by read endpoints.`}).option(`description`,{type:`string`,description:`Optional description of the MCP server.`}).option(`is-shared-oauth-callback-enabled`,{type:`boolean`,description:`When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.`}).option(`name`,{type:`string`,description:`Display name for the MCP server.`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const B={command:`update <id>`,describe:`Updates an MCP server's configuration and credentials.`,builder:z,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access ai-controls mcp servers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/ai-controls/mcp/servers/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`json`,body:e.body===void 0?d({auth_credentials:f(e[`auth-credentials`],`auth-credentials`,`text`),client_secret:f(e[`client-secret`],`client-secret`,`text`),description:f(e.description,`description`,`text`),is_shared_oauth_callback_enabled:e[`is-shared-oauth-callback-enabled`],name:f(e.name,`name`,`text`),secure_web_gateway:e[`secure-web-gateway`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.access.aiControls.mcp.servers.update({...t,account_id:u,id:e.id})),{successLabel:`Updated`});return}let p=d({auth_credentials:f(e[`auth-credentials`],`auth-credentials`,`text`),client_secret:f(e[`client-secret`],`client-secret`,`text`),description:f(e.description,`description`,`text`),is_shared_oauth_callback_enabled:e[`is-shared-oauth-callback-enabled`],name:f(e.name,`name`,`text`),secure_web_gateway:e[`secure-web-gateway`]});a(await s(`Updating`,async()=>r.zeroTrust.access.aiControls.mcp.servers.update({...p,account_id:u,id:e.id})),{successLabel:`Updated`})}},V={command:`servers`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(A).command(M).command(P).command(I).command(R).command(B).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},H={command:`mcp`,describe:`Operations for access.ai-controls.mcp`,builder:e=>e.command(O).command(V).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},U={command:`ai-controls`,describe:`Operations for access.ai-controls`,builder:e=>e.command(H).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function W(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const G={command:`create <app-id>`,describe:`Generates a new short-lived certificate CA and public key.`,builder:W,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access applications cas create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Creating`,async()=>r.zeroTrust.access.applications.cas.create({account_id:l,app_id:e[`app-id`]})),{successLabel:`Created`})}};function K(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const q={command:`delete <app-id>`,describe:`Deletes a short-lived certificate CA.`,builder:K,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access applications cas delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.access.applications.cas.delete({account_id:l,app_id:e[`app-id`]})),{successLabel:`Deleted`})}};function J(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Y={command:`get <app-id>`,describe:`Fetches a short-lived certificate CA and its public key.`,builder:J,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access applications cas get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/ca`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.applications.cas.get({account_id:l,app_id:e[`app-id`]})),{successLabel:`Loaded`})}};function X(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Z={command:`list`,describe:`Lists short-lived certificate CAs and their public keys.`,builder:X,handler:async e=>{let r={page:e.page,per_page:e[`per-page`]};if(e.dryRun){o({command:`cf zero-trust access applications cas list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps/ca`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.access.applications.cas.list({account_id:u,...r})),{successLabel:`Loaded`})}},Q={command:`cas`,describe:`Operations for access.applications.cas`,builder:e=>e.command(G).command(q).command(Y).command(Z).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ne(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const re={command:`create`,describe:`Adds a new application to Access.`,builder:ne,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access applications create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.access.applications.create({body:t,account_id:u})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function ie(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ae={command:`delete <app-id>`,describe:`Deletes an application from Access.`,builder:ie,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access applications delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.access.applications.delete({account_id:l,app_id:e[`app-id`]})),{successLabel:`Deleted`})}};function oe(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const se={command:`get <app-id>`,describe:`Fetches information about an Access application.`,builder:oe,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access applications get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.applications.get({account_id:l,app_id:e[`app-id`]})),{successLabel:`Loaded`})}};function ce(e){return e.option(`name`,{type:`string`,description:`The name of the app.`}).option(`domain`,{type:`string`,description:`The domain of the app.`}).option(`aud`,{type:`string`,description:`The aud of the app.`}).option(`target-attributes`,{type:`string`,description:`Target Criteria attributes in key=value format.`}).option(`exact`,{type:`boolean`,description:`True for only exact string matches against passed name/domain query parameters.`}).option(`search`,{type:`string`,description:`Search for apps by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const le={command:`list`,describe:`Lists all Access applications in an account.`,builder:ce,handler:async e=>{let r={name:e.name,domain:e.domain,aud:e.aud,target_attributes:e[`target-attributes`],exact:e.exact,search:e.search,page:e.page,per_page:e[`per-page`]};if(e.dryRun){o({command:`cf zero-trust access applications list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.access.applications.list({account_id:u,...r})),{successLabel:`Loaded`})}};function ue(e){return e.positional(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const de={command:`create <app-id>`,describe:`Creates a policy applying exclusive to a single application that defines the users or groups who can reach it. We recommend creating a reusable policy instead and subsequently referencing its ID in the application's 'policies' array.`,builder:ue,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access applications policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.access.applications.policies.create({body:t,account_id:u,app_id:e[`app-id`]})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function fe(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const pe={command:`delete <policy-id>`,describe:`Deletes an Access policy specific to an application. To delete a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint.`,builder:fe,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access applications policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.access.applications.policies.delete({account_id:l,app_id:e[`app-id`],policy_id:e[`policy-id`]})),{successLabel:`Deleted`})}};function me(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const he={command:`get <policy-id>`,describe:`Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.`,builder:me,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access applications policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.applications.policies.get({account_id:l,app_id:e[`app-id`],policy_id:e[`policy-id`]})),{successLabel:`Loaded`})}};function ge(e){return e.option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _e={command:`list`,describe:`Lists Access policies configured for an application. Returns both exclusively scoped and reusable policies used by the application.`,builder:ge,handler:async e=>{let r={page:e.page,per_page:e[`per-page`]};if(e.dryRun){o({command:`cf zero-trust access applications policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies`,pathParams:{"app-id":String(e[`app-id`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.access.applications.policies.list({account_id:u,app_id:e[`app-id`],...r})),{successLabel:`Loaded`})}};function ve(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ye={command:`update <policy-id>`,describe:`Updates an Access policy specific to an application. To update a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint.`,builder:ve,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access applications policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``),"policy-id":String(e[`policy-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.access.applications.policies.update({body:t,account_id:u,app_id:e[`app-id`],policy_id:e[`policy-id`]})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},be={command:`policies`,describe:`Operations for access.applications.policies`,builder:e=>e.command(de).command(pe).command(he).command(_e).command(ye).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function xe(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Se={command:`create`,describe:`Starts an Access policy test.`,builder:xe,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access applications policy-tests create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/policy-tests`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.access.applications.policyTests.create({...t,account_id:u})),{successLabel:`Created`});return}a(await s(`Creating`,async()=>r.zeroTrust.access.applications.policyTests.create({account_id:u})),{successLabel:`Created`})}};function Ce(e){return e.positional(`policy-test-id`,{type:`string`,description:`The UUID of the policy test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const we={command:`get <policy-test-id>`,describe:`Fetches the current status of a given Access policy test.`,builder:Ce,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access applications policy-tests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/policy-tests/${e[`policy-test-id`]==null?`<policy-test-id>`:encodeURIComponent(String(e[`policy-test-id`]))}`,pathParams:{"policy-test-id":String(e[`policy-test-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.applications.policyTests.get({account_id:l,policy_test_id:e[`policy-test-id`]})),{successLabel:`Loaded`})}};function Te(e){return e.option(`policy-test-id`,{type:`string`,description:`The UUID of the policy test.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`status`,{type:`string`,description:`Filter users by their policy evaluation status.`,choices:[`success`,`fail`,`error`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ee={command:`list`,describe:`Fetches a single page of user results from an Access policy test.`,builder:_(Te),handler:async e=>{let r={page:e.page,per_page:e[`per-page`],status:e.status};if(e.dryRun){o({command:`cf zero-trust access applications policy-tests users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/policy-tests/${e[`policy-test-id`]==null?`<policy-test-id>`:encodeURIComponent(String(e[`policy-test-id`]))}/users`,pathParams:{"policy-test-id":String(e[`policy-test-id`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.access.applications.policyTests.users.list({account_id:u,policy_test_id:e[`policy-test-id`],...r})),{successLabel:`Loaded`})}},De={command:`users`,describe:`Operations for access.applications.policy-tests.users`,builder:e=>e.command(Ee).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Oe={command:`policy-tests`,describe:`Operations for access.applications.policy-tests`,builder:e=>e.command(Se).command(we).command(De).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ke(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ae={command:`revoke-tokens <app-id>`,describe:`Revokes all tokens issued for an application.`,builder:ke,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access applications revoke-tokens`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/revoke_tokens`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force,message:`This operation invalidates every service token for the app.`})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.access.applications.revokeTokens({account_id:l,app_id:e[`app-id`]})),{successLabel:`Deleted`})}};function je(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Me={command:`edit <app-id>`,describe:`Updates Access application settings.`,builder:je,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access applications settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/settings`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.access.applications.settings.edit({body:t,account_id:u,app_id:e[`app-id`]})),{successLabel:`Updated`});return}let f=d({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]});a(await s(`Updating`,async()=>r.zeroTrust.access.applications.settings.edit({body:f,account_id:u,app_id:e[`app-id`]})),{successLabel:`Updated`})}};function Ne(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Pe={command:`update <app-id>`,describe:`Updates Access application settings.`,builder:Ne,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access applications settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/settings`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.access.applications.settings.update({body:t,account_id:u,app_id:e[`app-id`]})),{successLabel:`Updated`});return}let f=d({allow_iframe:e[`allow-iframe`],skip_interstitial:e[`skip-interstitial`]});a(await s(`Updating`,async()=>r.zeroTrust.access.applications.settings.update({body:f,account_id:u,app_id:e[`app-id`]})),{successLabel:`Updated`})}},Fe={command:`settings`,describe:`Operations for access.applications.settings`,builder:e=>e.command(Me).command(Pe).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ie(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Le={command:`update <app-id>`,describe:`Updates an Access application.`,builder:Ie,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access applications update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.access.applications.update({body:t,account_id:u,app_id:e[`app-id`]})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Re(e){return e.option(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ze={command:`list`,describe:`Tests if a specific user has permission to access an application.`,builder:Re,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access applications user-policy-checks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/user_policy_checks`,pathParams:{"app-id":String(e[`app-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.applications.userPolicyChecks.list({account_id:l,app_id:e[`app-id`]})),{successLabel:`Loaded`})}},Be={command:`user-policy-checks`,describe:`Operations for access.applications.user-policy-checks`,builder:e=>e.command(ze).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ve={command:`applications`,describe:`Operations for access.applications`,builder:e=>e.command(re).command(ae).command(se).command(le).command(Ae).command(Le).command(Q).command(be).command(Oe).command(Fe).command(Be).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function He(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ue={command:`create <bookmark-id>`,describe:`Create a new Bookmark application.`,builder:He,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access bookmarks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/bookmarks/${e[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(e[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(e[`bookmark-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Creating`,async()=>r.zeroTrust.access.bookmarks.create({account_id:l,bookmark_id:e[`bookmark-id`]})),{successLabel:`Created`})}};function We(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ge={command:`delete <bookmark-id>`,describe:`Deletes a Bookmark application.`,builder:We,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access bookmarks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/bookmarks/${e[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(e[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(e[`bookmark-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.access.bookmarks.delete({account_id:l,bookmark_id:e[`bookmark-id`]})),{successLabel:`Deleted`})}};function Ke(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qe={command:`get <bookmark-id>`,describe:`Fetches a single Bookmark application.`,builder:Ke,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access bookmarks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/bookmarks/${e[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(e[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(e[`bookmark-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.bookmarks.get({account_id:l,bookmark_id:e[`bookmark-id`]})),{successLabel:`Loaded`})}};function Je(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ye={command:`list`,describe:`Lists Bookmark applications.`,builder:Je,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access bookmarks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/bookmarks`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.bookmarks.list({account_id:l})),{successLabel:`Loaded`})}};function Xe(e){return e.positional(`bookmark-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ze={command:`update <bookmark-id>`,describe:`Updates a configured Bookmark application.`,builder:Xe,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access bookmarks update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/bookmarks/${e[`bookmark-id`]==null?`<bookmark-id>`:encodeURIComponent(String(e[`bookmark-id`]))}`,pathParams:{"bookmark-id":String(e[`bookmark-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Updating`,async()=>r.zeroTrust.access.bookmarks.update({account_id:l,bookmark_id:e[`bookmark-id`]})),{successLabel:`Updated`})}},Qe={command:`bookmarks`,describe:`Operations for access.bookmarks`,builder:e=>e.command(Ue).command(Ge).command(qe).command(Ye).command(Ze).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $e(e){return e.option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`certificate`,{type:`string`,description:`The certificate content.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const et={command:`create`,describe:`Adds a new mTLS root certificate to Access.`,builder:$e,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/certificates`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({associated_hostnames:e[`associated-hostnames`],certificate:f(e.certificate,`certificate`,`text`),name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.access.certificates.create({...t,account_id:u})),{successLabel:`Created`});return}e.certificate===void 0&&(e.certificate=await h(`certificate`,`The certificate content.`)),e.name===void 0&&(e.name=await h(`name`,`The name of the certificate.`));let p=d({associated_hostnames:e[`associated-hostnames`],certificate:f(e.certificate,`certificate`,`text`),name:f(e.name,`name`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.access.certificates.create({...p,account_id:u})),{successLabel:`Created`})}};function tt(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const nt={command:`delete <certificate-id>`,describe:`Deletes an mTLS certificate.`,builder:tt,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.access.certificates.delete({account_id:l,certificate_id:e[`certificate-id`]})),{successLabel:`Deleted`})}};function rt(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const it={command:`get <certificate-id>`,describe:`Fetches a single mTLS certificate.`,builder:rt,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.certificates.get({account_id:l,certificate_id:e[`certificate-id`]})),{successLabel:`Loaded`})}};function at(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ot={command:`list`,describe:`Lists all mTLS root certificates.`,builder:at,handler:async e=>{let r={page:e.page,per_page:e[`per-page`]};if(e.dryRun){o({command:`cf zero-trust access certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/certificates`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.access.certificates.list({account_id:u,...r})),{successLabel:`Loaded`})}};function st(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ct={command:`get`,describe:`List all mTLS hostname settings for this account.`,builder:st,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access certificates settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/certificates/settings`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.certificates.settings.get({account_id:l})),{successLabel:`Loaded`})}};function lt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ut={command:`update`,describe:`Updates an mTLS certificate's hostname settings.`,builder:lt,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access certificates settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/certificates/settings`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let u=await i(e),d=e.local?c:await n();if(e.accountId=d,e.body){let t=l(e.body);a(await s(`Updating`,async()=>u.zeroTrust.access.certificates.settings.update({...t,account_id:d})),{successLabel:`Updated`});return}a(await s(`Updating`,async()=>r(u,`PUT`,`/accounts/${d}/access/certificates/settings`)),{successLabel:`Updated`})}},dt={command:`settings`,describe:`Operations for access.certificates.settings`,builder:e=>e.command(ct).command(ut).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ft(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pt={command:`update <certificate-id>`,describe:`Updates a configured mTLS certificate.`,builder:ft,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access certificates update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({associated_hostnames:e[`associated-hostnames`],name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.access.certificates.update({...t,account_id:u,certificate_id:e[`certificate-id`]})),{successLabel:`Updated`});return}if(e[`associated-hostnames`]===void 0)throw Error(`--associated-hostnames is required (or pass --body with this field set).`);let p=d({associated_hostnames:e[`associated-hostnames`],name:f(e.name,`name`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.access.certificates.update({...p,account_id:u,certificate_id:e[`certificate-id`]})),{successLabel:`Updated`})}},mt={command:`certificates`,describe:`Operations for access.certificates`,builder:e=>e.command(et).command(nt).command(it).command(ot).command(pt).command(dt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ht(e){return e.option(`app-count`,{type:`number`,description:`Number of apps the custom page is assigned to.`}).option(`contract-version`,{type:`number`,description:`Contract version of the page's Liquid template. Present (>= 1) marks a sanitized template; absent or 0 marks a legacy page served verbatim.`}).option(`custom-html`,{type:`string`,description:`Custom page HTML.`}).option(`name`,{type:`string`,description:`Custom page name.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`,`login`,`interstitial`]}).option(`uid`,{type:`string`,description:`UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const gt={command:`create`,describe:`Create a custom page`,builder:ht,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access custom-pages create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/custom_pages`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({app_count:e[`app-count`],contract_version:e[`contract-version`],custom_html:f(e[`custom-html`],`custom-html`,`text`),name:f(e.name,`name`,`text`),type:f(e.type,`type`,`text`),uid:f(e.uid,`uid`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.access.customPages.create({body:t,account_id:u})),{successLabel:`Created`});return}e[`custom-html`]===void 0&&(e[`custom-html`]=await h(`custom-html`,`Custom page HTML.`)),e.name===void 0&&(e.name=await h(`name`,`Custom page name.`)),e.type===void 0&&(e.type=await m(`type`,`Custom page type.`,[`identity_denied`,`forbidden`,`login`,`interstitial`]));let p=d({app_count:e[`app-count`],contract_version:e[`contract-version`],custom_html:f(e[`custom-html`],`custom-html`,`text`),name:f(e.name,`name`,`text`),type:f(e.type,`type`,`text`),uid:f(e.uid,`uid`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.access.customPages.create({body:p,account_id:u})),{successLabel:`Created`})}};function _t(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const vt={command:`delete <custom-page-id>`,describe:`Delete a custom page`,builder:_t,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access custom-pages delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/custom_pages/${e[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(e[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(e[`custom-page-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.access.customPages.delete({account_id:l,custom_page_id:e[`custom-page-id`]})),{successLabel:`Deleted`})}};function yt(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const bt={command:`get <custom-page-id>`,describe:`Fetches a custom page and also returns its HTML.`,builder:yt,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access custom-pages get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/custom_pages/${e[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(e[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(e[`custom-page-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.customPages.get({account_id:l,custom_page_id:e[`custom-page-id`]})),{successLabel:`Loaded`})}};function xt(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const St={command:`list`,describe:`List custom pages`,builder:xt,handler:async e=>{let r={page:e.page,per_page:e[`per-page`]};if(e.dryRun){o({command:`cf zero-trust access custom-pages list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/custom_pages`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.access.customPages.list({account_id:u,...r})),{successLabel:`Loaded`})}};function Ct(e){return e.positional(`custom-page-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-count`,{type:`number`,description:`Number of apps the custom page is assigned to.`}).option(`contract-version`,{type:`number`,description:`Contract version of the page's Liquid template. Present (>= 1) marks a sanitized template; absent or 0 marks a legacy page served verbatim.`}).option(`custom-html`,{type:`string`,description:`Custom page HTML.`}).option(`name`,{type:`string`,description:`Custom page name.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`,`login`,`interstitial`]}).option(`uid`,{type:`string`,description:`UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const wt={command:`update <custom-page-id>`,describe:`Update a custom page`,builder:Ct,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access custom-pages update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/custom_pages/${e[`custom-page-id`]==null?`<custom-page-id>`:encodeURIComponent(String(e[`custom-page-id`]))}`,pathParams:{"custom-page-id":String(e[`custom-page-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({app_count:e[`app-count`],contract_version:e[`contract-version`],custom_html:f(e[`custom-html`],`custom-html`,`text`),name:f(e.name,`name`,`text`),type:f(e.type,`type`,`text`),uid:f(e.uid,`uid`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.access.customPages.update({body:t,account_id:u,custom_page_id:e[`custom-page-id`]})),{successLabel:`Updated`});return}e[`custom-html`]===void 0&&(e[`custom-html`]=await h(`custom-html`,`Custom page HTML.`)),e.name===void 0&&(e.name=await h(`name`,`Custom page name.`)),e.type===void 0&&(e.type=await m(`type`,`Custom page type.`,[`identity_denied`,`forbidden`,`login`,`interstitial`]));let p=d({app_count:e[`app-count`],contract_version:e[`contract-version`],custom_html:f(e[`custom-html`],`custom-html`,`text`),name:f(e.name,`name`,`text`),type:f(e.type,`type`,`text`),uid:f(e.uid,`uid`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.access.customPages.update({body:p,account_id:u,custom_page_id:e[`custom-page-id`]})),{successLabel:`Updated`})}};function Tt(e){return e.option(`template`,{type:`string`,description:`The Liquid template to validate.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`,`login`,`interstitial`]}).option(`version`,{type:`number`,description:`Contract version to validate against; omit for the latest.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A template to validate without persisting it.`})}const Et={command:`validate`,describe:`Validate a Liquid template and return its errors and warnings without persisting it.`,builder:Tt,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access custom-pages validate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/custom_pages/validate`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({template:f(e.template,`template`,`text`),type:f(e.type,`type`,`text`),version:e.version}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.access.customPages.validate({...t,account_id:u})),{successLabel:`Created`});return}e.template===void 0&&(e.template=await h(`template`,`The Liquid template to validate.`)),e.type===void 0&&(e.type=await m(`type`,`Custom page type.`,[`identity_denied`,`forbidden`,`login`,`interstitial`]));let p=d({template:f(e.template,`template`,`text`),type:f(e.type,`type`,`text`),version:e.version});a(await s(`Creating`,async()=>r.zeroTrust.access.customPages.validate({...p,account_id:u})),{successLabel:`Created`})}},Dt={command:`custom-pages`,describe:`Operations for access.custom-pages`,builder:e=>e.command(gt).command(vt).command(bt).command(St).command(wt).command(Et).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ot(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const kt={command:`create`,describe:`Adds a new SSH Certificate Authority (CA).`,builder:Ot,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access gateway-ca create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/gateway_ca`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Creating`,async()=>r.zeroTrust.access.gatewayCa.create({account_id:l})),{successLabel:`Created`})}};function At(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const jt={command:`delete <certificate-id>`,describe:`Deletes an SSH Certificate Authority.`,builder:At,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access gateway-ca delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/gateway_ca/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.access.gatewayCa.delete({account_id:l,certificate_id:e[`certificate-id`]})),{successLabel:`Deleted`})}};function Mt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Nt={command:`list`,describe:`Lists SSH Certificate Authorities (CA).`,builder:Mt,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access gateway-ca list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/gateway_ca`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.gatewayCa.list({account_id:l})),{successLabel:`Loaded`})}},Pt={command:`gateway-ca`,describe:`Operations for access.gateway-ca`,builder:e=>e.command(kt).command(jt).command(Nt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ft(e){return e.option(`is-default`,{type:`boolean`,description:`Whether this is the default group`}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const It={command:`create`,describe:`Creates a new Access group.`,builder:Ft,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/groups`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({is_default:e[`is-default`],name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.access.groups.create({...t,account_id:u})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await h(`name`,`The name of the Access group.`));let p=d({is_default:e[`is-default`],name:f(e.name,`name`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.access.groups.create({...p,account_id:u})),{successLabel:`Created`})}};function Lt(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Rt={command:`delete <group-id>`,describe:`Deletes an Access group.`,builder:Lt,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.access.groups.delete({account_id:l,group_id:e[`group-id`]})),{successLabel:`Deleted`})}};function zt(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bt={command:`get <group-id>`,describe:`Fetches a single Access group.`,builder:zt,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.groups.get({account_id:l,group_id:e[`group-id`]})),{successLabel:`Loaded`})}};function Vt(e){return e.option(`name`,{type:`string`,description:`The name of the group.`}).option(`search`,{type:`string`,description:`Search for groups by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ht={command:`list`,describe:`Lists all Access groups.`,builder:Vt,handler:async e=>{let r={name:e.name,search:e.search,page:e.page,per_page:e[`per-page`]};if(e.dryRun){o({command:`cf zero-trust access groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/groups`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.access.groups.list({account_id:u,...r})),{successLabel:`Loaded`})}};function Ut(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`is-default`,{type:`boolean`,description:`Whether this is the default group`}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wt={command:`update <group-id>`,describe:`Updates a configured Access group.`,builder:Ut,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({is_default:e[`is-default`],name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.access.groups.update({...t,account_id:u,group_id:e[`group-id`]})),{successLabel:`Updated`});return}e.name===void 0&&(e.name=await h(`name`,`The name of the Access group.`));let p=d({is_default:e[`is-default`],name:f(e.name,`name`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.access.groups.update({...p,account_id:u,group_id:e[`group-id`]})),{successLabel:`Updated`})}},Gt={command:`groups`,describe:`Operations for access.groups`,builder:e=>e.command(It).command(Rt).command(Bt).command(Ht).command(Wt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Kt(e){return e.option(`target-ids`,{type:`string`,array:!0,description:`List of target IDs to bulk delete`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const qt={command:`bulk-delete-v2`,describe:`Removes one or more targets.`,builder:Kt,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access infrastructure targets bulk-delete-v2`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/infrastructure/targets/batch_delete`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({target_ids:e[`target-ids`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,!await g({force:!!e.force,message:`This operation bulk-deletes infrastructure targets destructively.`})){process.stderr.write(`Aborted.
+`);return}if(e.body){let t=l(e.body);a(await s(`Deleting`,async()=>r.zeroTrust.access.infrastructure.targets.bulkDeleteV2({...t,account_id:u})),{successLabel:`Deleted`});return}if(e[`target-ids`]===void 0)throw Error(`--target-ids is required (or pass --body with this field set).`);let f=d({target_ids:e[`target-ids`]});a(await s(`Deleting`,async()=>r.zeroTrust.access.infrastructure.targets.bulkDeleteV2({...f,account_id:u})),{successLabel:`Deleted`})}};function Jt(e){return e.option(`target-ids`,{type:`string`,array:!0,description:`List of target IDs to bulk delete`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Yt={command:`bulk-delete`,describe:`Removes one or more targets.`,builder:Jt,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access infrastructure targets bulk-delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/infrastructure/targets/batch`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({target_ids:e[`target-ids`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}if(e.body){let t=l(e.body);a(await s(`Deleting`,async()=>r.zeroTrust.access.infrastructure.targets.bulkDelete({...t,account_id:u})),{successLabel:`Deleted`});return}if(e[`target-ids`]===void 0)throw Error(`--target-ids is required (or pass --body with this field set).`);let f=d({target_ids:e[`target-ids`]});a(await s(`Deleting`,async()=>r.zeroTrust.access.infrastructure.targets.bulkDelete({...f,account_id:u})),{successLabel:`Deleted`})}};function Xt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Zt={command:`bulk-update`,describe:`Adds one or more targets.`,builder:Xt,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access infrastructure targets bulk-update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/infrastructure/targets/batch`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.access.infrastructure.targets.bulkUpdate({body:t,account_id:u})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Qt(e){return e.option(`hostname`,{type:`string`,description:`A non-unique field that refers to a target. Case insensitive, maximum
+length of 255 characters, supports the use of special characters dash
+and period, does not support spaces, and must start and end with an
+alphanumeric character.`}).option(`ip-ipv4-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv4-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`ip-ipv6-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv6-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const $t={command:`create`,describe:`Creates a new infrastructure access target in the account.`,builder:Qt,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access infrastructure targets create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/infrastructure/targets`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({hostname:f(e.hostname,`hostname`,`text`),ip:{ipv4:{ip_addr:f(e[`ip-ipv4-ip-addr`],`ip-ipv4-ip-addr`,`text`),virtual_network_id:f(e[`ip-ipv4-virtual-network-id`],`ip-ipv4-virtual-network-id`,`text`)},ipv6:{ip_addr:f(e[`ip-ipv6-ip-addr`],`ip-ipv6-ip-addr`,`text`),virtual_network_id:f(e[`ip-ipv6-virtual-network-id`],`ip-ipv6-virtual-network-id`,`text`)}}}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.access.infrastructure.targets.create({...t,account_id:u})),{successLabel:`Created`});return}e.hostname===void 0&&(e.hostname=await h(`hostname`,`A non-unique field that refers to a target. Case insensitive, maximum length of 255 characters, supports the use of special characters dash and period, does not support spaces, and must start and end with an alphanumeric character.`));let p=d({hostname:f(e.hostname,`hostname`,`text`),ip:{ipv4:{ip_addr:f(e[`ip-ipv4-ip-addr`],`ip-ipv4-ip-addr`,`text`),virtual_network_id:f(e[`ip-ipv4-virtual-network-id`],`ip-ipv4-virtual-network-id`,`text`)},ipv6:{ip_addr:f(e[`ip-ipv6-ip-addr`],`ip-ipv6-ip-addr`,`text`),virtual_network_id:f(e[`ip-ipv6-virtual-network-id`],`ip-ipv6-virtual-network-id`,`text`)}}});a(await s(`Creating`,async()=>r.zeroTrust.access.infrastructure.targets.create({...p,account_id:u})),{successLabel:`Created`})}};function en(e){return e.positional(`target-id`,{type:`string`,description:`Target identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const tn={command:`delete <target-id>`,describe:`Removes a single infrastructure access target by its ID.`,builder:en,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access infrastructure targets delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/infrastructure/targets/${e[`target-id`]==null?`<target-id>`:encodeURIComponent(String(e[`target-id`]))}`,pathParams:{"target-id":String(e[`target-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.access.infrastructure.targets.delete({account_id:l,target_id:e[`target-id`]})),{successLabel:`Deleted`})}};function nn(e){return e.positional(`target-id`,{type:`string`,description:`Target identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const rn={command:`get <target-id>`,describe:`Fetches a single infrastructure access target by its ID.`,builder:nn,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access infrastructure targets get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/infrastructure/targets/${e[`target-id`]==null?`<target-id>`:encodeURIComponent(String(e[`target-id`]))}`,pathParams:{"target-id":String(e[`target-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.infrastructure.targets.get({account_id:l,target_id:e[`target-id`]})),{successLabel:`Loaded`})}};function an(e){return e.option(`hostname`,{type:`string`,description:`Hostname of a target`}).option(`hostname-contains`,{type:`string`,description:`Partial match to the hostname of a target`}).option(`virtual-network-id`,{type:`string`,description:`Private virtual network identifier of the target`}).option(`ip-v4`,{type:`string`,description:`IPv4 address of the target`}).option(`ip-v6`,{type:`string`,description:`IPv6 address of the target`}).option(`created-before`,{type:`string`,description:`Date and time at which the target was created before (inclusive)`}).option(`created-after`,{type:`string`,description:`Date and time at which the target was created after (inclusive)`}).option(`modified-before`,{type:`string`,description:`Date and time at which the target was modified before (inclusive)`}).option(`modified-after`,{type:`string`,description:`Date and time at which the target was modified after (inclusive)`}).option(`ips`,{type:`string`,description:"Filters for targets that have any of the following IP addresses. Specify\n`ips` multiple times in query parameter to build list of candidates."}).option(`target-ids`,{type:`string`,description:`Filters for targets that have any of the following UUIDs. Specify
+\`target_ids\` multiple times in query parameter to build list of
+candidates.`}).option(`ip-like`,{type:`string`,description:"Filters for targets whose IP addresses look like the specified string.\nSupports `*` as a wildcard character"}).option(`ipv4-start`,{type:`string`,description:"Defines an IPv4 filter range's starting value (inclusive). Requires\n`ipv4_end` to be specified as well."}).option(`ipv4-end`,{type:`string`,description:"Defines an IPv4 filter range's ending value (inclusive). Requires\n`ipv4_start` to be specified as well."}).option(`ipv6-start`,{type:`string`,description:"Defines an IPv6 filter range's starting value (inclusive). Requires\n`ipv6_end` to be specified as well."}).option(`ipv6-end`,{type:`string`,description:"Defines an IPv6 filter range's ending value (inclusive). Requires\n`ipv6_start` to be specified as well."}).option(`page`,{type:`number`,description:`Current page in the response`}).option(`per-page`,{type:`number`,description:`Max amount of entries returned per page`}).option(`order`,{type:`string`,description:`The field to sort by.`,choices:[`hostname`,`created_at`]}).option(`direction`,{type:`string`,description:`The sorting direction.`,choices:[`asc`,`desc`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const on={command:`list`,describe:`Lists and sorts an account's targets. Filters are optional and are ANDed together.`,builder:_(an),handler:async e=>{let r={hostname:e.hostname,hostname_contains:e[`hostname-contains`],virtual_network_id:e[`virtual-network-id`],ip_v4:e[`ip-v4`],ip_v6:e[`ip-v6`],created_before:e[`created-before`],created_after:e[`created-after`],modified_before:e[`modified-before`],modified_after:e[`modified-after`],ips:e.ips,target_ids:e[`target-ids`],ip_like:e[`ip-like`],ipv4_start:e[`ipv4-start`],ipv4_end:e[`ipv4-end`],ipv6_start:e[`ipv6-start`],ipv6_end:e[`ipv6-end`],page:e.page,per_page:e[`per-page`],order:e.order,direction:e.direction};if(e.dryRun){o({command:`cf zero-trust access infrastructure targets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/infrastructure/targets`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.access.infrastructure.targets.list({account_id:u,...r})),{successLabel:`Loaded`})}};function sn(e){return e.positional(`target-id`,{type:`string`,description:`Target identifier`,demandOption:!0}).option(`hostname`,{type:`string`,description:`A non-unique field that refers to a target. Case insensitive, maximum
+length of 255 characters, supports the use of special characters dash
+and period, does not support spaces, and must start and end with an
+alphanumeric character.`}).option(`ip-ipv4-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv4-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`ip-ipv6-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv6-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const cn={command:`update <target-id>`,describe:`Updates an existing infrastructure access target by its ID.`,builder:sn,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access infrastructure targets update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/infrastructure/targets/${e[`target-id`]==null?`<target-id>`:encodeURIComponent(String(e[`target-id`]))}`,pathParams:{"target-id":String(e[`target-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({hostname:f(e.hostname,`hostname`,`text`),ip:{ipv4:{ip_addr:f(e[`ip-ipv4-ip-addr`],`ip-ipv4-ip-addr`,`text`),virtual_network_id:f(e[`ip-ipv4-virtual-network-id`],`ip-ipv4-virtual-network-id`,`text`)},ipv6:{ip_addr:f(e[`ip-ipv6-ip-addr`],`ip-ipv6-ip-addr`,`text`),virtual_network_id:f(e[`ip-ipv6-virtual-network-id`],`ip-ipv6-virtual-network-id`,`text`)}}}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.access.infrastructure.targets.update({...t,account_id:u,target_id:e[`target-id`]})),{successLabel:`Updated`});return}e.hostname===void 0&&(e.hostname=await h(`hostname`,`A non-unique field that refers to a target. Case insensitive, maximum length of 255 characters, supports the use of special characters dash and period, does not support spaces, and must start and end with an alphanumeric character.`));let p=d({hostname:f(e.hostname,`hostname`,`text`),ip:{ipv4:{ip_addr:f(e[`ip-ipv4-ip-addr`],`ip-ipv4-ip-addr`,`text`),virtual_network_id:f(e[`ip-ipv4-virtual-network-id`],`ip-ipv4-virtual-network-id`,`text`)},ipv6:{ip_addr:f(e[`ip-ipv6-ip-addr`],`ip-ipv6-ip-addr`,`text`),virtual_network_id:f(e[`ip-ipv6-virtual-network-id`],`ip-ipv6-virtual-network-id`,`text`)}}});a(await s(`Updating`,async()=>r.zeroTrust.access.infrastructure.targets.update({...p,account_id:u,target_id:e[`target-id`]})),{successLabel:`Updated`})}},ln={command:`targets`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Yt).command(qt).command(Zt).command($t).command(tn).command(rn).command(on).command(cn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},un={command:`infrastructure`,describe:`Operations for access.infrastructure`,builder:e=>e.command(ln).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function dn(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fn={command:`get`,describe:`Gets the Access key rotation settings for an account.`,builder:dn,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access keys get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/keys`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.keys.get({account_id:l})),{successLabel:`Loaded`})}};function pn(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const mn={command:`rotate`,describe:`Perfoms a key rotation for an account.`,builder:pn,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access keys rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/keys/rotate`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Creating`,async()=>r.zeroTrust.access.keys.rotate({account_id:l})),{successLabel:`Created`})}};function hn(e){return e.option(`key-rotation-interval-days`,{type:`number`,description:`The number of days between key rotations.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const gn={command:`update`,describe:`Updates the Access key rotation settings for an account.`,builder:hn,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access keys update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/keys`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({key_rotation_interval_days:e[`key-rotation-interval-days`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.access.keys.update({...t,account_id:u})),{successLabel:`Updated`});return}if(e[`key-rotation-interval-days`]===void 0)throw Error(`--key-rotation-interval-days is required (or pass --body with this field set).`);let f=d({key_rotation_interval_days:e[`key-rotation-interval-days`]});a(await s(`Updating`,async()=>r.zeroTrust.access.keys.update({...f,account_id:u})),{successLabel:`Updated`})}},_n={command:`keys`,describe:`Operations for access.keys`,builder:e=>e.command(fn).command(mn).command(gn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function vn(e){return e.option(`limit`,{type:`number`,description:`The maximum number of log entries to retrieve.`}).option(`direction`,{type:`string`,description:`The chronological sorting order for the logs.`,choices:[`desc`,`asc`]}).option(`since`,{type:`string`,description:`The earliest event timestamp to query.`}).option(`until`,{type:`string`,description:`The latest event timestamp to query.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`email`,{type:`string`,description:"Filter by user email. Match mode is controlled by `emailOp` (preferred) or the legacy `email_exact` flag.\n- Default (no `emailOp`, `email_exact=false` or unset): substring match — `email=@example.com` returns all events with that domain.\n- Exact match: set `emailOp=eq` (preferred) or `email_exact=true` — e.g. `email=user@example.com&email_exact=true` returns only that user.\n- Explicit substring match: set `emailOp=contains` (without `email_exact=true`). When both are set, `email_exact=true` takes precedence and the match is exact.\n- Exclusion: set `emailOp=neq`. With `email_exact=true` this is an exact-value exclusion; without it, a fuzzy substring exclusion."}).option(`email-exact`,{type:`boolean`,description:"When true, `email` is matched exactly instead of substring matching."}).option(`user-id`,{type:`string`,description:"Deprecated. Accepted for backward compatibility but no longer applied\nas a filter. Use `email` instead."}).option(`allowed-op`,{type:`string`,description:"Operator for the `allowed` filter.",choices:[`eq`,`neq`]}).option(`country-code-op`,{type:`string`,description:"Operator for the `country_code` filter.",choices:[`eq`,`neq`]}).option(`app-type-op`,{type:`string`,description:"Operator for the `app_type` filter.",choices:[`eq`,`neq`]}).option(`app-uid-op`,{type:`string`,description:"Operator for the `app_uid` filter.",choices:[`eq`,`neq`]}).option(`ray-id-op`,{type:`string`,description:"Operator for the `ray_id` filter.",choices:[`eq`,`neq`]}).option(`email-op`,{type:`string`,description:"Operator for the `email` filter.\n`contains` performs a substring (case-sensitive) match. When `email_exact=true`\nis also set, `email_exact` takes precedence and `contains` is ignored.",choices:[`eq`,`neq`,`contains`]}).option(`idp-op`,{type:`string`,description:"Operator for the `idp` filter.",choices:[`eq`,`neq`]}).option(`non-identity-op`,{type:`string`,description:"Operator for the `non_identity` filter.",choices:[`eq`,`neq`]}).option(`user-id-op`,{type:`string`,description:"Deprecated. Accepted for backward compatibility but no longer applied\nas a filter (the `user_id` parameter is itself deprecated).",choices:[`eq`,`neq`]}).option(`fields`,{type:`string`,description:`Comma-separated list of fields to include in the response.
+When omitted, all fields are returned.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yn={command:`list`,describe:`Gets a list of Access authentication audit logs for an account.`,builder:_(vn),handler:async e=>{let r={limit:e.limit,direction:e.direction,since:e.since,until:e.until,page:e.page,per_page:e[`per-page`],email:e.email,email_exact:e[`email-exact`],user_id:e[`user-id`],allowedOp:e[`allowed-op`],country_codeOp:e[`country-code-op`],app_typeOp:e[`app-type-op`],app_uidOp:e[`app-uid-op`],ray_idOp:e[`ray-id-op`],emailOp:e[`email-op`],idpOp:e[`idp-op`],non_identityOp:e[`non-identity-op`],user_idOp:e[`user-id-op`],fields:e.fields};if(e.dryRun){o({command:`cf zero-trust access logs access-requests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/logs/access_requests`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.access.logs.accessRequests.list({account_id:u,...r})),{successLabel:`Loaded`})}},bn={command:`access-requests`,describe:`Operations for access.logs.access-requests`,builder:e=>e.command(yn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function xn(e){return e.option(`limit`,{type:`number`,description:`The maximum number of update logs to retrieve.`}).option(`direction`,{type:`string`,description:`The chronological order used to sort the logs.`,choices:[`desc`,`asc`]}).option(`since`,{type:`string`,description:`the timestamp of the earliest update log.`}).option(`until`,{type:`string`,description:`the timestamp of the most-recent update log.`}).option(`idp-id`,{type:`string`,description:`The unique Id of the IdP that has SCIM enabled.`,demandOption:!0}).option(`status`,{type:`string`,description:`The status of the SCIM request.`}).option(`resource-type`,{type:`string`,description:`The resource type of the SCIM request.`}).option(`request-method`,{type:`string`,description:`The request method of the SCIM request.`}).option(`resource-user-email`,{type:`string`,description:"The email address of the SCIM User resource. Pass once for a single\nlookup (`?resource_user_email=A`) or repeat the parameter\n(`?resource_user_email=A&resource_user_email=B`) to filter by multiple\nemails in one request."}).option(`resource-group-name`,{type:`string`,description:"The display name of the SCIM Group resource. Pass once for a single\nlookup (`?resource_group_name=A`) or repeat the parameter\n(`?resource_group_name=A&resource_group_name=B`) to filter by multiple\ngroup names in one request."}).option(`cf-resource-id`,{type:`string`,description:"The unique Cloudflare-generated Id of the SCIM resource. Pass once for\na single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to filter by multiple resources\nin one request."}).option(`idp-resource-id`,{type:`string`,description:"The IdP-generated Id of the SCIM resource. Pass once for a single\nlookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to filter by multiple\nresources in one request."}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sn={command:`list`,describe:`Lists Access SCIM update logs that maintain a record of updates made to User and Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:_(xn),handler:async e=>{let r={limit:e.limit,direction:e.direction,since:e.since,until:e.until,idp_id:e[`idp-id`],status:e.status,resource_type:e[`resource-type`],request_method:e[`request-method`],resource_user_email:e[`resource-user-email`],resource_group_name:e[`resource-group-name`],cf_resource_id:e[`cf-resource-id`],idp_resource_id:e[`idp-resource-id`],page:e.page,per_page:e[`per-page`]};if(e.dryRun){o({command:`cf zero-trust access logs scim updates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/logs/scim/updates`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.access.logs.scim.updates.list({account_id:u,...r})),{successLabel:`Loaded`})}},Cn={command:`updates`,describe:`Operations for access.logs.scim.updates`,builder:e=>e.command(Sn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},wn={command:`scim`,describe:`Operations for access.logs.scim`,builder:e=>e.command(Cn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Tn={command:`logs`,describe:`Operations for access.logs`,builder:e=>e.command(bn).command(wn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function En(e){return e.option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Dn={command:`create`,describe:`Creates a new Access reusable policy.`,builder:En,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/policies`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({decision:f(e.decision,`decision`,`text`),name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.access.policies.create({body:t,account_id:u})),{successLabel:`Created`});return}e.decision===void 0&&(e.decision=await m(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),e.name===void 0&&(e.name=await h(`name`,`The name of the Access policy.`));let p=d({decision:f(e.decision,`decision`,`text`),name:f(e.name,`name`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.access.policies.create({body:p,account_id:u})),{successLabel:`Created`})}};function On(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const kn={command:`delete <policy-id>`,describe:`Deletes an Access reusable policy.`,builder:On,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.access.policies.delete({account_id:l,policy_id:e[`policy-id`]})),{successLabel:`Deleted`})}};function An(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const jn={command:`get <policy-id>`,describe:`Fetches a single Access reusable policy.`,builder:An,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.policies.get({account_id:l,policy_id:e[`policy-id`]})),{successLabel:`Loaded`})}};function Mn(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Nn={command:`list`,describe:`Lists Access reusable policies.`,builder:Mn,handler:async e=>{let r={page:e.page,per_page:e[`per-page`]};if(e.dryRun){o({command:`cf zero-trust access policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/policies`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.access.policies.list({account_id:u,...r})),{successLabel:`Loaded`})}};function Pn(e){return e.positional(`policy-id`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Fn={command:`update <policy-id>`,describe:`Updates a Access reusable policy.`,builder:Pn,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({decision:f(e.decision,`decision`,`text`),name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.access.policies.update({body:t,account_id:u,policy_id:e[`policy-id`]})),{successLabel:`Updated`});return}e.decision===void 0&&(e.decision=await m(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),e.name===void 0&&(e.name=await h(`name`,`The name of the Access policy.`));let p=d({decision:f(e.decision,`decision`,`text`),name:f(e.name,`name`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.access.policies.update({body:p,account_id:u,policy_id:e[`policy-id`]})),{successLabel:`Updated`})}},In={command:`policies`,describe:`Operations for access.policies`,builder:e=>e.command(Dn).command(kn).command(jn).command(Nn).command(Fn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ln(e){return e.option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.",default:1}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).",default:`8760h`}).option(`enabled`,{type:`boolean`,description:"Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous `client_secret` stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Rn={command:`create`,describe:`Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token.`,builder:Ln,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access service-tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/service_tokens`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({client_secret_version:e[`client-secret-version`],duration:f(e.duration,`duration`,`text`),enabled:e.enabled,name:f(e.name,`name`,`text`),previous_client_secret_expires_at:f(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.access.serviceTokens.create({...t,account_id:u})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await h(`name`,`The name of the service token.`));let p=d({client_secret_version:e[`client-secret-version`],duration:f(e.duration,`duration`,`text`),enabled:e.enabled,name:f(e.name,`name`,`text`),previous_client_secret_expires_at:f(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.access.serviceTokens.create({...p,account_id:u})),{successLabel:`Created`})}};function zn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Bn={command:`delete <service-token-id>`,describe:`Deletes a service token.`,builder:zn,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access service-tokens delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.access.serviceTokens.delete({account_id:l,service_token_id:e[`service-token-id`]})),{successLabel:`Deleted`})}};function Vn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Hn={command:`get <service-token-id>`,describe:`Fetches a single service token.`,builder:Vn,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access service-tokens get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.serviceTokens.get({account_id:l,service_token_id:e[`service-token-id`]})),{successLabel:`Loaded`})}};function Un(e){return e.option(`name`,{type:`string`,description:`The name of the service token.`}).option(`search`,{type:`string`,description:`Search for service tokens by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Wn={command:`list`,describe:`Lists all service tokens.`,builder:Un,handler:async e=>{let r={name:e.name,search:e.search,page:e.page,per_page:e[`per-page`]};if(e.dryRun){o({command:`cf zero-trust access service-tokens list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/service_tokens`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.access.serviceTokens.list({account_id:u,...r})),{successLabel:`Loaded`})}};function Gn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kn={command:`refresh <service-token-id>`,describe:`Refreshes the expiration of a service token.`,builder:Gn,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access service-tokens refresh`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}/refresh`,pathParams:{"service-token-id":String(e[`service-token-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Creating`,async()=>r.zeroTrust.access.serviceTokens.refresh({account_id:l,service_token_id:e[`service-token-id`]})),{successLabel:`Created`})}};function qn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. If not provided, it defaults to the current timestamp in order to immediately expire the previous secret."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Jn={command:`rotate <service-token-id>`,describe:`Generates a new Client Secret for a service token and revokes the old one.`,builder:qn,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access service-tokens rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}/rotate`,pathParams:{"service-token-id":String(e[`service-token-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({previous_client_secret_expires_at:f(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.access.serviceTokens.rotate({...t,account_id:u,service_token_id:e[`service-token-id`]})),{successLabel:`Created`});return}let p=d({previous_client_secret_expires_at:f(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.access.serviceTokens.rotate({...p,account_id:u,service_token_id:e[`service-token-id`]})),{successLabel:`Created`})}};function Yn(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`."}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h)."}).option(`enabled`,{type:`boolean`,description:"Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous `client_secret` stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Xn={command:`update <service-token-id>`,describe:`Updates a configured service token.`,builder:Yn,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access service-tokens update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/service_tokens/${e[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(e[`service-token-id`]))}`,pathParams:{"service-token-id":String(e[`service-token-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({client_secret_version:e[`client-secret-version`],duration:f(e.duration,`duration`,`text`),enabled:e.enabled,name:f(e.name,`name`,`text`),previous_client_secret_expires_at:f(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.access.serviceTokens.update({...t,account_id:u,service_token_id:e[`service-token-id`]})),{successLabel:`Updated`});return}let p=d({client_secret_version:e[`client-secret-version`],duration:f(e.duration,`duration`,`text`),enabled:e.enabled,name:f(e.name,`name`,`text`),previous_client_secret_expires_at:f(e[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.access.serviceTokens.update({...p,account_id:u,service_token_id:e[`service-token-id`]})),{successLabel:`Updated`})}},Zn={command:`service-tokens`,describe:`Operations for access.service-tokens`,builder:e=>e.command(Rn).command(Bn).command(Hn).command(Wn).command(Kn).command(Jn).command(Xn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qn(e){return e.option(`name`,{type:`string`,description:`The name of the tag`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const $n={command:`create`,describe:`Create a tag`,builder:Qn,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access tags create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/tags`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.access.tags.create({...t,account_id:u})),{successLabel:`Created`});return}let p=d({name:f(e.name,`name`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.access.tags.create({...p,account_id:u})),{successLabel:`Created`})}};function er(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const tr={command:`delete <tag-name>`,describe:`Delete a tag`,builder:er,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access tags delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/tags/${e[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(e[`tag-name`]))}`,pathParams:{"tag-name":String(e[`tag-name`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.access.tags.delete({account_id:l,tag_name:e[`tag-name`]})),{successLabel:`Deleted`})}};function nr(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const rr={command:`get <tag-name>`,describe:`Get a tag`,builder:nr,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access tags get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/tags/${e[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(e[`tag-name`]))}`,pathParams:{"tag-name":String(e[`tag-name`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.tags.get({account_id:l,tag_name:e[`tag-name`]})),{successLabel:`Loaded`})}};function ir(e){return e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ar={command:`list`,describe:`List tags`,builder:ir,handler:async e=>{let r={page:e.page,per_page:e[`per-page`]};if(e.dryRun){o({command:`cf zero-trust access tags list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/tags`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.access.tags.list({account_id:u,...r})),{successLabel:`Loaded`})}};function or(e){return e.positional(`tag-name`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`name`,{type:`string`,description:`The name of the tag`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A tag`})}const sr={command:`update <tag-name>`,describe:`Update a tag`,builder:or,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access tags update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/tags/${e[`tag-name`]==null?`<tag-name>`:encodeURIComponent(String(e[`tag-name`]))}`,pathParams:{"tag-name":String(e[`tag-name`]??``)},bodyKind:`json`,body:e.body===void 0?d({name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.access.tags.update({...t,account_id:u,tag_name:e[`tag-name`]})),{successLabel:`Updated`});return}e.name===void 0&&(e.name=await h(`name`,`The name of the tag`));let p=d({name:f(e.name,`name`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.access.tags.update({...p,account_id:u,tag_name:e[`tag-name`]})),{successLabel:`Updated`})}},cr={command:`tags`,describe:`Operations for access.tags`,builder:e=>e.command($n).command(tr).command(rr).command(ar).command(sr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function lr(e){return e.positional(`nonce`,{type:`string`,description:`Nonce`,demandOption:!0}).option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ur={command:`get <nonce>`,describe:`Get an active session for a single user.`,builder:lr,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access users active-sessions get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}/active_sessions/${e.nonce==null?`<nonce>`:encodeURIComponent(String(e.nonce))}`,pathParams:{"user-id":String(e[`user-id`]??``),nonce:String(e.nonce??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.users.activeSessions.get({account_id:l,user_id:e[`user-id`],nonce:e.nonce})),{successLabel:`Loaded`})}};function dr(e){return e.option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fr={command:`list`,describe:`Get active sessions for a single user.`,builder:dr,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access users active-sessions list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}/active_sessions`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.users.activeSessions.list({account_id:l,user_id:e[`user-id`]})),{successLabel:`Loaded`})}},pr={command:`active-sessions`,describe:`Operations for access.users.active-sessions`,builder:e=>e.command(ur).command(fr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function mr(e){return e.option(`email`,{type:`string`,description:`The email of the user.`}).option(`name`,{type:`string`,description:`The name of the user.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const hr={command:`create`,describe:`Creates a new user.`,builder:mr,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access users create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/users`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({email:f(e.email,`email`,`text`),name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.access.users.create({...t,account_id:u})),{successLabel:`Created`});return}e.email===void 0&&(e.email=await h(`email`,`The email of the user.`));let p=d({email:f(e.email,`email`,`text`),name:f(e.name,`name`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.access.users.create({...p,account_id:u})),{successLabel:`Created`})}};function gr(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const _r={command:`delete <user-id>`,describe:`Deletes a specific user for an account. This will also revoke any active seats and tokens for the user.`,builder:gr,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access users delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.access.users.delete({account_id:l,user_id:e[`user-id`]})),{successLabel:`Deleted`})}};function vr(e){return e.option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yr={command:`list`,describe:`Get all failed login attempts for a single user.`,builder:vr,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access users failed-logins list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}/failed_logins`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.users.failedLogins.list({account_id:l,user_id:e[`user-id`]})),{successLabel:`Loaded`})}},br={command:`failed-logins`,describe:`Operations for access.users.failed-logins`,builder:e=>e.command(yr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function xr(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sr={command:`get <user-id>`,describe:`Gets a specific user for an account.`,builder:xr,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access users get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.users.get({account_id:l,user_id:e[`user-id`]})),{successLabel:`Loaded`})}};function Cr(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wr={command:`get <user-id>`,describe:`Get last seen identity for a single user.`,builder:Cr,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access users last-seen-identity get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}/last_seen_identity`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.access.users.lastSeenIdentity.get({account_id:l,user_id:e[`user-id`]})),{successLabel:`Loaded`})}},Tr={command:`last-seen-identity`,describe:`Operations for access.users.last-seen-identity`,builder:e=>e.command(wr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Er(e){return e.option(`name`,{type:`string`,description:`The name of the user.`}).option(`email`,{type:`string`,description:`The email of the user.`}).option(`search`,{type:`string`,description:`Search for users by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dr={command:`list`,describe:`Gets a list of users for an account.`,builder:Er,handler:async e=>{let r={name:e.name,email:e.email,search:e.search,page:e.page,per_page:e[`per-page`]};if(e.dryRun){o({command:`cf zero-trust access users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/users`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.access.users.list({account_id:u,...r})),{successLabel:`Loaded`})}};function Or(e){return e.positional(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`email`,{type:`string`,description:`The email of the user.`}).option(`name`,{type:`string`,description:`The name of the user.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const kr={command:`update <user-id>`,describe:`Updates a specific user's name for an account. Requires the user's current email as confirmation (email cannot be changed).`,builder:Or,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust access users update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({email:f(e.email,`email`,`text`),name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.access.users.update({...t,account_id:u,user_id:e[`user-id`]})),{successLabel:`Updated`});return}e.email===void 0&&(e.email=await h(`email`,`The email of the user.`)),e.name===void 0&&(e.name=await h(`name`,`The name of the user.`));let p=d({email:f(e.email,`email`,`text`),name:f(e.name,`name`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.access.users.update({...p,account_id:u,user_id:e[`user-id`]})),{successLabel:`Updated`})}},Ar={command:`users`,describe:`Operations for access.users`,builder:e=>e.command(hr).command(_r).command(Sr).command(Dr).command(kr).command(pr).command(br).command(Tr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},jr={command:`access`,describe:`Operations for access`,builder:e=>e.command(U).command(Ve).command(Qe).command(mt).command(Dt).command(Pt).command(Gt).command(un).command(_n).command(Tn).command(In).command(Zn).command(cr).command(Ar).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Mr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Nr={command:`create <app-id>`,describe:`Generates a new short-lived certificate CA and public key.`,builder:Mr,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps ca create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/ca`,pathParams:{"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Creating`,async()=>n.zeroTrust.apps.ca.create({zone_id:r,app_id:t[`app-id`]})),{successLabel:`Created`})}};function Pr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Fr={command:`delete <app-id>`,describe:`Deletes a short-lived certificate CA.`,builder:Pr,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps ca delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/ca`,pathParams:{"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,!await g({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>n.zeroTrust.apps.ca.delete({zone_id:r,app_id:t[`app-id`]})),{successLabel:`Deleted`})}};function Ir(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Lr={command:`get <app-id>`,describe:`Fetches a short-lived certificate CA and its public key.`,builder:Ir,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps ca get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/ca`,pathParams:{"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.apps.ca.get({zone_id:r,app_id:t[`app-id`]})),{successLabel:`Loaded`})}};function Rr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zr={command:`list`,describe:`Lists short-lived certificate CAs and their public keys.`,builder:Rr,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps ca list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/ca`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.apps.ca.list({zone_id:r})),{successLabel:`Loaded`})}},Br={command:`ca`,describe:`Operations for apps.ca`,builder:e=>e.command(Nr).command(Fr).command(Lr).command(zr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Vr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Hr={command:`create`,describe:`Adds a new application to Access.`,builder:Vr,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?void 0:l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=l(t.body);a(await s(`Creating`,async()=>n.zeroTrust.apps.create({body:e,zone_id:r})),{successLabel:`Created`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Ur(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Wr={command:`delete <app-id>`,describe:`Deletes an application from Access.`,builder:Ur,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}`,pathParams:{"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,!await g({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>n.zeroTrust.apps.delete({zone_id:r,app_id:t[`app-id`]})),{successLabel:`Deleted`})}};function Gr(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kr={command:`get <app-id>`,describe:`Fetches information about an Access application.`,builder:Gr,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}`,pathParams:{"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.apps.get({zone_id:r,app_id:t[`app-id`]})),{successLabel:`Loaded`})}};function qr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jr={command:`list`,describe:`List all Access Applications in a zone.`,builder:qr,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.apps.list({zone_id:r})),{successLabel:`Loaded`})}};function Yr(e){return e.positional(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`,default:!1}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy.`,default:!1}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy.`}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Xr={command:`create <app-id>`,describe:`Create a new Access policy for an application.`,builder:Yr,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/policies`,pathParams:{"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?d({approval_required:t[`approval-required`],decision:f(t.decision,`decision`,`text`),isolation_required:t[`isolation-required`],name:f(t.name,`name`,`text`),precedence:t.precedence,purpose_justification_prompt:f(t[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:t[`purpose-justification-required`]}):l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=l(t.body);a(await s(`Creating`,async()=>n.zeroTrust.apps.policies.create({...e,zone_id:r,app_id:t[`app-id`]})),{successLabel:`Created`});return}t.decision===void 0&&(t.decision=await m(`decision`,`The action Access will take if a user matches this policy.`,[`allow`,`deny`,`non_identity`,`bypass`])),t.name===void 0&&(t.name=await h(`name`,`The name of the Access policy.`));let c=d({approval_required:t[`approval-required`],decision:f(t.decision,`decision`,`text`),isolation_required:t[`isolation-required`],name:f(t.name,`name`,`text`),precedence:t.precedence,purpose_justification_prompt:f(t[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:t[`purpose-justification-required`]});a(await s(`Creating`,async()=>n.zeroTrust.apps.policies.create({...c,zone_id:r,app_id:t[`app-id`]})),{successLabel:`Created`})}};function Zr(e){return e.positional(`policy-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Qr={command:`delete <policy-id>`,describe:`Delete an Access policy.`,builder:Zr,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/policies/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}`,pathParams:{"policy-id":String(t[`policy-id`]??``),"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,!await g({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>n.zeroTrust.apps.policies.delete({zone_id:r,app_id:t[`app-id`],policy_id:t[`policy-id`]})),{successLabel:`Deleted`})}};function $r(e){return e.positional(`policy-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ei={command:`get <policy-id>`,describe:`Fetches a single Access policy.`,builder:$r,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps policies get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/policies/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}`,pathParams:{"policy-id":String(t[`policy-id`]??``),"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.apps.policies.get({zone_id:r,app_id:t[`app-id`],policy_id:t[`policy-id`]})),{successLabel:`Loaded`})}};function ti(e){return e.option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ni={command:`list`,describe:`Lists Access policies configured for an application.`,builder:ti,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps policies list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/policies`,pathParams:{"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.apps.policies.list({zone_id:r,app_id:t[`app-id`]})),{successLabel:`Loaded`})}};function ri(e){return e.positional(`policy-id`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ii={command:`update <policy-id>`,describe:`Converts an application-scoped policy to a reusable policy. The policy will no longer be exclusively scoped to the application. Further updates to the policy should go through the /accounts/{account_id}/policies/{uid} endpoint.`,builder:ri,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust apps policies make reusable update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/apps/${e[`app-id`]==null?`<app-id>`:encodeURIComponent(String(e[`app-id`]))}/policies/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/make_reusable`,pathParams:{"app-id":String(e[`app-id`]??``),"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Updating`,async()=>r.zeroTrust.apps.policies.make.reusable.update({account_id:l,app_id:e[`app-id`],policy_id:e[`policy-id`]})),{successLabel:`Updated`})}},ai={command:`reusable`,describe:`Operations for apps.policies.make.reusable`,builder:e=>e.command(ii).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},oi={command:`make`,describe:`Operations for apps.policies.make`,builder:e=>e.command(ai).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function si(e){return e.positional(`policy-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy.`}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy.`}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ci={command:`update <policy-id>`,describe:`Update a configured Access policy.`,builder:si,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/policies/${t[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(t[`policy-id`]))}`,pathParams:{"policy-id":String(t[`policy-id`]??``),"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?d({approval_required:t[`approval-required`],decision:f(t.decision,`decision`,`text`),isolation_required:t[`isolation-required`],name:f(t.name,`name`,`text`),precedence:t.precedence,purpose_justification_prompt:f(t[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:t[`purpose-justification-required`]}):l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=l(t.body);a(await s(`Updating`,async()=>n.zeroTrust.apps.policies.update({...e,zone_id:r,app_id:t[`app-id`],policy_id:t[`policy-id`]})),{successLabel:`Updated`});return}t.decision===void 0&&(t.decision=await m(`decision`,`The action Access will take if a user matches this policy.`,[`allow`,`deny`,`non_identity`,`bypass`])),t.name===void 0&&(t.name=await h(`name`,`The name of the Access policy.`));let c=d({approval_required:t[`approval-required`],decision:f(t.decision,`decision`,`text`),isolation_required:t[`isolation-required`],name:f(t.name,`name`,`text`),precedence:t.precedence,purpose_justification_prompt:f(t[`purpose-justification-prompt`],`purpose-justification-prompt`,`text`),purpose_justification_required:t[`purpose-justification-required`]});a(await s(`Updating`,async()=>n.zeroTrust.apps.policies.update({...c,zone_id:r,app_id:t[`app-id`],policy_id:t[`policy-id`]})),{successLabel:`Updated`})}},li={command:`policies`,describe:`Operations for apps.policies`,builder:e=>e.command(Xr).command(Qr).command(ei).command(ni).command(ci).command(oi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ui(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const di={command:`list`,describe:`Retrieve the statuses of your applications.`,builder:ui,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust apps review status list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/apps/review_status`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.apps.review.status.list({account_id:l})),{successLabel:`Loaded`})}};function fi(e){return e.option(`approved-apps`,{type:`string`,array:!0,description:`Contains the ids of the approved applications.`}).option(`in-review-apps`,{type:`string`,array:!0,description:`Contains the ids of the applications in review.`}).option(`unapproved-apps`,{type:`string`,array:!0,description:`Contains the ids of the unapproved applications.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pi={command:`update`,describe:`Update the statuses of your applications.`,builder:fi,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust apps review status update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/apps/review_status`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({approved_apps:e[`approved-apps`],in_review_apps:e[`in-review-apps`],unapproved_apps:e[`unapproved-apps`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.apps.review.status.update({...t,account_id:u})),{successLabel:`Updated`});return}if(e[`approved-apps`]===void 0)throw Error(`--approved-apps is required (or pass --body with this field set).`);if(e[`in-review-apps`]===void 0)throw Error(`--in-review-apps is required (or pass --body with this field set).`);if(e[`unapproved-apps`]===void 0)throw Error(`--unapproved-apps is required (or pass --body with this field set).`);let f=d({approved_apps:e[`approved-apps`],in_review_apps:e[`in-review-apps`],unapproved_apps:e[`unapproved-apps`]});a(await s(`Updating`,async()=>r.zeroTrust.apps.review.status.update({...f,account_id:u})),{successLabel:`Updated`})}},mi={command:`status`,describe:`Operations for apps.review.status`,builder:e=>e.command(di).command(pi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},hi={command:`review`,describe:`Operations for apps.review`,builder:e=>e.command(mi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function gi(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const _i={command:`create <app-id>`,describe:`Revokes all tokens issued for an application.`,builder:gi,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps revoke tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/revoke_tokens`,pathParams:{"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,!await g({force:!!t.force,message:`This operation revokes all service tokens for the application.`})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>n.zeroTrust.apps.revoke.tokens.create({zone_id:r,app_id:t[`app-id`]})),{successLabel:`Deleted`})}},vi={command:`tokens`,describe:`Operations for apps.revoke.tokens`,builder:e=>e.command(_i).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},yi={command:`revoke`,describe:`Operations for apps.revoke`,builder:e=>e.command(vi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bi(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xi={command:`edit <app-id>`,describe:`Updates application settings.`,builder:bi,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/settings`,pathParams:{"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?d({allow_iframe:t[`allow-iframe`],skip_interstitial:t[`skip-interstitial`]}):l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=l(t.body);a(await s(`Updating`,async()=>n.zeroTrust.apps.settings.edit({body:e,zone_id:r,app_id:t[`app-id`]})),{successLabel:`Updated`});return}let c=d({allow_iframe:t[`allow-iframe`],skip_interstitial:t[`skip-interstitial`]});a(await s(`Updating`,async()=>n.zeroTrust.apps.settings.edit({body:c,zone_id:r,app_id:t[`app-id`]})),{successLabel:`Updated`})}};function Si(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ci={command:`update <app-id>`,describe:`Updates application settings.`,builder:Si,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/settings`,pathParams:{"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?d({allow_iframe:t[`allow-iframe`],skip_interstitial:t[`skip-interstitial`]}):l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=l(t.body);a(await s(`Updating`,async()=>n.zeroTrust.apps.settings.update({body:e,zone_id:r,app_id:t[`app-id`]})),{successLabel:`Updated`});return}let c=d({allow_iframe:t[`allow-iframe`],skip_interstitial:t[`skip-interstitial`]});a(await s(`Updating`,async()=>n.zeroTrust.apps.settings.update({body:c,zone_id:r,app_id:t[`app-id`]})),{successLabel:`Updated`})}},wi={command:`settings`,describe:`Operations for apps.settings`,builder:e=>e.command(xi).command(Ci).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ti(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ei={command:`update <app-id>`,describe:`Updates an Access application.`,builder:Ti,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}`,pathParams:{"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?void 0:l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=l(t.body);a(await s(`Updating`,async()=>n.zeroTrust.apps.update({body:e,zone_id:r,app_id:t[`app-id`]})),{successLabel:`Updated`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Di(e){return e.positional(`app-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Oi={command:`get <app-id>`,describe:`Tests if a specific user has permission to access an application.`,builder:Di,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust apps user policy checks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/apps/${t[`app-id`]==null?`<app-id>`:encodeURIComponent(String(t[`app-id`]))}/user_policy_checks`,pathParams:{"app-id":String(t[`app-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.apps.user.policy.checks.get({zone_id:r,app_id:t[`app-id`]})),{successLabel:`Loaded`})}},ki={command:`checks`,describe:`Operations for apps.user.policy.checks`,builder:e=>e.command(Oi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ai={command:`policy`,describe:`Operations for apps.user.policy`,builder:e=>e.command(ki).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ji={command:`user`,describe:`Operations for apps.user`,builder:e=>e.command(Ai).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Mi={command:`apps`,describe:`Operations for apps`,builder:e=>e.command(Hr).command(Wr).command(Kr).command(Jr).command(Ei).command(Br).command(li).command(hi).command(yi).command(wi).command(ji).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ni(e){return e.option(`application-id`,{type:`string`,description:`Application/vendor identifier.`,demandOption:!0}).option(`page`,{type:`number`,description:`A page number within the paginated result set.`}).option(`page-size`,{type:`number`,description:`Number of results to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pi={command:`list`,describe:`Returns available auth methods for the specified vendor, including credential schema, instructions, and example payloads. Use this to understand what credentials are required before calling POST /v2/integrations.`,builder:_(Ni),handler:async e=>{let r={page:e.page,page_size:e[`page-size`]};if(e.dryRun){o({command:`cf zero-trust casb applications auth_methods list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/one/applications/${e[`application-id`]==null?`<application-id>`:encodeURIComponent(String(e[`application-id`]))}/auth-methods`,pathParams:{"application-id":String(e[`application-id`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.casb.applications.authMethods.list({account_id:u,application_id:e[`application-id`],...r})),{successLabel:`Loaded`})}},Fi={command:`auth_methods`,describe:`Operations for casb.applications.auth_methods`,builder:e=>e.command(Pi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ii(e){return e.positional(`application-id`,{type:`string`,description:`Application/vendor identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Li={command:`get <application-id>`,describe:`Returns full application details including auth methods, use cases, and permissions.`,builder:_(Ii),handler:async e=>{if(e.dryRun){o({command:`cf zero-trust casb applications get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/one/applications/${e[`application-id`]==null?`<application-id>`:encodeURIComponent(String(e[`application-id`]))}`,pathParams:{"application-id":String(e[`application-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.casb.applications.get({account_id:l,application_id:e[`application-id`]})),{successLabel:`Loaded`})}};function Ri(e){return e.option(`environment`,{type:`string`,description:`Filter by supported environment (standard, fedramp).`}).option(`page`,{type:`number`,description:`A page number within the paginated result set.`}).option(`page-size`,{type:`number`,description:`Number of results to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zi={command:`list`,describe:`Returns a list of available applications with use cases and permissions.`,builder:Ri,handler:async e=>{let r={environment:e.environment,page:e.page,page_size:e[`page-size`]};if(e.dryRun){o({command:`cf zero-trust casb applications list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/one/applications`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.casb.applications.list({account_id:u,...r})),{successLabel:`Loaded`})}};function Bi(e){return e.option(`application-id`,{type:`string`,description:`Application/vendor identifier.`,demandOption:!0}).option(`auth-method`,{type:`string`,description:`Filter by auth method id. Get available ids from GET /v2/applications.`}).option(`environment`,{type:`string`,description:`Filter by environment.`,choices:[`fedramp`,`standard`]}).option(`page`,{type:`number`,description:`A page number within the paginated result set.`}).option(`page-size`,{type:`number`,description:`Number of results to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vi={command:`list`,describe:`Returns all available setup flows for the application, one per auth method.`,builder:_(Bi),handler:async e=>{let r={auth_method:e[`auth-method`],environment:e.environment,page:e.page,page_size:e[`page-size`]};if(e.dryRun){o({command:`cf zero-trust casb applications setup_flows list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/one/applications/${e[`application-id`]==null?`<application-id>`:encodeURIComponent(String(e[`application-id`]))}/setup-flows`,pathParams:{"application-id":String(e[`application-id`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.casb.applications.setupFlows.list({account_id:u,application_id:e[`application-id`],...r})),{successLabel:`Loaded`})}},Hi={command:`setup_flows`,describe:`Operations for casb.applications.setup_flows`,builder:e=>e.command(Vi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ui={command:`applications`,describe:`Operations for casb.applications`,builder:e=>e.command(Li).command(zi).command(Fi).command(Hi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Wi(e){return e.option(`application`,{type:`string`,description:"Vendor/application slug (e.g., GOOGLE_WORKSPACE).\n\n* `ANTHROPIC` - ANTHROPIC\n* `AWS` - AWS\n* `BITBUCKET` - BITBUCKET\n* `BOX` - BOX\n* `CONFLUENCE` - CONFLUENCE\n* `DROPBOX` - DROPBOX\n* `GITHUB` - GITHUB\n* `GOOGLE_CLOUD_PLATFORM` - GOOGLE_CLOUD_PLATFORM\n* `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE\n* `JIRA` - JIRA\n* `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL\n* `OPENAI` - OPENAI\n* `SALESFORCE` - SALESFORCE\n* `SERVICENOW` - SERVICENOW\n* `SLACK` - SLACK",choices:[`ANTHROPIC`,`AWS`,`BITBUCKET`,`BOX`,`CONFLUENCE`,`DROPBOX`,`GITHUB`,`GOOGLE_CLOUD_PLATFORM`,`GOOGLE_WORKSPACE`,`JIRA`,`MICROSOFT_INTERNAL`,`OPENAI`,`SALESFORCE`,`SERVICENOW`,`SLACK`]}).option(`auth-method`,{type:`string`,description:`Authentication method slug (uses default if omitted).`}).option(`dlp-profiles`,{type:`string`,array:!0,description:`List of DLP profile IDs to associate.`}).option(`name`,{type:`string`,description:`Name of the integration.`}).option(`permissions`,{type:`string`,array:!0,description:`List of permission scopes (uses policy defaults if empty).`}).option(`use-cases`,{type:`string`,array:!0,description:`List of use case or feature slugs to enroll (e.g., ['casb', 'ces', 'auto_remediation']).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Serializer for v2 integration create requests.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Gi={command:`create`,describe:"Creates a new integration for the specified application. Integration creation with OAuth is not supported by API at the moment. For other auth methods, use `GET /v2/applications/{application_id}/credential-guide` to see the required credential structure and example payloads for each vendor.",builder:Wi,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust casb integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/one/integrations`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({application:f(e.application,`application`,`text`),auth_method:f(e[`auth-method`],`auth-method`,`text`),dlp_profiles:e[`dlp-profiles`],name:f(e.name,`name`,`text`),permissions:e.permissions,use_cases:e[`use-cases`]}):l(e.body)});return}let g=await i(e),_=e.local?c:await n();if(e.accountId=_,e.file){let t=p(e.file);a(await s(`Creating`,async()=>r(g,`POST`,`/accounts/${_}/one/integrations`,{body:t,headers:{"Content-Type":``}})),{successLabel:`Created`});return}if(e.body){let t=l(e.body);a(await s(`Creating`,async()=>r(g,`POST`,`/accounts/${_}/one/integrations`,{body:t})),{successLabel:`Created`});return}e.application===void 0&&(e.application=await m(`application`,"Vendor/application slug (e.g., GOOGLE_WORKSPACE).  * `ANTHROPIC` - ANTHROPIC * `AWS` - AWS * `BITBUCKET` - BITBUCKET * `BOX` - BOX * `CONFLUENCE` - CONFLUENCE * `DROPBOX` - DROPBOX * `GITHUB` - GITHUB * `GOOGLE_CLOUD_PLATFORM` - GOOGLE_CLOUD_PLATFORM * `GOOGLE_WORKSPACE` - GOOGLE_WORKSPACE * `JIRA` - JIRA * `MICROSOFT_INTERNAL` - MICROSOFT_INTERNAL * `OPENAI` - OPENAI * `SALESFORCE` - SALESFORCE * `SERVICENOW` - SERVICENOW * `SLACK` - SLACK",[`ANTHROPIC`,`AWS`,`BITBUCKET`,`BOX`,`CONFLUENCE`,`DROPBOX`,`GITHUB`,`GOOGLE_CLOUD_PLATFORM`,`GOOGLE_WORKSPACE`,`JIRA`,`MICROSOFT_INTERNAL`,`OPENAI`,`SALESFORCE`,`SERVICENOW`,`SLACK`])),e.name===void 0&&(e.name=await h(`name`,`Name of the integration.`));let v={};e.application!==void 0&&u(v,[`application`],f(e.application,`application`,`text`)),e[`auth-method`]!==void 0&&u(v,[`auth_method`],f(e[`auth-method`],`auth-method`,`text`)),e[`dlp-profiles`]!==void 0&&u(v,[`dlp_profiles`],e[`dlp-profiles`]),e.name!==void 0&&u(v,[`name`],f(e.name,`name`,`text`)),e.permissions!==void 0&&u(v,[`permissions`],e.permissions),e[`use-cases`]!==void 0&&u(v,[`use_cases`],e[`use-cases`]),a(await s(`Creating`,async()=>r(g,`POST`,`/accounts/${_}/one/integrations`,{body:Object.keys(v).length>0?v:void 0})),{successLabel:`Created`})}};function Ki(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const qi={command:`delete <id>`,describe:`Delete an integration by soft-deleting it.`,builder:Ki,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust casb integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/one/integrations/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.casb.integrations.delete({account_id:l,id:e.id})),{successLabel:`Deleted`})}};function Ji(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yi={command:`get <id>`,describe:`Returns full integration details including use cases and permissions.`,builder:Ji,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust casb integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/one/integrations/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.casb.integrations.get({account_id:l,id:e.id})),{successLabel:`Loaded`})}};function Xi(e){return e.option(`application`,{type:`string`,description:`Filter by application/vendor (e.g., GOOGLE_WORKSPACE, MICROSOFT_INTERNAL).`}).option(`direction`,{type:`string`,description:`Direction to order results.`,choices:[`asc`,`desc`]}).option(`dlp-enabled`,{type:`boolean`,description:`Filter by DLP enabled status (true/false).`}).option(`order`,{type:`string`,description:`Field to order results by.`,choices:[`application`,`created`,`name`,`status`]}).option(`page`,{type:`number`,description:`Page number within the paginated result set.`}).option(`page-size`,{type:`number`,description:`Number of results per page.`}).option(`search`,{type:`string`,description:`Search integrations by name or application.`}).option(`status`,{type:`string`,description:`Filter by integration status.`,choices:[`Healthy`,`Initializing`,`Offline`,`Unhealthy`]}).option(`use-cases`,{type:`string`,description:`Filter by enabled use cases (e.g., casb, ces). Matches integrations enrolled in any of the specified values. Can be specified multiple times.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zi={command:`list`,describe:`Returns a paginated list of integrations for the account.`,builder:_(Xi),handler:async e=>{let r={application:e.application,direction:e.direction,dlp_enabled:e[`dlp-enabled`],order:e.order,page:e.page,page_size:e[`page-size`],search:e.search,status:e.status,use_cases:e[`use-cases`]};if(e.dryRun){o({command:`cf zero-trust casb integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/one/integrations`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.casb.integrations.list({account_id:u,...r})),{successLabel:`Loaded`})}};function Qi(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $i={command:`pause <id>`,describe:`Pauses an integration, stopping all crawlers.`,builder:Qi,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust casb integrations pause`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/one/integrations/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}/pause`,pathParams:{id:String(e.id??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Creating`,async()=>r.zeroTrust.casb.integrations.pause({account_id:l,id:e.id})),{successLabel:`Created`})}};function ea(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ta={command:`resume <id>`,describe:`Resumes a paused integration, restarting crawlers.`,builder:ea,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust casb integrations resume`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/one/integrations/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}/resume`,pathParams:{id:String(e.id??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Creating`,async()=>r.zeroTrust.casb.integrations.resume({account_id:l,id:e.id})),{successLabel:`Created`})}};function na(e){return e.positional(`id`,{type:`string`,description:`Integration ID.`,demandOption:!0}).option(`dlp-profiles`,{type:`string`,array:!0,description:`List of DLP profile IDs to associate with the integration.`}).option(`name`,{type:`string`,description:`Name of the integration.`}).option(`permissions`,{type:`string`,array:!0,description:`List of permission scopes granted to the integration.`}).option(`use-cases`,{type:`string`,array:!0,description:`List of use case or feature slugs to enroll (e.g., ['casb', 'ces', 'auto_remediation']).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Serializer for v2 integration PATCH requests.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const ra={command:`update <id>`,describe:`Updates an integration's name, permissions, DLP profiles, use cases, or credentials.`,builder:na,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust casb integrations update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/one/integrations/${e.id==null?`<id>`:encodeURIComponent(String(e.id))}`,pathParams:{id:String(e.id??``)},bodyKind:`json`,body:e.body===void 0?d({dlp_profiles:e[`dlp-profiles`],name:f(e.name,`name`,`text`),permissions:e.permissions,use_cases:e[`use-cases`]}):l(e.body)});return}let m=await i(e),h=e.local?c:await n();if(e.accountId=h,e.file){let t=p(e.file);a(await s(`Updating`,async()=>r(m,`PATCH`,`/accounts/${h}/one/integrations/${encodeURIComponent(String(e.id))}`,{body:t,headers:{"Content-Type":``}})),{successLabel:`Updated`});return}if(e.body){let t=l(e.body);a(await s(`Updating`,async()=>r(m,`PATCH`,`/accounts/${h}/one/integrations/${encodeURIComponent(String(e.id))}`,{body:t})),{successLabel:`Updated`});return}let g={};e[`dlp-profiles`]!==void 0&&u(g,[`dlp_profiles`],e[`dlp-profiles`]),e.name!==void 0&&u(g,[`name`],f(e.name,`name`,`text`)),e.permissions!==void 0&&u(g,[`permissions`],e.permissions),e[`use-cases`]!==void 0&&u(g,[`use_cases`],e[`use-cases`]),a(await s(`Updating`,async()=>r(m,`PATCH`,`/accounts/${h}/one/integrations/${encodeURIComponent(String(e.id))}`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Updated`})}},ia={command:`integrations`,describe:`Operations for casb.integrations`,builder:e=>e.command(Gi).command(qi).command(Yi).command(Zi).command($i).command(ta).command(ra).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},aa={command:`casb`,describe:`Operations for casb`,builder:e=>e.command(Ui).command(ia).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function oa(e){return e.option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`certificate`,{type:`string`,description:`The certificate content.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const sa={command:`create`,describe:`Adds a new mTLS root certificate to Access.`,builder:oa,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/certificates`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?d({associated_hostnames:t[`associated-hostnames`],certificate:f(t.certificate,`certificate`,`text`),name:f(t.name,`name`,`text`)}):l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=l(t.body);a(await s(`Creating`,async()=>n.zeroTrust.certificates.create({...e,zone_id:r})),{successLabel:`Created`});return}t.certificate===void 0&&(t.certificate=await h(`certificate`,`The certificate content.`)),t.name===void 0&&(t.name=await h(`name`,`The name of the certificate.`));let c=d({associated_hostnames:t[`associated-hostnames`],certificate:f(t.certificate,`certificate`,`text`),name:f(t.name,`name`,`text`)});a(await s(`Creating`,async()=>n.zeroTrust.certificates.create({...c,zone_id:r})),{successLabel:`Created`})}};function ca(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const la={command:`delete <certificate-id>`,describe:`Deletes an mTLS certificate.`,builder:ca,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/certificates/${t[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(t[`certificate-id`]))}`,pathParams:{"certificate-id":String(t[`certificate-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,!await g({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>n.zeroTrust.certificates.delete({zone_id:r,certificate_id:t[`certificate-id`]})),{successLabel:`Deleted`})}};function ua(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const da={command:`get <certificate-id>`,describe:`Fetches a single mTLS certificate.`,builder:ua,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/certificates/${t[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(t[`certificate-id`]))}`,pathParams:{"certificate-id":String(t[`certificate-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.certificates.get({zone_id:r,certificate_id:t[`certificate-id`]})),{successLabel:`Loaded`})}};function fa(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pa={command:`list`,describe:`Lists all mTLS certificates.`,builder:fa,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/certificates`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.certificates.list({zone_id:r})),{successLabel:`Loaded`})}};function ma(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ha={command:`list`,describe:`List all mTLS hostname settings for this zone.`,builder:ma,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust certificates settings list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/certificates/settings`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.certificates.settings.list({zone_id:r})),{successLabel:`Loaded`})}};function ga(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _a={command:`update`,describe:`Updates an mTLS certificate's hostname settings.`,builder:ga,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust certificates settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/certificates/settings`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?void 0:l(t.body)});return}let n=await i(t),c=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=c,t.body){let e=l(t.body);a(await s(`Updating`,async()=>n.zeroTrust.certificates.settings.update({...e,zone_id:c})),{successLabel:`Updated`});return}a(await s(`Updating`,async()=>r(n,`PUT`,`/zones/${t.zoneId}/access/certificates/settings`)),{successLabel:`Updated`})}},va={command:`settings`,describe:`Operations for certificates.settings`,builder:e=>e.command(ha).command(_a).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ya(e){return e.positional(`certificate-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ba={command:`update <certificate-id>`,describe:`Updates a configured mTLS certificate.`,builder:ya,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust certificates update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/certificates/${t[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(t[`certificate-id`]))}`,pathParams:{"certificate-id":String(t[`certificate-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?d({associated_hostnames:t[`associated-hostnames`],name:f(t.name,`name`,`text`)}):l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=l(t.body);a(await s(`Updating`,async()=>n.zeroTrust.certificates.update({...e,zone_id:r,certificate_id:t[`certificate-id`]})),{successLabel:`Updated`});return}if(t[`associated-hostnames`]===void 0)throw Error(`--associated-hostnames is required (or pass --body with this field set).`);let c=d({associated_hostnames:t[`associated-hostnames`],name:f(t.name,`name`,`text`)});a(await s(`Updating`,async()=>n.zeroTrust.certificates.update({...c,zone_id:r,certificate_id:t[`certificate-id`]})),{successLabel:`Updated`})}},xa={command:`certificates`,describe:`Operations for certificates`,builder:e=>e.command(sa).command(la).command(da).command(pa).command(ba).command(va).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Sa(e){return e.option(`icmp-proxy-enabled`,{type:`boolean`,description:`A flag to enable the ICMP proxy for the account network.`}).option(`offramp-warp-enabled`,{type:`boolean`,description:`A flag to enable WARP to WARP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ca={command:`edit`,describe:`Updates the Zero Trust Connectivity Settings for the given account.`,builder:Sa,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust connectivity-settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zerotrust/connectivity_settings`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({icmp_proxy_enabled:e[`icmp-proxy-enabled`],offramp_warp_enabled:e[`offramp-warp-enabled`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.connectivitySettings.edit({...t,account_id:u})),{successLabel:`Updated`});return}let f=d({icmp_proxy_enabled:e[`icmp-proxy-enabled`],offramp_warp_enabled:e[`offramp-warp-enabled`]});a(await s(`Updating`,async()=>r.zeroTrust.connectivitySettings.edit({...f,account_id:u})),{successLabel:`Updated`})}};function wa(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ta={command:`get`,describe:`Gets the Zero Trust Connectivity Settings for the given account.`,builder:wa,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust connectivity-settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zerotrust/connectivity_settings`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.connectivitySettings.get({account_id:l})),{successLabel:`Loaded`})}},Ea={command:`connectivity-settings`,describe:`Operations for connectivity-settings`,builder:e=>e.command(Ca).command(Ta).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Da(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Oa={command:`list`,describe:`Retrieves a list of all available target environments with their display names. This endpoint is in Beta.`,builder:Da,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices client target environments list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/client-versions/target-environments`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.client.target.environments.list({account_id:l})),{successLabel:`Loaded`})}},ka={command:`environments`,describe:`Operations for devices.client.target.environments`,builder:e=>e.command(Oa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Aa={command:`target`,describe:`Operations for devices.client.target`,builder:e=>e.command(ka).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ja(e){return e.option(`target-environment`,{type:`string`,description:`The target environment for the client version (e.g., windows, macos).`,demandOption:!0}).option(`release-track`,{type:`string`,description:`The release track (ga for General Availability, beta for Beta releases).`,choices:[`ga`,`beta`],demandOption:!0}).option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The maximum number of versions to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ma={command:`list`,describe:`Lists available WARP client versions for a specific target environment and release track. This endpoint is in Beta.`,builder:_(ja),handler:async e=>{let r={target_environment:e[`target-environment`],release_track:e[`release-track`],page:e.page,per_page:e[`per-page`]};if(e.dryRun){o({command:`cf zero-trust devices client versions list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/client-versions`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.devices.client.versions.list({account_id:u,...r})),{successLabel:`Loaded`})}},Na={command:`versions`,describe:`Operations for devices.client.versions`,builder:e=>e.command(Ma).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Pa={command:`client`,describe:`Operations for devices.client`,builder:e=>e.command(Aa).command(Na).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Fa(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for the deployment group.`}).option(`policy-ids`,{type:`string`,array:!0,description:`Contains an optional list of policy IDs assigned to a group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ia={command:`create`,describe:`Creates a new deployment group. Policy IDs must be unique across all deployment groups. This endpoint is in Beta.`,builder:Fa,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices deployment groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/deployment-groups`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({name:f(e.name,`name`,`text`),policy_ids:e[`policy-ids`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.devices.deployment.groups.create({...t,account_id:u})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await h(`name`,`A user-friendly name for the deployment group.`));let p=d({name:f(e.name,`name`,`text`),policy_ids:e[`policy-ids`]});a(await s(`Creating`,async()=>r.zeroTrust.devices.deployment.groups.create({...p,account_id:u})),{successLabel:`Created`})}};function La(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ra={command:`delete <group-id>`,describe:`Deletes a deployment group. Associated policies no longer apply and devices stop receiving version targets. This endpoint is in Beta.`,builder:La,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices deployment groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/deployment-groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.devices.deployment.groups.delete({account_id:l,group_id:e[`group-id`]})),{successLabel:`Deleted`})}};function za(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ba={command:`get <group-id>`,describe:`Fetches a single deployment group by its ID. This endpoint is in Beta.`,builder:za,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices deployment groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/deployment-groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.deployment.groups.get({account_id:l,group_id:e[`group-id`]})),{successLabel:`Loaded`})}};function Va(e){return e.option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The maximum number of deployment groups to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ha={command:`list`,describe:`Lists all deployment groups for an account. Use deployment groups to assign target WARP client versions to specific devices. This endpoint is in Beta.`,builder:Va,handler:async e=>{let r={page:e.page,per_page:e[`per-page`]};if(e.dryRun){o({command:`cf zero-trust devices deployment groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/deployment-groups`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.devices.deployment.groups.list({account_id:u,...r})),{successLabel:`Loaded`})}};function Ua(e){return e.positional(`group-id`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for the deployment group.`}).option(`policy-ids`,{type:`string`,array:!0,description:`Replaces the entire list of policy IDs.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wa={command:`update <group-id>`,describe:`Updates a deployment group. Returns 409 if any newly added policy IDs already belong to another deployment group. This endpoint is in Beta.`,builder:Ua,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices deployment groups update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/deployment-groups/${e[`group-id`]==null?`<group-id>`:encodeURIComponent(String(e[`group-id`]))}`,pathParams:{"group-id":String(e[`group-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({name:f(e.name,`name`,`text`),policy_ids:e[`policy-ids`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.devices.deployment.groups.update({...t,account_id:u,group_id:e[`group-id`]})),{successLabel:`Updated`});return}let p=d({name:f(e.name,`name`,`text`),policy_ids:e[`policy-ids`]});a(await s(`Updating`,async()=>r.zeroTrust.devices.deployment.groups.update({...p,account_id:u,group_id:e[`group-id`]})),{successLabel:`Updated`})}},Ga={command:`groups`,describe:`Operations for devices.deployment.groups`,builder:e=>e.command(Ia).command(Ra).command(Ba).command(Ha).command(Wa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ka={command:`deployment`,describe:`Operations for devices.deployment`,builder:e=>e.command(Ga).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function qa(e){return e.positional(`device-id`,{type:`string`,description:`Registration ID. Equal to Device ID except for accounts which enabled [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/).`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ja={command:`get <device-id>`,describe:`Fetches a single WARP device. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices/{device_id} - GET /accounts/{account_id}/devices/registrations/{registration_id}`,builder:qa,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}`,pathParams:{"device-id":String(e[`device-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.get({account_id:l,device_id:e[`device-id`]})),{successLabel:`Loaded`})}};function Ya(e){return e.option(`description`,{type:`string`,description:`An optional description of the Device IP profile.`}).option(`enabled`,{type:`boolean`,description:`Whether the Device IP profile will be applied to matching devices.`,default:!0}).option(`match`,{type:`string`,description:`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`}).option(`name`,{type:`string`,description:`A user-friendly name for the Device IP profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.`}).option(`subnet-id`,{type:`string`,description:`The ID of the Subnet.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Xa={command:`create`,describe:`Creates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.`,builder:Ya,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices ip-profiles create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/ip-profiles`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({description:f(e.description,`description`,`text`),enabled:e.enabled,match:f(e.match,`match`,`text`),name:f(e.name,`name`,`text`),precedence:e.precedence,subnet_id:f(e[`subnet-id`],`subnet-id`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.devices.ipProfiles.create({...t,account_id:u})),{successLabel:`Created`});return}if(e.match===void 0&&(e.match=await h(`match`,`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`)),e.name===void 0&&(e.name=await h(`name`,`A user-friendly name for the Device IP profile.`)),e.precedence===void 0)throw Error(`--precedence is required (or pass --body with this field set).`);e[`subnet-id`]===void 0&&(e[`subnet-id`]=await h(`subnet-id`,`The ID of the Subnet.`));let p=d({description:f(e.description,`description`,`text`),enabled:e.enabled,match:f(e.match,`match`,`text`),name:f(e.name,`name`,`text`),precedence:e.precedence,subnet_id:f(e[`subnet-id`],`subnet-id`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.devices.ipProfiles.create({...p,account_id:u})),{successLabel:`Created`})}};function Za(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Qa={command:`delete <profile-id>`,describe:`Delete a WARP Device IP profile.`,builder:Za,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices ip-profiles delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/ip-profiles/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.devices.ipProfiles.delete({account_id:l,profile_id:e[`profile-id`]})),{successLabel:`Deleted`})}};function $a(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const eo={command:`get <profile-id>`,describe:`Fetches a single WARP Device IP profile.`,builder:$a,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices ip-profiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/ip-profiles/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.ipProfiles.get({account_id:l,profile_id:e[`profile-id`]})),{successLabel:`Loaded`})}};function to(e){return e.option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The number of IP profiles to return per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const no={command:`list`,describe:`Lists WARP Device IP profiles.`,builder:to,handler:async e=>{let r={page:e.page,per_page:e[`per-page`]};if(e.dryRun){o({command:`cf zero-trust devices ip-profiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/ip-profiles`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.devices.ipProfiles.list({account_id:u,...r})),{successLabel:`Loaded`})}};function ro(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`description`,{type:`string`,description:`An optional description of the Device IP profile.`}).option(`enabled`,{type:`boolean`,description:`Whether the Device IP profile is enabled.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`}).option(`name`,{type:`string`,description:`A user-friendly name for the Device IP profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.`}).option(`subnet-id`,{type:`string`,description:`The ID of the Subnet.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const io={command:`update <profile-id>`,describe:`Updates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.`,builder:ro,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices ip-profiles update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/ip-profiles/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({description:f(e.description,`description`,`text`),enabled:e.enabled,match:f(e.match,`match`,`text`),name:f(e.name,`name`,`text`),precedence:e.precedence,subnet_id:f(e[`subnet-id`],`subnet-id`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.devices.ipProfiles.update({...t,account_id:u,profile_id:e[`profile-id`]})),{successLabel:`Updated`});return}let p=d({description:f(e.description,`description`,`text`),enabled:e.enabled,match:f(e.match,`match`,`text`),name:f(e.name,`name`,`text`),precedence:e.precedence,subnet_id:f(e[`subnet-id`],`subnet-id`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.devices.ipProfiles.update({...p,account_id:u,profile_id:e[`profile-id`]})),{successLabel:`Updated`})}},ao={command:`ip-profiles`,describe:`Operations for devices.ip-profiles`,builder:e=>e.command(Xa).command(Qa).command(eo).command(no).command(io).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function oo(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const so={command:`list`,describe:`List WARP devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices - GET /accounts/{account_id}/devices/registrations`,builder:oo,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.list({account_id:l})),{successLabel:`Loaded`})}};function co(e){return e.option(`config-sha256`,{type:`string`,description:`The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.`}).option(`config-tls-sockaddr`,{type:`string`,description:`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`}).option(`name`,{type:`string`,description:`The name of the device managed network. This name must be unique.`}).option(`type`,{type:`string`,description:`The type of device managed network.`,choices:[`tls`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const lo={command:`create`,describe:`Creates a new device managed network.`,builder:co,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/networks`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({config:{sha256:f(e[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:f(e[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:f(e.name,`name`,`text`),type:f(e.type,`type`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.devices.networks.create({...t,account_id:u})),{successLabel:`Created`});return}e[`config-tls-sockaddr`]===void 0&&(e[`config-tls-sockaddr`]=await h(`config-tls-sockaddr`,`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`)),e.name===void 0&&(e.name=await h(`name`,`The name of the device managed network. This name must be unique.`)),e.type===void 0&&(e.type=await m(`type`,`The type of device managed network.`,[`tls`]));let p=d({config:{sha256:f(e[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:f(e[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:f(e.name,`name`,`text`),type:f(e.type,`type`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.devices.networks.create({...p,account_id:u})),{successLabel:`Created`})}};function uo(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const fo={command:`delete <network-id>`,describe:`Deletes a device managed network and fetches a list of the remaining device managed networks for an account.`,builder:uo,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/networks/${e[`network-id`]==null?`<network-id>`:encodeURIComponent(String(e[`network-id`]))}`,pathParams:{"network-id":String(e[`network-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.devices.networks.delete({account_id:l,network_id:e[`network-id`]})),{successLabel:`Deleted`})}};function po(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const mo={command:`get <network-id>`,describe:`Fetches details for a single managed network.`,builder:po,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices networks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/networks/${e[`network-id`]==null?`<network-id>`:encodeURIComponent(String(e[`network-id`]))}`,pathParams:{"network-id":String(e[`network-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.networks.get({account_id:l,network_id:e[`network-id`]})),{successLabel:`Loaded`})}};function ho(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const go={command:`list`,describe:`Fetches a list of managed networks for an account.`,builder:ho,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices networks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/networks`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.networks.list({account_id:l})),{successLabel:`Loaded`})}};function _o(e){return e.positional(`network-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`config-sha256`,{type:`string`,description:`The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.`}).option(`config-tls-sockaddr`,{type:`string`,description:`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`}).option(`name`,{type:`string`,description:`The name of the device managed network. This name must be unique.`}).option(`type`,{type:`string`,description:`The type of device managed network.`,choices:[`tls`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`config-sha256`,`config-tls-sockaddr`].some(t=>e[t]!==void 0)){let t=[`config-tls-sockaddr`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --config-* flag is set`)}return!0})}const vo={command:`update <network-id>`,describe:`Updates a configured device managed network.`,builder:_o,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices networks update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/networks/${e[`network-id`]==null?`<network-id>`:encodeURIComponent(String(e[`network-id`]))}`,pathParams:{"network-id":String(e[`network-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({config:{sha256:f(e[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:f(e[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:f(e.name,`name`,`text`),type:f(e.type,`type`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.devices.networks.update({...t,account_id:u,network_id:e[`network-id`]})),{successLabel:`Updated`});return}let p=d({config:{sha256:f(e[`config-sha256`],`config-sha256`,`text`),tls_sockaddr:f(e[`config-tls-sockaddr`],`config-tls-sockaddr`,`text`)},name:f(e.name,`name`,`text`),type:f(e.type,`type`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.devices.networks.update({...p,account_id:u,network_id:e[`network-id`]})),{successLabel:`Updated`})}},yo={command:`networks`,describe:`Operations for devices.networks`,builder:e=>e.command(lo).command(fo).command(mo).command(go).command(vo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bo(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xo={command:`get <registration-id>`,describe:`Fetches one-time use admin override codes for a registration. This relies on the **Admin Override** setting being enabled in your device configuration.`,builder:bo,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices override-codes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/registrations/${e[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(e[`registration-id`]))}/override_codes`,pathParams:{"registration-id":String(e[`registration-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.overrideCodes.get({account_id:l,registration_id:e[`registration-id`]})),{successLabel:`Loaded`})}};function So(e){return e.option(`device-id`,{type:`string`,description:`Registration ID. Equal to Device ID except for accounts which enabled [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/).`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Co={command:`list`,describe:`Fetches a one-time use admin override code for a device. This relies on the **Admin Override** setting being enabled in your device configuration. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated:** please use GET /accounts/{account_id}/devices/registrations/{registration_id}/override_codes instead.`,builder:So,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices override-codes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}/override_codes`,pathParams:{"device-id":String(e[`device-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.overrideCodes.list({account_id:l,device_id:e[`device-id`]})),{successLabel:`Loaded`})}},wo={command:`override-codes`,describe:`Operations for devices.override-codes`,builder:e=>e.command(xo).command(Co).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function To(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Eo={command:`delete <device-id>`,describe:`Deletes a WARP device.`,builder:To,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices physical-devices delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/physical-devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}`,pathParams:{"device-id":String(e[`device-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.devices.physicalDevices.delete({account_id:l,device_id:e[`device-id`]})),{successLabel:`Deleted`})}};function Do(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the device response. Supported values are: "last_seen_registration.policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Oo={command:`get <device-id>`,describe:`Fetches a single WARP device.`,builder:Do,handler:async e=>{let r={include:e.include};if(e.dryRun){o({command:`cf zero-trust devices physical-devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/physical-devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}`,pathParams:{"device-id":String(e[`device-id`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.devices.physicalDevices.get({account_id:u,device_id:e[`device-id`],...r})),{successLabel:`Loaded`})}};function ko(e){return e.option(`cursor`,{type:`string`,description:`Opaque token indicating the starting position when requesting the next set of records. A cursor value can be obtained from the result_info.cursor field in the response.`}).option(`sort-by`,{type:`string`,description:`The device field to order results by.`,choices:[`name`,`id`,`client_version`,`last_seen_user.email`,`last_seen_at`,`active_registrations`,`created_at`]}).option(`sort-order`,{type:`string`,description:`Sort direction.`,choices:[`asc`,`desc`]}).option(`last-seen-user-email`,{type:`string`,description:`Filter by the last seen user's email.`}).option(`seen-after`,{type:`string`,description:`Filter by the last_seen timestamp - returns only devices last seen after this timestamp.`}).option(`seen-before`,{type:`string`,description:`Filter by the last_seen timestamp - returns only devices last seen before this timestamp.`}).option(`per-page`,{type:`number`,description:`The maximum number of devices to return in a single response.`}).option(`search`,{type:`string`,description:`Search by device details.`}).option(`active-registrations`,{type:`string`,description:`Include or exclude devices with active registrations. The default is "only" - return only devices with active registrations.`,choices:[`include`,`only`,`exclude`]}).option(`id`,{type:`string`,description:`Filter by a one or more device IDs.`}).option(`last-seen-registration-policy-id`,{type:`string`,description:`Filter by the ID of the device settings profile assigned to the device registration.`}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the device response. Supported values are: "last_seen_registration.policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ao={command:`list`,describe:`Lists WARP devices.`,builder:_(ko),handler:async e=>{let r={cursor:e.cursor,sort_by:e[`sort-by`],sort_order:e[`sort-order`],"last_seen_user.email":e[`last-seen-user-email`],seen_after:e[`seen-after`],seen_before:e[`seen-before`],per_page:e[`per-page`],search:e.search,active_registrations:e[`active-registrations`],id:e.id,"last_seen_registration.policy.id":e[`last-seen-registration-policy-id`],include:e.include};if(e.dryRun){o({command:`cf zero-trust devices physical-devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/physical-devices`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.devices.physicalDevices.list({account_id:u,...r})),{successLabel:`Loaded`})}};function jo(e){return e.positional(`device-id`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Mo={command:`revoke <device-id>`,describe:`Revokes all WARP registrations associated with the specified device.`,builder:jo,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices physical-devices revoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/physical-devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}/revoke`,pathParams:{"device-id":String(e[`device-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force,message:`This operation revokes a device's session destructively.`})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.devices.physicalDevices.revoke({account_id:l,device_id:e[`device-id`]})),{successLabel:`Deleted`})}},No={command:`physical-devices`,describe:`Enrolled physical WARP devices`,builder:e=>e.command(Eo).command(Oo).command(Ao).command(Mo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Po(e){return e.option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`,default:!1}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`,default:!1}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`,default:!0}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`,default:0}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`,default:180}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`.",default:!1}).option(`enabled`,{type:`boolean`,description:`Whether the policy will be applied to matching devices.`,default:!0}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`,default:!1}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`}).option(`name`,{type:`string`,description:`The name of the device settings profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`,default:!0}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`,default:!1}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`,default:``}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`,default:!1}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`,default:``}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const Fo={command:`create`,describe:`Creates a device settings profile to be applied to certain devices matching the criteria.`,builder:Po,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({allow_mode_switch:e[`allow-mode-switch`],allow_updates:e[`allow-updates`],allowed_to_leave:e[`allowed-to-leave`],auto_connect:e[`auto-connect`],captive_portal:e[`captive-portal`],disable_auto_fallback:e[`disable-auto-fallback`],enabled:e.enabled,exclude_office_ips:e[`exclude-office-ips`],global_acceleration:{api_endpoints:e[`global-acceleration-api-endpoints`],enabled:e[`global-acceleration-enabled`],masque_endpoints:e[`global-acceleration-masque-endpoints`],wireguard_endpoints:e[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:e[`lan-allow-minutes`],lan_allow_subnet_size:e[`lan-allow-subnet-size`],match:f(e.match,`match`,`text`),name:f(e.name,`name`,`text`),precedence:e.precedence,register_interface_ip_with_dns:e[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:e[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(e[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:e[`service-mode-v2-port`]},support_url:f(e[`support-url`],`support-url`,`text`),switch_locked:e[`switch-locked`],tunnel_protocol:f(e[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:e[`virtual-networks-allowed`],default:f(e[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.devices.policies.custom.create({...t,account_id:u})),{successLabel:`Created`});return}if(e.match===void 0&&(e.match=await h(`match`,`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`)),e.name===void 0&&(e.name=await h(`name`,`The name of the device settings profile.`)),e.precedence===void 0)throw Error(`--precedence is required (or pass --body with this field set).`);let p=d({allow_mode_switch:e[`allow-mode-switch`],allow_updates:e[`allow-updates`],allowed_to_leave:e[`allowed-to-leave`],auto_connect:e[`auto-connect`],captive_portal:e[`captive-portal`],disable_auto_fallback:e[`disable-auto-fallback`],enabled:e.enabled,exclude_office_ips:e[`exclude-office-ips`],global_acceleration:{api_endpoints:e[`global-acceleration-api-endpoints`],enabled:e[`global-acceleration-enabled`],masque_endpoints:e[`global-acceleration-masque-endpoints`],wireguard_endpoints:e[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:e[`lan-allow-minutes`],lan_allow_subnet_size:e[`lan-allow-subnet-size`],match:f(e.match,`match`,`text`),name:f(e.name,`name`,`text`),precedence:e.precedence,register_interface_ip_with_dns:e[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:e[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(e[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:e[`service-mode-v2-port`]},support_url:f(e[`support-url`],`support-url`,`text`),switch_locked:e[`switch-locked`],tunnel_protocol:f(e[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:e[`virtual-networks-allowed`],default:f(e[`virtual-networks-default`],`virtual-networks-default`,`text`)}});a(await s(`Creating`,async()=>r.zeroTrust.devices.policies.custom.create({...p,account_id:u})),{successLabel:`Created`})}};function Io(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Lo={command:`delete <policy-id>`,describe:`Deletes a device settings profile and fetches a list of the remaining profiles for an account.`,builder:Io,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.devices.policies.custom.delete({account_id:l,policy_id:e[`policy-id`]})),{successLabel:`Deleted`})}};function Ro(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`}).option(`description`,{type:`string`,description:`A description of the policy.`}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`."}).option(`enabled`,{type:`boolean`,description:`Whether the policy will be applied to matching devices.`}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`}).option(`name`,{type:`string`,description:`The name of the device settings profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const zo={command:`edit <policy-id>`,describe:`Updates a configured device settings profile.`,builder:Ro,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies custom edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({allow_mode_switch:e[`allow-mode-switch`],allow_updates:e[`allow-updates`],allowed_to_leave:e[`allowed-to-leave`],auto_connect:e[`auto-connect`],captive_portal:e[`captive-portal`],description:f(e.description,`description`,`text`),disable_auto_fallback:e[`disable-auto-fallback`],enabled:e.enabled,exclude_office_ips:e[`exclude-office-ips`],global_acceleration:{api_endpoints:e[`global-acceleration-api-endpoints`],enabled:e[`global-acceleration-enabled`],masque_endpoints:e[`global-acceleration-masque-endpoints`],wireguard_endpoints:e[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:e[`lan-allow-minutes`],lan_allow_subnet_size:e[`lan-allow-subnet-size`],match:f(e.match,`match`,`text`),name:f(e.name,`name`,`text`),precedence:e.precedence,register_interface_ip_with_dns:e[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:e[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(e[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:e[`service-mode-v2-port`]},support_url:f(e[`support-url`],`support-url`,`text`),switch_locked:e[`switch-locked`],tunnel_protocol:f(e[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:e[`virtual-networks-allowed`],default:f(e[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.devices.policies.custom.edit({...t,account_id:u,policy_id:e[`policy-id`]})),{successLabel:`Updated`});return}let p=d({allow_mode_switch:e[`allow-mode-switch`],allow_updates:e[`allow-updates`],allowed_to_leave:e[`allowed-to-leave`],auto_connect:e[`auto-connect`],captive_portal:e[`captive-portal`],description:f(e.description,`description`,`text`),disable_auto_fallback:e[`disable-auto-fallback`],enabled:e.enabled,exclude_office_ips:e[`exclude-office-ips`],global_acceleration:{api_endpoints:e[`global-acceleration-api-endpoints`],enabled:e[`global-acceleration-enabled`],masque_endpoints:e[`global-acceleration-masque-endpoints`],wireguard_endpoints:e[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:e[`lan-allow-minutes`],lan_allow_subnet_size:e[`lan-allow-subnet-size`],match:f(e.match,`match`,`text`),name:f(e.name,`name`,`text`),precedence:e.precedence,register_interface_ip_with_dns:e[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:e[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(e[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:e[`service-mode-v2-port`]},support_url:f(e[`support-url`],`support-url`,`text`),switch_locked:e[`switch-locked`],tunnel_protocol:f(e[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:e[`virtual-networks-allowed`],default:f(e[`virtual-networks-default`],`virtual-networks-default`,`text`)}});a(await s(`Updating`,async()=>r.zeroTrust.devices.policies.custom.edit({...p,account_id:u,policy_id:e[`policy-id`]})),{successLabel:`Updated`})}};function Bo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vo={command:`get <policy-id>`,describe:`Fetches the list of routes excluded from the WARP client's tunnel for a specific device settings profile.`,builder:Bo,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies custom excludes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/exclude`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.policies.custom.excludes.get({account_id:l,policy_id:e[`policy-id`]})),{successLabel:`Loaded`})}};function Ho(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Uo={command:`update <policy-id>`,describe:`Sets the list of routes excluded from the WARP client's tunnel for a specific device settings profile.`,builder:Ho,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies custom excludes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/exclude`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.devices.policies.custom.excludes.update({body:t,account_id:u,policy_id:e[`policy-id`]})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Wo={command:`excludes`,describe:`Operations for devices.policies.custom.excludes`,builder:e=>e.command(Vo).command(Uo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Go(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ko={command:`get <policy-id>`,describe:`Fetches the list of domains to bypass Gateway DNS resolution from a specified device settings profile. These domains will use the specified local DNS resolver instead.`,builder:Go,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies custom fallback-domains get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/fallback_domains`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.policies.custom.fallbackDomains.get({account_id:l,policy_id:e[`policy-id`]})),{successLabel:`Loaded`})}};function qo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Jo={command:`update <policy-id>`,describe:`Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. This will only apply to the specified device settings profile.`,builder:qo,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies custom fallback-domains update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/fallback_domains`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.devices.policies.custom.fallbackDomains.update({body:t,account_id:u,policy_id:e[`policy-id`]})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Yo={command:`fallback-domains`,describe:`Operations for devices.policies.custom.fallback-domains`,builder:e=>e.command(Ko).command(Jo).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Xo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zo={command:`get <policy-id>`,describe:`Fetches a device settings profile by ID.`,builder:Xo,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies custom get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.policies.custom.get({account_id:l,policy_id:e[`policy-id`]})),{successLabel:`Loaded`})}};function Qo(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $o={command:`get <policy-id>`,describe:`Fetches the list of routes included in the WARP client's tunnel for a specific device settings profile.`,builder:Qo,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies custom includes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/include`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.policies.custom.includes.get({account_id:l,policy_id:e[`policy-id`]})),{successLabel:`Loaded`})}};function es(e){return e.positional(`policy-id`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ts={command:`update <policy-id>`,describe:`Sets the list of routes included in the WARP client's tunnel for a specific device settings profile.`,builder:es,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies custom includes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy/${e[`policy-id`]==null?`<policy-id>`:encodeURIComponent(String(e[`policy-id`]))}/include`,pathParams:{"policy-id":String(e[`policy-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.devices.policies.custom.includes.update({body:t,account_id:u,policy_id:e[`policy-id`]})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},ns={command:`includes`,describe:`Operations for devices.policies.custom.includes`,builder:e=>e.command($o).command(ts).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function rs(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const is={command:`list`,describe:`Fetches a list of the device settings profiles for an account.`,builder:rs,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies custom list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policies`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.policies.custom.list({account_id:l})),{successLabel:`Loaded`})}},as={command:`custom`,describe:`Operations for devices.policies.custom`,builder:e=>e.command(Fo).command(Lo).command(zo).command(Zo).command(is).command(Wo).command(Yo).command(ns).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function os(e){return e.option(`enabled`,{type:`boolean`,description:`The current status of the device policy certificate provisioning feature for WARP clients.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ss={command:`edit`,describe:`Enable Zero Trust Clients to provision a certificate, containing a x509 subject, and referenced by Access device posture policies when the client visits MTLS protected domains. This facilitates device posture without a WARP session.`,builder:os,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust devices policies default certificates edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/devices/policy/certificates`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?d({enabled:t.enabled}):l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=l(t.body);a(await s(`Updating`,async()=>n.zeroTrust.devices.policies.default.certificates.edit({body:e,zone_id:r})),{successLabel:`Updated`});return}if(t.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let c=d({enabled:t.enabled});a(await s(`Updating`,async()=>n.zeroTrust.devices.policies.default.certificates.edit({body:c,zone_id:r})),{successLabel:`Updated`})}};function cs(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ls={command:`get`,describe:`Fetches device certificate provisioning.`,builder:cs,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust devices policies default certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/devices/policy/certificates`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.devices.policies.default.certificates.get({zone_id:r})),{successLabel:`Loaded`})}},us={command:`certificates`,describe:`Operations for devices.policies.default.certificates`,builder:e=>e.command(ss).command(ls).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ds(e){return e.option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`."}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`}).option(`global-acceleration-api-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the API endpoints.`}).option(`global-acceleration-enabled`,{type:`boolean`,description:`Global acceleration settings are used only when "enabled".`}).option(`global-acceleration-masque-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the MASQUE tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`global-acceleration-wireguard-endpoints`,{type:`string`,array:!0,description:`IP:port entries for the WireGuard tunnel endpoints. Either wireguard_endpoints or masque_endpoints must be provided.`}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`}).option(`virtual-networks-allowed`,{type:`string`,array:!0,description:`List of virtual network IDs the device is allowed to access. When virtual_networks is set, at least one entry is required.`}).option(`virtual-networks-default`,{type:`string`,description:"The default virtual network ID. Must be included in the `allowed` list."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].some(t=>e[t]!==void 0)){let t=[`global-acceleration-api-endpoints`,`global-acceleration-enabled`,`global-acceleration-masque-endpoints`,`global-acceleration-wireguard-endpoints`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --global_acceleration-* flag is set`)}return!0}).check(e=>{if([`virtual-networks-allowed`,`virtual-networks-default`].some(t=>e[t]!==void 0)){let t=[`virtual-networks-allowed`,`virtual-networks-default`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --virtual_networks-* flag is set`)}return!0})}const fs={command:`edit`,describe:`Updates the default device settings profile for an account.`,builder:ds,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies default edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({allow_mode_switch:e[`allow-mode-switch`],allow_updates:e[`allow-updates`],allowed_to_leave:e[`allowed-to-leave`],auto_connect:e[`auto-connect`],captive_portal:e[`captive-portal`],disable_auto_fallback:e[`disable-auto-fallback`],exclude_office_ips:e[`exclude-office-ips`],global_acceleration:{api_endpoints:e[`global-acceleration-api-endpoints`],enabled:e[`global-acceleration-enabled`],masque_endpoints:e[`global-acceleration-masque-endpoints`],wireguard_endpoints:e[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:e[`lan-allow-minutes`],lan_allow_subnet_size:e[`lan-allow-subnet-size`],register_interface_ip_with_dns:e[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:e[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(e[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:e[`service-mode-v2-port`]},support_url:f(e[`support-url`],`support-url`,`text`),switch_locked:e[`switch-locked`],tunnel_protocol:f(e[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:e[`virtual-networks-allowed`],default:f(e[`virtual-networks-default`],`virtual-networks-default`,`text`)}}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.devices.policies.default.edit({...t,account_id:u})),{successLabel:`Updated`});return}let p=d({allow_mode_switch:e[`allow-mode-switch`],allow_updates:e[`allow-updates`],allowed_to_leave:e[`allowed-to-leave`],auto_connect:e[`auto-connect`],captive_portal:e[`captive-portal`],disable_auto_fallback:e[`disable-auto-fallback`],exclude_office_ips:e[`exclude-office-ips`],global_acceleration:{api_endpoints:e[`global-acceleration-api-endpoints`],enabled:e[`global-acceleration-enabled`],masque_endpoints:e[`global-acceleration-masque-endpoints`],wireguard_endpoints:e[`global-acceleration-wireguard-endpoints`]},lan_allow_minutes:e[`lan-allow-minutes`],lan_allow_subnet_size:e[`lan-allow-subnet-size`],register_interface_ip_with_dns:e[`register-interface-ip-with-dns`],sccm_vpn_boundary_support:e[`sccm-vpn-boundary-support`],service_mode_v2:{mode:f(e[`service-mode-v2-mode`],`service-mode-v2-mode`,`text`),port:e[`service-mode-v2-port`]},support_url:f(e[`support-url`],`support-url`,`text`),switch_locked:e[`switch-locked`],tunnel_protocol:f(e[`tunnel-protocol`],`tunnel-protocol`,`text`),virtual_networks:{allowed:e[`virtual-networks-allowed`],default:f(e[`virtual-networks-default`],`virtual-networks-default`,`text`)}});a(await s(`Updating`,async()=>r.zeroTrust.devices.policies.default.edit({...p,account_id:u})),{successLabel:`Updated`})}};function ps(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ms={command:`get`,describe:`Fetches the list of routes excluded from the WARP client's tunnel.`,builder:ps,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies default excludes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy/exclude`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.policies.default.excludes.get({account_id:l})),{successLabel:`Loaded`})}};function hs(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const gs={command:`update`,describe:`Sets the list of routes excluded from the WARP client's tunnel.`,builder:hs,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies default excludes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy/exclude`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.devices.policies.default.excludes.update({body:t,account_id:u})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},_s={command:`excludes`,describe:`Operations for devices.policies.default.excludes`,builder:e=>e.command(ms).command(gs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function vs(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ys={command:`get`,describe:`Fetches a list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.`,builder:vs,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies default fallback-domains get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy/fallback_domains`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.policies.default.fallbackDomains.get({account_id:l})),{successLabel:`Loaded`})}};function bs(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xs={command:`update`,describe:`Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.`,builder:bs,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies default fallback-domains update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy/fallback_domains`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.devices.policies.default.fallbackDomains.update({body:t,account_id:u})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ss={command:`fallback-domains`,describe:`Operations for devices.policies.default.fallback-domains`,builder:e=>e.command(ys).command(xs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Cs(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ws={command:`get`,describe:`Fetches the default device settings profile for an account.`,builder:Cs,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies default get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.policies.default.get({account_id:l})),{successLabel:`Loaded`})}};function Ts(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Es={command:`get`,describe:`Fetches the list of routes included in the WARP client's tunnel.`,builder:Ts,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies default includes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy/include`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.policies.default.includes.get({account_id:l})),{successLabel:`Loaded`})}};function Ds(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Os={command:`update`,describe:`Sets the list of routes included in the WARP client's tunnel.`,builder:Ds,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices policies default includes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/policy/include`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.devices.policies.default.includes.update({body:t,account_id:u})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},ks={command:`includes`,describe:`Operations for devices.policies.default.includes`,builder:e=>e.command(Es).command(Os).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},As={command:`default`,describe:`Operations for devices.policies.default`,builder:e=>e.command(fs).command(ws).command(us).command(_s).command(Ss).command(ks).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},js={command:`policies`,describe:`Operations for devices.policies`,builder:e=>e.command(as).command(As).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ms(e){return e.option(`description`,{type:`string`,description:`The description of the device posture rule.`}).option(`expiration`,{type:`string`,description:`Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.`}).option(`input-exists`,{type:`boolean`,description:`Whether or not file exists.`}).option(`input-operating-system`,{type:`string`,description:`Operating system.`,choices:[`windows`,`linux`,`mac`,`android`,`ios`,`chromeos`]}).option(`input-path`,{type:`string`,description:`File path.`}).option(`input-sha256`,{type:`string`,description:`SHA-256.`}).option(`input-thumbprint`,{type:`string`,description:`Signing certificate thumbprint.`}).option(`input-id`,{type:`string`,description:`List ID.`}).option(`input-domain`,{type:`string`,description:`Domain.`}).option(`input-operator`,{type:`string`,description:`Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-os-distro-name`,{type:`string`,description:`Operating System Distribution Name (linux only).`}).option(`input-os-distro-revision`,{type:`string`,description:`Version of OS Distribution (linux only).`}).option(`input-os-version-extra`,{type:`string`,description:`Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.`}).option(`input-version`,{type:`string`,description:`Version of OS.`}).option(`input-enabled`,{type:`boolean`,description:`Enabled.`}).option(`input-check-disks`,{type:`string`,array:!0,description:`List of volume names to be checked for encryption.`}).option(`input-require-all`,{type:`boolean`,description:`Whether to check all disks for encryption.`}).option(`input-certificate-id`,{type:`string`,description:`UUID of Cloudflare managed certificate.`}).option(`input-cn`,{type:`string`,description:`Common Name that is protected by the certificate.`}).option(`input-check-private-key`,{type:`boolean`,description:`Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.`}).option(`input-extended-key-usage`,{type:`string`,array:!0,description:`List of values indicating purposes for which the certificate public key can be used.`}).option(`input-locations-paths`,{type:`string`,array:!0,description:`List of paths to check for client certificate on linux.`}).option(`input-locations-trust-stores`,{type:`string`,array:!0,description:`List of trust stores to check for client certificate.`}).option(`input-subject-alternative-names`,{type:`string`,array:!0,description:`List of certificate Subject Alternative Names.`}).option(`input-update-window-days`,{type:`number`,description:`Number of days that the antivirus should be updated within.`}).option(`input-compliance-status`,{type:`string`,description:`Compliance Status.`,choices:[`compliant`,`noncompliant`,`unknown`,`notapplicable`,`ingraceperiod`,`error`]}).option(`input-connection-id`,{type:`string`,description:`Posture Integration ID.`}).option(`input-last-seen`,{type:`string`,description:`For more details on last seen, please refer to the Crowdstrike documentation.`}).option(`input-os`,{type:`string`,description:`Os Version.`}).option(`input-overall`,{type:`string`,description:`Overall.`}).option(`input-sensor-config`,{type:`string`,description:`SensorConfig.`}).option(`input-state`,{type:`string`,description:`For more details on state, please refer to the Crowdstrike documentation.`,choices:[`online`,`offline`,`unknown`]}).option(`input-version-operator`,{type:`string`,description:`Version Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-auth-state`,{type:`string`,array:!0,description:`The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.`}).option(`input-count-operator`,{type:`string`,description:`Count Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-issue-count`,{type:`string`,description:`The Number of Issues.`}).option(`input-eid-last-seen`,{type:`string`,description:`For more details on eid last seen, refer to the Tanium documentation.`}).option(`input-risk-level`,{type:`string`,description:`For more details on risk level, refer to the Tanium documentation.`,choices:[`low`,`medium`,`high`,`critical`]}).option(`input-score-operator`,{type:`string`,description:`Score Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-total-score`,{type:`number`,description:`For more details on total score, refer to the Tanium documentation.`}).option(`input-active-threats`,{type:`number`,description:`The Number of active threats.`}).option(`input-infected`,{type:`boolean`,description:`Whether device is infected.`}).option(`input-is-active`,{type:`boolean`,description:`Whether device is active.`}).option(`input-network-status`,{type:`string`,description:`Network status of device.`,choices:[`connected`,`disconnected`,`disconnecting`,`connecting`]}).option(`input-operational-state`,{type:`string`,description:`Agent operational state.`,choices:[`na`,`partially_disabled`,`auto_fully_disabled`,`fully_disabled`,`auto_partially_disabled`,`disabled_error`,`db_corruption`]}).option(`input-score`,{type:`number`,description:`A value between 0-100 assigned to devices set by the 3rd party posture provider.`}).option(`name`,{type:`string`,description:`The name of the device posture rule.`}).option(`schedule`,{type:`string`,description:"Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`."}).option(`type`,{type:`string`,description:`The type of device posture rule.`,choices:[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`input-exists`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operating-system`,`input-id.input-check-disks.input-require-all.input-certificate-id.input-cn.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-operator.input-os.input-overall.input-sensor-config.input-state.input-version.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-path`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sha256`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-thumbprint`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-id`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-domain`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operator`,[`input-exists`,`input-path`,`input-sha256`,`input-thumbprint`,`input-operating-system`,`input-id`,`input-domain`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`,`input-compliance-status`,`input-connection-id`,`input-auth-state`,`input-count-operator`,`input-issue-count`]).conflicts(`input-os-distro-name`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-distro-revision`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-version-extra`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-version`,[`input-operating-system`,`input-operator`]).conflicts(`input-enabled`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-enabled`,[`input-operating-system`]).conflicts(`input-check-disks`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-require-all`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-certificate-id`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-cn`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-cn`,[`input-certificate-id`]).conflicts(`input-check-private-key`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-check-private-key`,[`input-certificate-id`,`input-operating-system`]).conflicts(`input-extended-key-usage`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-paths`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-trust-stores`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-subject-alternative-names`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-update-window-days`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-compliance-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-connection-id`,[`input-exists`,`input-operating-system`,`input-path`,`input-sha256`,`input-thumbprint`,`input-id`,`input-domain`,`input-operator`,`input-os-distro-name`,`input-os-distro-revision`,`input-os-version-extra`,`input-version`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`]).conflicts(`input-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-overall`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sensor-config`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-auth-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-count-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-issue-count`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-eid-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-risk-level`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-score-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-total-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-active-threats`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-infected`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-is-active`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-network-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-operational-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state`.split(`.`)).implies(`input-score`,[`input-connection-id`,`input-operator`])}const Ns={command:`create`,describe:`Creates a new device posture rule.`,builder:Ms,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices posture create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/posture`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({description:f(e.description,`description`,`text`),expiration:f(e.expiration,`expiration`,`text`),input:{exists:e[`input-exists`],operating_system:f(e[`input-operating-system`],`input-operating-system`,`text`),path:f(e[`input-path`],`input-path`,`text`),sha256:f(e[`input-sha256`],`input-sha256`,`text`),thumbprint:f(e[`input-thumbprint`],`input-thumbprint`,`text`),id:f(e[`input-id`],`input-id`,`text`),domain:f(e[`input-domain`],`input-domain`,`text`),operator:f(e[`input-operator`],`input-operator`,`text`),os_distro_name:f(e[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:f(e[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:f(e[`input-os-version-extra`],`input-os-version-extra`,`text`),version:f(e[`input-version`],`input-version`,`text`),enabled:e[`input-enabled`],checkDisks:e[`input-check-disks`],requireAll:e[`input-require-all`],certificate_id:f(e[`input-certificate-id`],`input-certificate-id`,`text`),cn:f(e[`input-cn`],`input-cn`,`text`),check_private_key:e[`input-check-private-key`],extended_key_usage:e[`input-extended-key-usage`],locations:{paths:e[`input-locations-paths`],trust_stores:e[`input-locations-trust-stores`]},subject_alternative_names:e[`input-subject-alternative-names`],update_window_days:e[`input-update-window-days`],compliance_status:f(e[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:f(e[`input-connection-id`],`input-connection-id`,`text`),last_seen:f(e[`input-last-seen`],`input-last-seen`,`text`),os:f(e[`input-os`],`input-os`,`text`),overall:f(e[`input-overall`],`input-overall`,`text`),sensor_config:f(e[`input-sensor-config`],`input-sensor-config`,`text`),state:f(e[`input-state`],`input-state`,`text`),versionOperator:f(e[`input-version-operator`],`input-version-operator`,`text`),auth_state:e[`input-auth-state`],countOperator:f(e[`input-count-operator`],`input-count-operator`,`text`),issue_count:f(e[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:f(e[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:f(e[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:f(e[`input-score-operator`],`input-score-operator`,`text`),total_score:e[`input-total-score`],active_threats:e[`input-active-threats`],infected:e[`input-infected`],is_active:e[`input-is-active`],network_status:f(e[`input-network-status`],`input-network-status`,`text`),operational_state:f(e[`input-operational-state`],`input-operational-state`,`text`),score:e[`input-score`]},name:f(e.name,`name`,`text`),schedule:f(e.schedule,`schedule`,`text`),type:f(e.type,`type`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.devices.posture.create({...t,account_id:u})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await h(`name`,`The name of the device posture rule.`)),e.type===void 0&&(e.type=await m(`type`,`The type of device posture rule.`,[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]));let p=d({description:f(e.description,`description`,`text`),expiration:f(e.expiration,`expiration`,`text`),input:{exists:e[`input-exists`],operating_system:f(e[`input-operating-system`],`input-operating-system`,`text`),path:f(e[`input-path`],`input-path`,`text`),sha256:f(e[`input-sha256`],`input-sha256`,`text`),thumbprint:f(e[`input-thumbprint`],`input-thumbprint`,`text`),id:f(e[`input-id`],`input-id`,`text`),domain:f(e[`input-domain`],`input-domain`,`text`),operator:f(e[`input-operator`],`input-operator`,`text`),os_distro_name:f(e[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:f(e[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:f(e[`input-os-version-extra`],`input-os-version-extra`,`text`),version:f(e[`input-version`],`input-version`,`text`),enabled:e[`input-enabled`],checkDisks:e[`input-check-disks`],requireAll:e[`input-require-all`],certificate_id:f(e[`input-certificate-id`],`input-certificate-id`,`text`),cn:f(e[`input-cn`],`input-cn`,`text`),check_private_key:e[`input-check-private-key`],extended_key_usage:e[`input-extended-key-usage`],locations:{paths:e[`input-locations-paths`],trust_stores:e[`input-locations-trust-stores`]},subject_alternative_names:e[`input-subject-alternative-names`],update_window_days:e[`input-update-window-days`],compliance_status:f(e[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:f(e[`input-connection-id`],`input-connection-id`,`text`),last_seen:f(e[`input-last-seen`],`input-last-seen`,`text`),os:f(e[`input-os`],`input-os`,`text`),overall:f(e[`input-overall`],`input-overall`,`text`),sensor_config:f(e[`input-sensor-config`],`input-sensor-config`,`text`),state:f(e[`input-state`],`input-state`,`text`),versionOperator:f(e[`input-version-operator`],`input-version-operator`,`text`),auth_state:e[`input-auth-state`],countOperator:f(e[`input-count-operator`],`input-count-operator`,`text`),issue_count:f(e[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:f(e[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:f(e[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:f(e[`input-score-operator`],`input-score-operator`,`text`),total_score:e[`input-total-score`],active_threats:e[`input-active-threats`],infected:e[`input-infected`],is_active:e[`input-is-active`],network_status:f(e[`input-network-status`],`input-network-status`,`text`),operational_state:f(e[`input-operational-state`],`input-operational-state`,`text`),score:e[`input-score`]},name:f(e.name,`name`,`text`),schedule:f(e.schedule,`schedule`,`text`),type:f(e.type,`type`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.devices.posture.create({...p,account_id:u})),{successLabel:`Created`})}};function Ps(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Fs={command:`delete <rule-id>`,describe:`Deletes a device posture rule.`,builder:Ps,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices posture delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/posture/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.devices.posture.delete({account_id:l,rule_id:e[`rule-id`]})),{successLabel:`Deleted`})}};function Is(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ls={command:`get <rule-id>`,describe:`Fetches a single device posture rule.`,builder:Is,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices posture get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/posture/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.posture.get({account_id:l,rule_id:e[`rule-id`]})),{successLabel:`Loaded`})}};function Rs(e){return e.option(`config-api-url`,{type:`string`,description:`The Workspace One API URL provided in the Workspace One Admin Dashboard.`}).option(`config-auth-url`,{type:`string`,description:`The Workspace One Authorization URL depending on your region.`}).option(`config-client-id`,{type:`string`,description:`The Workspace One client ID provided in the Workspace One Admin Dashboard.`}).option(`config-client-secret`,{type:`string`,description:`The Workspace One client secret provided in the Workspace One Admin Dashboard.`}).option(`config-customer-id`,{type:`string`,description:`The Crowdstrike customer ID.`}).option(`config-client-key`,{type:`string`,description:`The Uptycs client secret.`}).option(`config-access-client-id`,{type:`string`,description:"If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`."}).option(`config-access-client-secret`,{type:`string`,description:"If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`."}).option(`interval`,{type:`string`,description:"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`)."}).option(`name`,{type:`string`,description:`The name of the device posture integration.`}).option(`type`,{type:`string`,description:`The type of device posture integration.`,choices:[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`config-api-url`,[`config-customer-id`,`config-client-id`,`config-client-secret`]).conflicts(`config-auth-url`,[`config-customer-id`,`config-client-key`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-auth-url`,[`config-api-url`,`config-client-id`,`config-client-secret`]).conflicts(`config-client-id`,[`config-client-key`,`config-customer-id`,`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-client-secret`,[`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-customer-id`,[`config-auth-url`,`config-client-id`,`config-api-url`,`config-access-client-id`,`config-access-client-secret`]).conflicts(`config-client-key`,[`config-auth-url`,`config-client-id`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-client-key`,[`config-api-url`,`config-customer-id`,`config-client-secret`]).conflicts(`config-access-client-id`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-id`,[`config-api-url`,`config-access-client-secret`]).conflicts(`config-access-client-secret`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-secret`,[`config-api-url`,`config-access-client-id`])}const zs={command:`create`,describe:`Create a new device posture integration.`,builder:Rs,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices posture integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/posture/integration`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({config:{api_url:f(e[`config-api-url`],`config-api-url`,`text`),auth_url:f(e[`config-auth-url`],`config-auth-url`,`text`),client_id:f(e[`config-client-id`],`config-client-id`,`text`),client_secret:f(e[`config-client-secret`],`config-client-secret`,`text`),customer_id:f(e[`config-customer-id`],`config-customer-id`,`text`),client_key:f(e[`config-client-key`],`config-client-key`,`text`),access_client_id:f(e[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:f(e[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:f(e.interval,`interval`,`text`),name:f(e.name,`name`,`text`),type:f(e.type,`type`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.devices.posture.integrations.create({...t,account_id:u})),{successLabel:`Created`});return}e.interval===void 0&&(e.interval=await h(`interval`,"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`).")),e.name===void 0&&(e.name=await h(`name`,`The name of the device posture integration.`)),e.type===void 0&&(e.type=await m(`type`,`The type of device posture integration.`,[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]));let p=d({config:{api_url:f(e[`config-api-url`],`config-api-url`,`text`),auth_url:f(e[`config-auth-url`],`config-auth-url`,`text`),client_id:f(e[`config-client-id`],`config-client-id`,`text`),client_secret:f(e[`config-client-secret`],`config-client-secret`,`text`),customer_id:f(e[`config-customer-id`],`config-customer-id`,`text`),client_key:f(e[`config-client-key`],`config-client-key`,`text`),access_client_id:f(e[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:f(e[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:f(e.interval,`interval`,`text`),name:f(e.name,`name`,`text`),type:f(e.type,`type`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.devices.posture.integrations.create({...p,account_id:u})),{successLabel:`Created`})}};function Bs(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Vs={command:`delete <integration-id>`,describe:`Delete a configured device posture integration.`,builder:Bs,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices posture integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/posture/integration/${e[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(e[`integration-id`]))}`,pathParams:{"integration-id":String(e[`integration-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.devices.posture.integrations.delete({account_id:l,integration_id:e[`integration-id`]})),{successLabel:`Deleted`})}};function Hs(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`config-api-url`,{type:`string`,description:`The Workspace One API URL provided in the Workspace One Admin Dashboard.`}).option(`config-auth-url`,{type:`string`,description:`The Workspace One Authorization URL depending on your region.`}).option(`config-client-id`,{type:`string`,description:`The Workspace One client ID provided in the Workspace One Admin Dashboard.`}).option(`config-client-secret`,{type:`string`,description:`The Workspace One client secret provided in the Workspace One Admin Dashboard.`}).option(`config-customer-id`,{type:`string`,description:`The Crowdstrike customer ID.`}).option(`config-client-key`,{type:`string`,description:`The Uptycs client secret.`}).option(`config-access-client-id`,{type:`string`,description:"If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`."}).option(`config-access-client-secret`,{type:`string`,description:"If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`."}).option(`interval`,{type:`string`,description:"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`)."}).option(`name`,{type:`string`,description:`The name of the device posture integration.`}).option(`type`,{type:`string`,description:`The type of device posture integration.`,choices:[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`config-api-url`,[`config-customer-id`,`config-client-id`,`config-client-secret`]).conflicts(`config-auth-url`,[`config-customer-id`,`config-client-key`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-auth-url`,[`config-api-url`,`config-client-id`,`config-client-secret`]).conflicts(`config-client-id`,[`config-client-key`,`config-customer-id`,`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-client-secret`,[`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-customer-id`,[`config-auth-url`,`config-client-id`,`config-api-url`,`config-access-client-id`,`config-access-client-secret`]).conflicts(`config-client-key`,[`config-auth-url`,`config-client-id`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-client-key`,[`config-api-url`,`config-customer-id`,`config-client-secret`]).conflicts(`config-access-client-id`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-id`,[`config-api-url`,`config-access-client-secret`]).conflicts(`config-access-client-secret`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-secret`,[`config-api-url`,`config-access-client-id`])}const Us={command:`edit <integration-id>`,describe:`Updates a configured device posture integration.`,builder:Hs,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices posture integrations edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/posture/integration/${e[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(e[`integration-id`]))}`,pathParams:{"integration-id":String(e[`integration-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({config:{api_url:f(e[`config-api-url`],`config-api-url`,`text`),auth_url:f(e[`config-auth-url`],`config-auth-url`,`text`),client_id:f(e[`config-client-id`],`config-client-id`,`text`),client_secret:f(e[`config-client-secret`],`config-client-secret`,`text`),customer_id:f(e[`config-customer-id`],`config-customer-id`,`text`),client_key:f(e[`config-client-key`],`config-client-key`,`text`),access_client_id:f(e[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:f(e[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:f(e.interval,`interval`,`text`),name:f(e.name,`name`,`text`),type:f(e.type,`type`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.devices.posture.integrations.edit({...t,account_id:u,integration_id:e[`integration-id`]})),{successLabel:`Updated`});return}let p=d({config:{api_url:f(e[`config-api-url`],`config-api-url`,`text`),auth_url:f(e[`config-auth-url`],`config-auth-url`,`text`),client_id:f(e[`config-client-id`],`config-client-id`,`text`),client_secret:f(e[`config-client-secret`],`config-client-secret`,`text`),customer_id:f(e[`config-customer-id`],`config-customer-id`,`text`),client_key:f(e[`config-client-key`],`config-client-key`,`text`),access_client_id:f(e[`config-access-client-id`],`config-access-client-id`,`text`),access_client_secret:f(e[`config-access-client-secret`],`config-access-client-secret`,`text`)},interval:f(e.interval,`interval`,`text`),name:f(e.name,`name`,`text`),type:f(e.type,`type`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.devices.posture.integrations.edit({...p,account_id:u,integration_id:e[`integration-id`]})),{successLabel:`Updated`})}};function Ws(e){return e.positional(`integration-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gs={command:`get <integration-id>`,describe:`Fetches details for a single device posture integration.`,builder:Ws,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices posture integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/posture/integration/${e[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(e[`integration-id`]))}`,pathParams:{"integration-id":String(e[`integration-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.posture.integrations.get({account_id:l,integration_id:e[`integration-id`]})),{successLabel:`Loaded`})}};function Ks(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qs={command:`list`,describe:`Fetches the list of device posture integrations for an account.`,builder:Ks,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices posture integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/posture/integration`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.posture.integrations.list({account_id:l})),{successLabel:`Loaded`})}},Js={command:`integrations`,describe:`Operations for devices.posture.integrations`,builder:e=>e.command(zs).command(Vs).command(Us).command(Gs).command(qs).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ys(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xs={command:`list`,describe:`Fetches device posture rules for a Zero Trust account.`,builder:Ys,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices posture list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/posture`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.posture.list({account_id:l})),{successLabel:`Loaded`})}};function Zs(e){return e.positional(`rule-id`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`The description of the device posture rule.`}).option(`expiration`,{type:`string`,description:`Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.`}).option(`input-exists`,{type:`boolean`,description:`Whether or not file exists.`}).option(`input-operating-system`,{type:`string`,description:`Operating system.`,choices:[`windows`,`linux`,`mac`,`android`,`ios`,`chromeos`]}).option(`input-path`,{type:`string`,description:`File path.`}).option(`input-sha256`,{type:`string`,description:`SHA-256.`}).option(`input-thumbprint`,{type:`string`,description:`Signing certificate thumbprint.`}).option(`input-id`,{type:`string`,description:`List ID.`}).option(`input-domain`,{type:`string`,description:`Domain.`}).option(`input-operator`,{type:`string`,description:`Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-os-distro-name`,{type:`string`,description:`Operating System Distribution Name (linux only).`}).option(`input-os-distro-revision`,{type:`string`,description:`Version of OS Distribution (linux only).`}).option(`input-os-version-extra`,{type:`string`,description:`Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.`}).option(`input-version`,{type:`string`,description:`Version of OS.`}).option(`input-enabled`,{type:`boolean`,description:`Enabled.`}).option(`input-check-disks`,{type:`string`,array:!0,description:`List of volume names to be checked for encryption.`}).option(`input-require-all`,{type:`boolean`,description:`Whether to check all disks for encryption.`}).option(`input-certificate-id`,{type:`string`,description:`UUID of Cloudflare managed certificate.`}).option(`input-cn`,{type:`string`,description:`Common Name that is protected by the certificate.`}).option(`input-check-private-key`,{type:`boolean`,description:`Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.`}).option(`input-extended-key-usage`,{type:`string`,array:!0,description:`List of values indicating purposes for which the certificate public key can be used.`}).option(`input-locations-paths`,{type:`string`,array:!0,description:`List of paths to check for client certificate on linux.`}).option(`input-locations-trust-stores`,{type:`string`,array:!0,description:`List of trust stores to check for client certificate.`}).option(`input-subject-alternative-names`,{type:`string`,array:!0,description:`List of certificate Subject Alternative Names.`}).option(`input-update-window-days`,{type:`number`,description:`Number of days that the antivirus should be updated within.`}).option(`input-compliance-status`,{type:`string`,description:`Compliance Status.`,choices:[`compliant`,`noncompliant`,`unknown`,`notapplicable`,`ingraceperiod`,`error`]}).option(`input-connection-id`,{type:`string`,description:`Posture Integration ID.`}).option(`input-last-seen`,{type:`string`,description:`For more details on last seen, please refer to the Crowdstrike documentation.`}).option(`input-os`,{type:`string`,description:`Os Version.`}).option(`input-overall`,{type:`string`,description:`Overall.`}).option(`input-sensor-config`,{type:`string`,description:`SensorConfig.`}).option(`input-state`,{type:`string`,description:`For more details on state, please refer to the Crowdstrike documentation.`,choices:[`online`,`offline`,`unknown`]}).option(`input-version-operator`,{type:`string`,description:`Version Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-auth-state`,{type:`string`,array:!0,description:`The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.`}).option(`input-count-operator`,{type:`string`,description:`Count Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-issue-count`,{type:`string`,description:`The Number of Issues.`}).option(`input-eid-last-seen`,{type:`string`,description:`For more details on eid last seen, refer to the Tanium documentation.`}).option(`input-risk-level`,{type:`string`,description:`For more details on risk level, refer to the Tanium documentation.`,choices:[`low`,`medium`,`high`,`critical`]}).option(`input-score-operator`,{type:`string`,description:`Score Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-total-score`,{type:`number`,description:`For more details on total score, refer to the Tanium documentation.`}).option(`input-active-threats`,{type:`number`,description:`The Number of active threats.`}).option(`input-infected`,{type:`boolean`,description:`Whether device is infected.`}).option(`input-is-active`,{type:`boolean`,description:`Whether device is active.`}).option(`input-network-status`,{type:`string`,description:`Network status of device.`,choices:[`connected`,`disconnected`,`disconnecting`,`connecting`]}).option(`input-operational-state`,{type:`string`,description:`Agent operational state.`,choices:[`na`,`partially_disabled`,`auto_fully_disabled`,`fully_disabled`,`auto_partially_disabled`,`disabled_error`,`db_corruption`]}).option(`input-score`,{type:`number`,description:`A value between 0-100 assigned to devices set by the 3rd party posture provider.`}).option(`name`,{type:`string`,description:`The name of the device posture rule.`}).option(`schedule`,{type:`string`,description:"Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`."}).option(`type`,{type:`string`,description:`The type of device posture rule.`,choices:[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`input-exists`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operating-system`,`input-id.input-check-disks.input-require-all.input-certificate-id.input-cn.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-operator.input-os.input-overall.input-sensor-config.input-state.input-version.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-path`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sha256`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-thumbprint`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-id`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-domain`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operator`,[`input-exists`,`input-path`,`input-sha256`,`input-thumbprint`,`input-operating-system`,`input-id`,`input-domain`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`,`input-compliance-status`,`input-connection-id`,`input-auth-state`,`input-count-operator`,`input-issue-count`]).conflicts(`input-os-distro-name`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-distro-revision`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-version-extra`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-version`,[`input-operating-system`,`input-operator`]).conflicts(`input-enabled`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-enabled`,[`input-operating-system`]).conflicts(`input-check-disks`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-require-all`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-certificate-id`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-cn`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-cn`,[`input-certificate-id`]).conflicts(`input-check-private-key`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-check-private-key`,[`input-certificate-id`,`input-operating-system`]).conflicts(`input-extended-key-usage`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-paths`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-trust-stores`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-subject-alternative-names`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-update-window-days`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-compliance-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-connection-id`,[`input-exists`,`input-operating-system`,`input-path`,`input-sha256`,`input-thumbprint`,`input-id`,`input-domain`,`input-operator`,`input-os-distro-name`,`input-os-distro-revision`,`input-os-version-extra`,`input-version`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`]).conflicts(`input-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-overall`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sensor-config`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-auth-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-count-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-issue-count`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-eid-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-risk-level`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-score-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-total-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-active-threats`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-infected`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-is-active`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-network-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-operational-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state`.split(`.`)).implies(`input-score`,[`input-connection-id`,`input-operator`])}const Qs={command:`update <rule-id>`,describe:`Updates a device posture rule.`,builder:Zs,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices posture update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/posture/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({description:f(e.description,`description`,`text`),expiration:f(e.expiration,`expiration`,`text`),input:{exists:e[`input-exists`],operating_system:f(e[`input-operating-system`],`input-operating-system`,`text`),path:f(e[`input-path`],`input-path`,`text`),sha256:f(e[`input-sha256`],`input-sha256`,`text`),thumbprint:f(e[`input-thumbprint`],`input-thumbprint`,`text`),id:f(e[`input-id`],`input-id`,`text`),domain:f(e[`input-domain`],`input-domain`,`text`),operator:f(e[`input-operator`],`input-operator`,`text`),os_distro_name:f(e[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:f(e[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:f(e[`input-os-version-extra`],`input-os-version-extra`,`text`),version:f(e[`input-version`],`input-version`,`text`),enabled:e[`input-enabled`],checkDisks:e[`input-check-disks`],requireAll:e[`input-require-all`],certificate_id:f(e[`input-certificate-id`],`input-certificate-id`,`text`),cn:f(e[`input-cn`],`input-cn`,`text`),check_private_key:e[`input-check-private-key`],extended_key_usage:e[`input-extended-key-usage`],locations:{paths:e[`input-locations-paths`],trust_stores:e[`input-locations-trust-stores`]},subject_alternative_names:e[`input-subject-alternative-names`],update_window_days:e[`input-update-window-days`],compliance_status:f(e[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:f(e[`input-connection-id`],`input-connection-id`,`text`),last_seen:f(e[`input-last-seen`],`input-last-seen`,`text`),os:f(e[`input-os`],`input-os`,`text`),overall:f(e[`input-overall`],`input-overall`,`text`),sensor_config:f(e[`input-sensor-config`],`input-sensor-config`,`text`),state:f(e[`input-state`],`input-state`,`text`),versionOperator:f(e[`input-version-operator`],`input-version-operator`,`text`),auth_state:e[`input-auth-state`],countOperator:f(e[`input-count-operator`],`input-count-operator`,`text`),issue_count:f(e[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:f(e[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:f(e[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:f(e[`input-score-operator`],`input-score-operator`,`text`),total_score:e[`input-total-score`],active_threats:e[`input-active-threats`],infected:e[`input-infected`],is_active:e[`input-is-active`],network_status:f(e[`input-network-status`],`input-network-status`,`text`),operational_state:f(e[`input-operational-state`],`input-operational-state`,`text`),score:e[`input-score`]},name:f(e.name,`name`,`text`),schedule:f(e.schedule,`schedule`,`text`),type:f(e.type,`type`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.devices.posture.update({...t,account_id:u,rule_id:e[`rule-id`]})),{successLabel:`Updated`});return}e.name===void 0&&(e.name=await h(`name`,`The name of the device posture rule.`)),e.type===void 0&&(e.type=await m(`type`,`The type of device posture rule.`,[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]));let p=d({description:f(e.description,`description`,`text`),expiration:f(e.expiration,`expiration`,`text`),input:{exists:e[`input-exists`],operating_system:f(e[`input-operating-system`],`input-operating-system`,`text`),path:f(e[`input-path`],`input-path`,`text`),sha256:f(e[`input-sha256`],`input-sha256`,`text`),thumbprint:f(e[`input-thumbprint`],`input-thumbprint`,`text`),id:f(e[`input-id`],`input-id`,`text`),domain:f(e[`input-domain`],`input-domain`,`text`),operator:f(e[`input-operator`],`input-operator`,`text`),os_distro_name:f(e[`input-os-distro-name`],`input-os-distro-name`,`text`),os_distro_revision:f(e[`input-os-distro-revision`],`input-os-distro-revision`,`text`),os_version_extra:f(e[`input-os-version-extra`],`input-os-version-extra`,`text`),version:f(e[`input-version`],`input-version`,`text`),enabled:e[`input-enabled`],checkDisks:e[`input-check-disks`],requireAll:e[`input-require-all`],certificate_id:f(e[`input-certificate-id`],`input-certificate-id`,`text`),cn:f(e[`input-cn`],`input-cn`,`text`),check_private_key:e[`input-check-private-key`],extended_key_usage:e[`input-extended-key-usage`],locations:{paths:e[`input-locations-paths`],trust_stores:e[`input-locations-trust-stores`]},subject_alternative_names:e[`input-subject-alternative-names`],update_window_days:e[`input-update-window-days`],compliance_status:f(e[`input-compliance-status`],`input-compliance-status`,`text`),connection_id:f(e[`input-connection-id`],`input-connection-id`,`text`),last_seen:f(e[`input-last-seen`],`input-last-seen`,`text`),os:f(e[`input-os`],`input-os`,`text`),overall:f(e[`input-overall`],`input-overall`,`text`),sensor_config:f(e[`input-sensor-config`],`input-sensor-config`,`text`),state:f(e[`input-state`],`input-state`,`text`),versionOperator:f(e[`input-version-operator`],`input-version-operator`,`text`),auth_state:e[`input-auth-state`],countOperator:f(e[`input-count-operator`],`input-count-operator`,`text`),issue_count:f(e[`input-issue-count`],`input-issue-count`,`text`),eid_last_seen:f(e[`input-eid-last-seen`],`input-eid-last-seen`,`text`),risk_level:f(e[`input-risk-level`],`input-risk-level`,`text`),scoreOperator:f(e[`input-score-operator`],`input-score-operator`,`text`),total_score:e[`input-total-score`],active_threats:e[`input-active-threats`],infected:e[`input-infected`],is_active:e[`input-is-active`],network_status:f(e[`input-network-status`],`input-network-status`,`text`),operational_state:f(e[`input-operational-state`],`input-operational-state`,`text`),score:e[`input-score`]},name:f(e.name,`name`,`text`),schedule:f(e.schedule,`schedule`,`text`),type:f(e.type,`type`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.devices.posture.update({...p,account_id:u,rule_id:e[`rule-id`]})),{successLabel:`Updated`})}},$s={command:`posture`,describe:`Operations for devices.posture`,builder:e=>e.command(Ns).command(Fs).command(Ls).command(Xs).command(Qs).command(Js).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ec(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const tc={command:`bulk-delete`,describe:`Deletes a list of WARP registrations.`,builder:ec,handler:async e=>{let r={id:e.id};if(e.dryRun){o({command:`cf zero-trust devices registrations bulk-delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/registrations`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();if(e.accountId=u,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>l.zeroTrust.devices.registrations.bulkDelete({account_id:u,...r})),{successLabel:`Deleted`})}};function nc(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const rc={command:`delete <registration-id>`,describe:`Deletes a WARP registration.`,builder:nc,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices registrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/registrations/${e[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(e[`registration-id`]))}`,pathParams:{"registration-id":String(e[`registration-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.devices.registrations.delete({account_id:l,registration_id:e[`registration-id`]})),{successLabel:`Deleted`})}};function ic(e){return e.positional(`registration-id`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the registration response. Supported values are: "policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ac={command:`get <registration-id>`,describe:`Fetches a single WARP registration.`,builder:ic,handler:async e=>{let r={include:e.include};if(e.dryRun){o({command:`cf zero-trust devices registrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/registrations/${e[`registration-id`]==null?`<registration-id>`:encodeURIComponent(String(e[`registration-id`]))}`,pathParams:{"registration-id":String(e[`registration-id`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.devices.registrations.get({account_id:u,registration_id:e[`registration-id`],...r})),{successLabel:`Loaded`})}};function oc(e){return e.option(`user-id`,{type:`string`,description:`Filter by user ID.`}).option(`seen-after`,{type:`string`,description:`Filter by the last_seen timestamp - returns only registrations last seen after this timestamp.`}).option(`seen-before`,{type:`string`,description:`Filter by the last_seen timestamp - returns only registrations last seen before this timestamp.`}).option(`status`,{type:`string`,description:`Filter by registration status. Defaults to 'active'.`,choices:[`active`,`all`,`revoked`]}).option(`per-page`,{type:`number`,description:`The maximum number of devices to return in a single response.`}).option(`search`,{type:`string`,description:`Filter by registration details.`}).option(`sort-by`,{type:`string`,description:`The registration field to order results by.`,choices:[`id`,`user.name`,`user.email`,`last_seen_at`,`created_at`]}).option(`sort-order`,{type:`string`,description:`Sort direction.`,choices:[`asc`,`desc`]}).option(`cursor`,{type:`string`,description:`Opaque token indicating the starting position when requesting the next set of records. A cursor value can be obtained from the result_info.cursor field in the response.`}).option(`id`,{type:`string`,description:`Filter by registration ID.`}).option(`device-id`,{type:`string`,description:`Filter by WARP device ID.`}).option(`policy-id`,{type:`string`,description:`Filter by the ID of the device settings profile assigned to the registration.`}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the registration response. Supported values are: "policy".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sc={command:`list`,describe:`Lists WARP registrations.`,builder:_(oc),handler:async e=>{let r={"user.id":e[`user-id`],seen_after:e[`seen-after`],seen_before:e[`seen-before`],status:e.status,per_page:e[`per-page`],search:e.search,sort_by:e[`sort-by`],sort_order:e[`sort-order`],cursor:e.cursor,id:e.id,"device.id":e[`device-id`],"policy.id":e[`policy-id`],include:e.include};if(e.dryRun){o({command:`cf zero-trust devices registrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/registrations`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.devices.registrations.list({account_id:u,...r})),{successLabel:`Loaded`})}};function cc(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to revoke.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const lc={command:`revoke`,describe:`Revokes a list of WARP registrations.`,builder:cc,handler:async e=>{let r={id:e.id};if(e.dryRun){o({command:`cf zero-trust devices registrations revoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/registrations/revoke`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();if(e.accountId=u,!await g({force:!!e.force,message:`This operation revokes device registrations destructively.`})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>l.zeroTrust.devices.registrations.revoke({account_id:u,...r})),{successLabel:`Deleted`})}};function uc(e){return e.option(`id`,{type:`string`,description:`A list of registration IDs to unrevoke.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dc={command:`unrevoke`,describe:`Unrevokes a list of WARP registrations.`,builder:uc,handler:async e=>{let r={id:e.id};if(e.dryRun){o({command:`cf zero-trust devices registrations unrevoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/registrations/unrevoke`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Creating`,async()=>l.zeroTrust.devices.registrations.unrevoke({account_id:u,...r})),{successLabel:`Created`})}},fc={command:`registrations`,describe:`Operations for devices.registrations`,builder:e=>e.command(tc).command(rc).command(ac).command(sc).command(lc).command(dc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pc(e){return e.option(`disconnect`,{type:`boolean`,description:`Disconnects all devices on the account using Global WARP override.`}).option(`justification`,{type:`string`,description:`Reasoning for setting the Global WARP override state. This will be surfaced in the audit log.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const mc={command:`create`,describe:`Sets the Global WARP override state.`,builder:pc,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices resilience global-warp-override create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/resilience/disconnect`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({disconnect:e.disconnect,justification:f(e.justification,`justification`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.devices.resilience.globalWarpOverride.create({...t,account_id:u})),{successLabel:`Created`});return}if(e.disconnect===void 0)throw Error(`--disconnect is required (or pass --body with this field set).`);let p=d({disconnect:e.disconnect,justification:f(e.justification,`justification`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.devices.resilience.globalWarpOverride.create({...p,account_id:u})),{successLabel:`Created`})}};function hc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gc={command:`get`,describe:`Fetch the Global WARP override state.`,builder:hc,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices resilience global-warp-override get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/resilience/disconnect`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.resilience.globalWarpOverride.get({account_id:l})),{successLabel:`Loaded`})}},_c={command:`global-warp-override`,describe:`Operations for devices.resilience.global-warp-override`,builder:e=>e.command(mc).command(gc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},vc={command:`resilience`,describe:`Operations for devices.resilience`,builder:e=>e.command(_c).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function yc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`A list of Registration IDs to revoke.`})}const bc={command:`create`,describe:`Revokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/revoke instead.`,builder:yc,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices revoke create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/revoke`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,!await g({force:!!e.force,message:`This operation revokes sessions for a batch of devices destructively.`})){process.stderr.write(`Aborted.
+`);return}if(e.body){let t=l(e.body);a(await s(`Deleting`,async()=>r.zeroTrust.devices.revoke.create({body:t,account_id:u})),{successLabel:`Deleted`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},xc={command:`revoke`,describe:`Operations for devices.revoke`,builder:e=>e.command(bc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Sc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Cc={command:`delete`,describe:`Resets the current device settings for a Zero Trust account.`,builder:Sc,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices settings delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.devices.settings.delete({account_id:l})),{successLabel:`Deleted`})}};function wc(e){return e.option(`disable-for-time`,{type:`number`,description:`Sets the time limit, in seconds, that a user can use an override code to bypass WARP.`}).option(`external-emergency-signal-enabled`,{type:`boolean`,description:`Controls whether the external emergency disconnect feature is enabled.`}).option(`external-emergency-signal-fingerprint`,{type:`string`,description:`The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.`}).option(`external-emergency-signal-interval`,{type:`string`,description:`The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.`}).option(`external-emergency-signal-url`,{type:`string`,description:`The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.`}).option(`gateway-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on TCP.`}).option(`gateway-udp-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on UDP.`}).option(`root-certificate-installation-enabled`,{type:`boolean`,description:`Enable installation of cloudflare managed root certificate.`}).option(`use-zt-virtual-ip`,{type:`boolean`,description:`Enable using CGNAT virtual IPv4.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Tc={command:`edit`,describe:`Patches the current device settings for a Zero Trust account.`,builder:wc,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({disable_for_time:e[`disable-for-time`],external_emergency_signal_enabled:e[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:f(e[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:f(e[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:f(e[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:e[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:e[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:e[`root-certificate-installation-enabled`],use_zt_virtual_ip:e[`use-zt-virtual-ip`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.devices.settings.edit({body:t,account_id:u})),{successLabel:`Updated`});return}let p=d({disable_for_time:e[`disable-for-time`],external_emergency_signal_enabled:e[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:f(e[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:f(e[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:f(e[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:e[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:e[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:e[`root-certificate-installation-enabled`],use_zt_virtual_ip:e[`use-zt-virtual-ip`]});a(await s(`Updating`,async()=>r.zeroTrust.devices.settings.edit({body:p,account_id:u})),{successLabel:`Updated`})}};function Ec(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Dc={command:`get`,describe:`Describes the current device settings for a Zero Trust account.`,builder:Ec,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.devices.settings.get({account_id:l})),{successLabel:`Loaded`})}};function Oc(e){return e.option(`disable-for-time`,{type:`number`,description:`Sets the time limit, in seconds, that a user can use an override code to bypass WARP.`}).option(`external-emergency-signal-enabled`,{type:`boolean`,description:`Controls whether the external emergency disconnect feature is enabled.`}).option(`external-emergency-signal-fingerprint`,{type:`string`,description:`The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.`}).option(`external-emergency-signal-interval`,{type:`string`,description:`The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.`}).option(`external-emergency-signal-url`,{type:`string`,description:`The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.`}).option(`gateway-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on TCP.`}).option(`gateway-udp-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on UDP.`}).option(`root-certificate-installation-enabled`,{type:`boolean`,description:`Enable installation of cloudflare managed root certificate.`}).option(`use-zt-virtual-ip`,{type:`boolean`,description:`Enable using CGNAT virtual IPv4.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const kc={command:`update`,describe:`Updates the current device settings for a Zero Trust account.`,builder:Oc,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({disable_for_time:e[`disable-for-time`],external_emergency_signal_enabled:e[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:f(e[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:f(e[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:f(e[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:e[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:e[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:e[`root-certificate-installation-enabled`],use_zt_virtual_ip:e[`use-zt-virtual-ip`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.devices.settings.update({body:t,account_id:u})),{successLabel:`Updated`});return}let p=d({disable_for_time:e[`disable-for-time`],external_emergency_signal_enabled:e[`external-emergency-signal-enabled`],external_emergency_signal_fingerprint:f(e[`external-emergency-signal-fingerprint`],`external-emergency-signal-fingerprint`,`text`),external_emergency_signal_interval:f(e[`external-emergency-signal-interval`],`external-emergency-signal-interval`,`text`),external_emergency_signal_url:f(e[`external-emergency-signal-url`],`external-emergency-signal-url`,`text`),gateway_proxy_enabled:e[`gateway-proxy-enabled`],gateway_udp_proxy_enabled:e[`gateway-udp-proxy-enabled`],root_certificate_installation_enabled:e[`root-certificate-installation-enabled`],use_zt_virtual_ip:e[`use-zt-virtual-ip`]});a(await s(`Updating`,async()=>r.zeroTrust.devices.settings.update({body:p,account_id:u})),{successLabel:`Updated`})}},Ac={command:`settings`,describe:`Operations for devices.settings`,builder:e=>e.command(Cc).command(Tc).command(Dc).command(kc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function jc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A list of Registration IDs to unrevoke.`})}const Mc={command:`create`,describe:`Unrevokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/unrevoke instead.`,builder:jc,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust devices unrevoke create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/devices/unrevoke`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.devices.unrevoke.create({body:t,account_id:u})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Nc={command:`unrevoke`,describe:`Operations for devices.unrevoke`,builder:e=>e.command(Mc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Pc={command:`devices`,describe:`Operations for devices`,builder:e=>e.command(Ja).command(so).command(Pa).command(Ka).command(ao).command(yo).command(wo).command(No).command(js).command($s).command(fc).command(vc).command(xc).command(Ac).command(Nc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Fc(e){return e.option(`from`,{type:`string`,description:`Start time for connection period in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for connection period in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`sort-by`,{type:`string`,description:`Type of usage that colos should be sorted by. If unspecified, returns all Cloudflare colos sorted alphabetically.`,choices:[`fleet-status-usage`,`application-tests-usage`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ic={command:`list`,describe:`List Cloudflare colos that account's devices were connected to during a time period, sorted by usage starting from the most used colo. Colos without traffic are also returned and sorted alphabetically.`,builder:_(Fc),handler:async e=>{let r={from:e.from,to:e.to,sortBy:e[`sort-by`]};if(e.dryRun){o({command:`cf zero-trust dex colos list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/colos`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.colos.list({account_id:u,...r})),{successLabel:`Loaded`})}},Lc={command:`colos`,describe:`Operations for dex.colos`,builder:e=>e.command(Ic).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Rc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const zc={command:`create`,describe:`Initiate commands for up to 10 devices per account.`,builder:Rc,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dex commands create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/commands`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let u=await i(e),d=e.local?c:await n();if(e.accountId=d,e.body){let t=l(e.body);a(await s(`Creating`,async()=>u.zeroTrust.dex.commands.create({...t,account_id:d})),{successLabel:`Created`});return}a(await s(`Creating`,async()=>r(u,`POST`,`/accounts/${d}/dex/commands`)),{successLabel:`Created`})}};function Bc(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`search`,{type:`string`,description:`Filter devices by name or email.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vc={command:`list`,describe:`List devices with WARP client support for remote captures which have been connected in the last 1 hour.`,builder:Bc,handler:async e=>{let r={page:e.page,per_page:e[`per-page`],search:e.search};if(e.dryRun){o({command:`cf zero-trust dex commands eligible-devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/commands/devices`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.commands.eligibleDevices.list({account_id:u,...r})),{successLabel:`Loaded`})}},Hc={command:`eligible-devices`,describe:`Operations for dex.commands.eligible-devices`,builder:e=>e.command(Vc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Uc(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`}).option(`device-id`,{type:`string`,description:`Unique identifier for a device.`}).option(`user-email`,{type:`string`,description:`Email tied to the device.`}).option(`command-type`,{type:`string`,description:`Optionally filter executed commands by command type.`,choices:[`pcap`,`speed-test`,`warp-diag`]}).option(`status`,{type:`string`,description:`Optionally filter executed commands by status.`,choices:[`PENDING_EXEC`,`PENDING_UPLOAD`,`SUCCESS`,`FAILED`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Wc={command:`list`,describe:`Retrieves a paginated list of commands issued to devices under the specified account, optionally filtered by time range, device, or other parameters`,builder:_(Uc),handler:async e=>{let r={page:e.page,per_page:e[`per-page`],from:e.from,to:e.to,device_id:e[`device-id`],user_email:e[`user-email`],command_type:e[`command-type`],status:e.status};if(e.dryRun){o({command:`cf zero-trust dex commands list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/commands`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.commands.list({account_id:u,...r})),{successLabel:`Loaded`})}};function Gc(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kc={command:`get`,describe:`Retrieves the current quota usage and limits for device commands within a specific account, including the time when the quota will reset`,builder:Gc,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dex commands quota get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/commands/quota`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.dex.commands.quota.get({account_id:l})),{successLabel:`Loaded`})}},qc={command:`quota`,describe:`Operations for dex.commands.quota`,builder:e=>e.command(Kc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Jc(e){return e.positional(`filename`,{type:`string`,description:"The name of the file to be downloaded, including the `.zip` extension.",demandOption:!0}).option(`command-id`,{type:`string`,description:`Unique identifier for command.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`text`,{type:`boolean`,description:`Decode the response body as UTF-8 text instead of writing raw bytes`,default:!1})}const Yc={command:`get <filename>`,describe:`Downloads artifacts for an executed command. Bulk downloads are not supported`,builder:Jc,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dex commands results get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/commands/${e[`command-id`]==null?`<command-id>`:encodeURIComponent(String(e[`command-id`]))}/downloads/${e.filename==null?`<filename>`:encodeURIComponent(String(e.filename))}`,pathParams:{"command-id":String(e[`command-id`]??``),filename:String(e.filename??``)},bodyKind:`none`});return}await i(e);let r=e.local?c:await n();e.accountId=r;let a=await s(`Loading`,async()=>ee(`/accounts/${r}/dex/commands/${encodeURIComponent(String(e[`command-id`]))}/downloads/${encodeURIComponent(String(e.filename))}`,{method:`GET`,localEndpoint:e.local?e.localEndpoint:void 0}));v(e.text===!0?a.toString(`utf-8`):a)}},Xc={command:`results`,describe:`Operations for dex.commands.results`,builder:e=>e.command(Yc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Zc={command:`commands`,describe:`Operations for dex.commands`,builder:e=>e.command(zc).command(Wc).command(Hc).command(qc).command(Xc).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qc(e){return e.option(`since-minutes`,{type:`number`,description:`Number of minutes before current time.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $c={command:`get`,describe:`Get details for live (up to 60 minutes) devices using WARP.`,builder:Qc,handler:async e=>{let r={since_minutes:e[`since-minutes`]};if(e.dryRun){o({command:`cf zero-trust dex devices aggregates live get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/fleet-status/live`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.devices.aggregates.live.get({account_id:u,...r})),{successLabel:`Loaded`})}},el={command:`live`,describe:`Operations for dex.devices.aggregates.live`,builder:e=>e.command($c).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function tl(e){return e.option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Cloudflare colo airport code.`}).option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const nl={command:`get`,describe:`Get aggregate details for devices using WARP, up to 7 days.`,builder:tl,handler:async e=>{let r={to:e.to,from:e.from,colo:e.colo,device_id:e[`device-id`]};if(e.dryRun){o({command:`cf zero-trust dex devices aggregates over-time get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/fleet-status/over-time`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.devices.aggregates.overTime.get({account_id:u,...r})),{successLabel:`Loaded`})}},rl={command:`over-time`,describe:`Operations for dex.devices.aggregates.over-time`,builder:e=>e.command(nl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},il={command:`aggregates`,describe:`Operations for dex.devices.aggregates`,builder:e=>e.command(el).command(rl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function al(e){return e.positional(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`since-minutes`,{type:`number`,description:`Number of minutes before current time.`,demandOption:!0}).option(`time-now`,{type:`string`,description:`Current time in ISO format.`}).option(`colo`,{type:`string`,description:`List of data centers to filter results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ol={command:`get <device-id>`,describe:`Get the latest status of a device given device_id from the device_state table.`,builder:al,handler:async e=>{let r={since_minutes:e[`since-minutes`],time_now:e[`time-now`],colo:e.colo};if(e.dryRun){o({command:`cf zero-trust dex devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}/fleet-status/live`,pathParams:{"device-id":String(e[`device-id`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.devices.get({account_id:u,device_id:e[`device-id`],...r})),{successLabel:`Loaded`})}};function sl(e){return e.option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`sort-by`,{type:`string`,description:`Dimension to sort results by.`,choices:[`colo`,`device_id`,`mode`,`platform`,`status`,`timestamp`,`version`]}).option(`colo`,{type:`string`,description:`Cloudflare colo airport code.`}).option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`}).option(`mode`,{type:`string`,description:`The mode under which the WARP client is run.`}).option(`status`,{type:`string`,description:`Network status.`}).option(`platform`,{type:`string`,description:`Operating system.`}).option(`version`,{type:`string`,description:`WARP client version.`}).option(`source`,{type:`string`,description:"Source:\n  * `hourly` - device details aggregated hourly, up to 7 days prior\n  * `last_seen` - device details, up to 60 minutes prior. Time windows exceeding 60 minutes will be rejected from June 1st, 2026. Please use 'hourly' or 'raw' instead for longer time ranges.\n  * `raw` - device details, up to 7 days prior",choices:[`last_seen`,`hourly`,`raw`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const cl={command:`list`,describe:`List details of devices using WARP.`,builder:_(sl),handler:async e=>{let r={to:e.to,from:e.from,page:e.page,per_page:e[`per-page`],sort_by:e[`sort-by`],colo:e.colo,device_id:e[`device-id`],mode:e.mode,status:e.status,platform:e.platform,version:e.version,source:e.source};if(e.dryRun){o({command:`cf zero-trust dex devices list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/fleet-status/devices`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.devices.list({account_id:u,...r})),{successLabel:`Loaded`})}};function ll(e){return e.positional(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`to`,{type:`string`,description:`End of the time range to query. Timestamp can be provided in ISO 8601 datetime format or milliseconds since epoch.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`List of data centers to filter results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ul={command:`get <device-id>`,describe:`Get time-bucketed status metrics for a specific device.`,builder:_(ll),handler:async e=>{let r={from:e.from,to:e.to,interval:e.interval,colo:e.colo};if(e.dryRun){o({command:`cf zero-trust dex devices over-time get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}/fleet-status/over-time`,pathParams:{"device-id":String(e[`device-id`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.devices.overTime.get({account_id:u,device_id:e[`device-id`],...r})),{successLabel:`Loaded`})}},dl={command:`over-time`,describe:`Operations for dex.devices.over-time`,builder:e=>e.command(ul).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},fl={command:`devices`,describe:`Operations for dex.devices`,builder:e=>e.command(ol).command(cl).command(il).command(dl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pl(e){return e.option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of paginated results. Mutually exclusive with cursor.`}).option(`per-page`,{type:`number`,description:`Number of items per page`,demandOption:!0}).option(`cursor`,{type:`string`,description:`Cursor for cursor-based pagination. Mutually exclusive with page.`}).option(`sort-by`,{type:`string`,description:`The field to sort results by.`,choices:[`time_start`]}).option(`sort-order`,{type:`string`,description:`The order to sort results.`,choices:[`ASC`,`DESC`]}).option(`from`,{type:`string`,description:`Start time for the query in ISO 8601 format.`}).option(`to`,{type:`string`,description:`End time for the query in ISO 8601 format.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ml={command:`list`,describe:`List ISP information observed for a specific device during traceroute tests.`,builder:_(pl),handler:async e=>{let r={page:e.page,per_page:e[`per-page`],cursor:e.cursor,sort_by:e[`sort-by`],sort_order:e[`sort-order`],from:e.from,to:e.to};if(e.dryRun){o({command:`cf zero-trust dex isps list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/devices/${e[`device-id`]==null?`<device-id>`:encodeURIComponent(String(e[`device-id`]))}/isps`,pathParams:{"device-id":String(e[`device-id`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.isps.list({account_id:u,device_id:e[`device-id`],...r})),{successLabel:`Loaded`})}},hl={command:`isps`,describe:`Operations for dex.isps`,builder:e=>e.command(ml).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function gl(e){return e.option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`test-name`,{type:`string`,description:`Optionally filter results by test name.`}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`registration-id`,{type:`string`,description:`Optionally filter results to a specific device registration. Must be used in combination with a single deviceId.`}).option(`page`,{type:`number`,description:`Page number of paginated results`}).option(`per-page`,{type:`number`,description:`Number of items per page`}).option(`kind`,{type:`string`,description:`Filter by test type.`,choices:[`http`,`traceroute`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _l={command:`list`,describe:`List DEX tests with overview metrics.`,builder:_(gl),handler:async e=>{let r={colo:e.colo,testName:e[`test-name`],deviceId:e[`device-id`],registration_id:e[`registration-id`],page:e.page,per_page:e[`per-page`],kind:e.kind};if(e.dryRun){o({command:`cf zero-trust dex overview tests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/tests/overview`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.overview.tests.list({account_id:u,...r})),{successLabel:`Loaded`})}};function vl(e){return e.option(`test-name`,{type:`string`,description:`Optionally filter results by test name.`}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yl={command:`get`,describe:`Returns unique count of devices that have run synthetic application monitoring tests in the past 7 days.`,builder:vl,handler:async e=>{let r={testName:e[`test-name`],deviceId:e[`device-id`]};if(e.dryRun){o({command:`cf zero-trust dex overview tests unique-devices get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/tests/unique-devices`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.overview.tests.uniqueDevices.get({account_id:u,...r})),{successLabel:`Loaded`})}},bl={command:`unique-devices`,describe:`Operations for dex.overview.tests.unique-devices`,builder:e=>e.command(yl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},xl={command:`tests`,describe:`Operations for dex.overview.tests`,builder:e=>e.command(_l).command(bl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Sl={command:`overview`,describe:`Operations for dex.overview`,builder:e=>e.command(xl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Cl(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`match`,{type:`string`,description:`The wirefilter expression to match.`}).option(`name`,{type:`string`,description:`The name of the Rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const wl={command:`create`,describe:`Create a DEX Rule.`,builder:Cl,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dex rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/rules`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({description:f(e.description,`description`,`text`),match:f(e.match,`match`,`text`),name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.dex.rules.create({...t,account_id:u})),{successLabel:`Created`});return}e.match===void 0&&(e.match=await h(`match`,`The wirefilter expression to match.`)),e.name===void 0&&(e.name=await h(`name`,`The name of the Rule.`));let p=d({description:f(e.description,`description`,`text`),match:f(e.match,`match`,`text`),name:f(e.name,`name`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.dex.rules.create({...p,account_id:u})),{successLabel:`Created`})}};function Tl(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const El={command:`delete <rule-id>`,describe:`Delete a DEX Rule.`,builder:Tl,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dex rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.dex.rules.delete({account_id:l,rule_id:e[`rule-id`]})),{successLabel:`Deleted`})}};function Dl(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ol={command:`get <rule-id>`,describe:`Get details for a DEX Rule.`,builder:Dl,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dex rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.dex.rules.get({account_id:l,rule_id:e[`rule-id`]})),{successLabel:`Loaded`})}};function kl(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`sort-order`,{type:`string`,description:`Sort direction for sort_by property.`,choices:[`ASC`,`DESC`]}).option(`sort-by`,{type:`string`,description:`Which property to sort results by.`,choices:[`name`,`created_at`,`updated_at`]}).option(`name`,{type:`string`,description:`Filter results by rule name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Al={command:`list`,describe:`List DEX Rules.`,builder:_(kl),handler:async e=>{let r={page:e.page,per_page:e[`per-page`],sort_order:e[`sort-order`],sort_by:e[`sort-by`],name:e.name};if(e.dryRun){o({command:`cf zero-trust dex rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/rules`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.rules.list({account_id:u,...r})),{successLabel:`Loaded`})}};function jl(e){return e.positional(`rule-id`,{type:`string`,description:`Unique identifier of the rule.`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`match`,{type:`string`,description:`The wirefilter expression to match.`}).option(`name`,{type:`string`,description:`The name of the Rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ml={command:`update <rule-id>`,describe:`Update a DEX Rule.`,builder:jl,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dex rules update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({description:f(e.description,`description`,`text`),match:f(e.match,`match`,`text`),name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.dex.rules.update({...t,account_id:u,rule_id:e[`rule-id`]})),{successLabel:`Updated`});return}let p=d({description:f(e.description,`description`,`text`),match:f(e.match,`match`,`text`),name:f(e.name,`name`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.dex.rules.update({...p,account_id:u,rule_id:e[`rule-id`]})),{successLabel:`Updated`})}},Nl={command:`rules`,describe:`Operations for dex.rules`,builder:e=>e.command(wl).command(El).command(Ol).command(Al).command(Ml).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Pl(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fl={command:`get <test-id>`,describe:`Get test details and aggregate performance metrics for an http test for a given time period between 1 hour and 7 days.`,builder:_(Pl),handler:async e=>{let r={deviceId:e[`device-id`],from:e.from,to:e.to,interval:e.interval,colo:e.colo};if(e.dryRun){o({command:`cf zero-trust dex test-results http get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/http-tests/${e[`test-id`]==null?`<test-id>`:encodeURIComponent(String(e[`test-id`]))}`,pathParams:{"test-id":String(e[`test-id`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.testResults.http.get({account_id:u,test_id:e[`test-id`],...r})),{successLabel:`Loaded`})}};function Il(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ll={command:`get <test-id>`,describe:`Get percentiles for an http test for a given time period between 1 hour and 7 days.`,builder:Il,handler:async e=>{let r={deviceId:e[`device-id`],from:e.from,to:e.to,colo:e.colo};if(e.dryRun){o({command:`cf zero-trust dex test-results http percentiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/http-tests/${e[`test-id`]==null?`<test-id>`:encodeURIComponent(String(e[`test-id`]))}/percentiles`,pathParams:{"test-id":String(e[`test-id`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.testResults.http.percentiles.get({account_id:u,test_id:e[`test-id`],...r})),{successLabel:`Loaded`})}},Rl={command:`percentiles`,describe:`Operations for dex.test-results.http.percentiles`,builder:e=>e.command(Ll).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},zl={command:`http`,describe:`Operations for dex.test-results.http`,builder:e=>e.command(Fl).command(Rl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bl(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vl={command:`get <test-id>`,describe:`Get test details and aggregate performance metrics for a traceroute test for a given time period between 1 hour and 7 days.`,builder:_(Bl),handler:async e=>{let r={deviceId:e[`device-id`],from:e.from,to:e.to,interval:e.interval,colo:e.colo};if(e.dryRun){o({command:`cf zero-trust dex test-results traceroute get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/traceroute-tests/${e[`test-id`]==null?`<test-id>`:encodeURIComponent(String(e[`test-id`]))}`,pathParams:{"test-id":String(e[`test-id`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.testResults.traceroute.get({account_id:u,test_id:e[`test-id`],...r})),{successLabel:`Loaded`})}};function Hl(e){return e.positional(`test-result-id`,{type:`string`,description:`Unique identifier for a specific traceroute test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ul={command:`get <test-result-id>`,describe:`Get a breakdown of hops and performance metrics for a specific traceroute test run`,builder:Hl,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dex test-results traceroute network-path get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/traceroute-test-results/${e[`test-result-id`]==null?`<test-result-id>`:encodeURIComponent(String(e[`test-result-id`]))}/network-path`,pathParams:{"test-result-id":String(e[`test-result-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.dex.testResults.traceroute.networkPath.get({account_id:l,test_result_id:e[`test-result-id`]})),{successLabel:`Loaded`})}},Wl={command:`network-path`,describe:`Operations for dex.test-results.traceroute.network-path`,builder:e=>e.command(Ul).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Gl(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kl={command:`get <test-id>`,describe:`Get percentiles for a traceroute test for a given time period between 1 hour and 7 days.`,builder:Gl,handler:async e=>{let r={deviceId:e[`device-id`],from:e.from,to:e.to,colo:e.colo};if(e.dryRun){o({command:`cf zero-trust dex test-results traceroute percentiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/traceroute-tests/${e[`test-id`]==null?`<test-id>`:encodeURIComponent(String(e[`test-id`]))}/percentiles`,pathParams:{"test-id":String(e[`test-id`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.testResults.traceroute.percentiles.get({account_id:u,test_id:e[`test-id`],...r})),{successLabel:`Loaded`})}},ql={command:`percentiles`,describe:`Operations for dex.test-results.traceroute.percentiles`,builder:e=>e.command(Kl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Jl={command:`traceroute`,describe:`Operations for dex.test-results.traceroute`,builder:e=>e.command(Vl).command(Wl).command(ql).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Yl={command:`test-results`,describe:`Operations for dex.test-results`,builder:e=>e.command(zl).command(Jl).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Xl(e){return e.option(`data-host`,{type:`string`,description:`The desired endpoint to test.`}).option(`data-kind`,{type:`string`,description:`The type of test.`,choices:[`http`,`traceroute`]}).option(`data-method`,{type:`string`,description:`The HTTP request method type.`,choices:[`GET`]}).option(`description`,{type:`string`,description:`Additional details about the test.`}).option(`enabled`,{type:`boolean`,description:`Determines whether or not the test is active.`}).option(`interval`,{type:`string`,description:`How often the test will run.`}).option(`name`,{type:`string`,description:`The name of the DEX test. Must be unique.`}).option(`targeted`,{type:`boolean`,description:`The targeted field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Zl={command:`create`,describe:`Create a DEX test.`,builder:Xl,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dex tests create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/devices/dex_tests`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({data:{host:f(e[`data-host`],`data-host`,`text`),kind:f(e[`data-kind`],`data-kind`,`text`),method:f(e[`data-method`],`data-method`,`text`)},description:f(e.description,`description`,`text`),enabled:e.enabled,interval:f(e.interval,`interval`,`text`),name:f(e.name,`name`,`text`),targeted:e.targeted}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.dex.tests.create({body:t,account_id:u})),{successLabel:`Created`});return}if(e[`data-host`]===void 0&&(e[`data-host`]=await h(`data-host`,`The desired endpoint to test.`)),e[`data-kind`]===void 0&&(e[`data-kind`]=await m(`data-kind`,`The type of test.`,[`http`,`traceroute`])),e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);e.interval===void 0&&(e.interval=await h(`interval`,`How often the test will run.`)),e.name===void 0&&(e.name=await h(`name`,`The name of the DEX test. Must be unique.`));let p=d({data:{host:f(e[`data-host`],`data-host`,`text`),kind:f(e[`data-kind`],`data-kind`,`text`),method:f(e[`data-method`],`data-method`,`text`)},description:f(e.description,`description`,`text`),enabled:e.enabled,interval:f(e.interval,`interval`,`text`),name:f(e.name,`name`,`text`),targeted:e.targeted});a(await s(`Creating`,async()=>r.zeroTrust.dex.tests.create({body:p,account_id:u})),{successLabel:`Created`})}};function Ql(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const $l={command:`delete <dex-test-id>`,describe:`Delete a Device DEX test. Returns the remaining device dex tests for the account.`,builder:Ql,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dex tests delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/devices/dex_tests/${e[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(e[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(e[`dex-test-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.dex.tests.delete({account_id:l,dex_test_id:e[`dex-test-id`]})),{successLabel:`Deleted`})}};function eu(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const tu={command:`get <dex-test-id>`,describe:`Fetch a single DEX test.`,builder:eu,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dex tests get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/devices/dex_tests/${e[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(e[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(e[`dex-test-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.dex.tests.get({account_id:l,dex_test_id:e[`dex-test-id`]})),{successLabel:`Loaded`})}};function nu(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`test-name`,{type:`string`,description:`Filter by test name.`}).option(`kind`,{type:`string`,description:`Filter by test type.`,choices:[`http`,`traceroute`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ru={command:`list`,describe:`Fetch all DEX tests.`,builder:_(nu),handler:async e=>{let r={page:e.page,per_page:e[`per-page`],testName:e[`test-name`],kind:e.kind};if(e.dryRun){o({command:`cf zero-trust dex tests list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/devices/dex_tests`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.tests.list({account_id:u,...r})),{successLabel:`Loaded`})}};function iu(e){return e.positional(`test-id`,{type:`string`,description:`Unique identifier for a specific test.`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Device to filter traceroute result runs to.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms.`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const au={command:`get <test-id>`,describe:`Get a breakdown of metrics by hop for individual traceroute test runs.`,builder:_(iu),handler:async e=>{let r={deviceId:e[`device-id`],from:e.from,to:e.to,interval:e.interval};if(e.dryRun){o({command:`cf zero-trust dex tests network-path get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/traceroute-tests/${e[`test-id`]==null?`<test-id>`:encodeURIComponent(String(e[`test-id`]))}/network-path`,pathParams:{"test-id":String(e[`test-id`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.tests.networkPath.get({account_id:u,test_id:e[`test-id`],...r})),{successLabel:`Loaded`})}},ou={command:`network-path`,describe:`Operations for dex.tests.network-path`,builder:e=>e.command(au).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function su(e){return e.positional(`dex-test-id`,{type:`string`,description:`Unique identifier for a DEX test.`,demandOption:!0}).option(`data-host`,{type:`string`,description:`The desired endpoint to test.`}).option(`data-kind`,{type:`string`,description:`The type of test.`,choices:[`http`,`traceroute`]}).option(`data-method`,{type:`string`,description:`The HTTP request method type.`,choices:[`GET`]}).option(`description`,{type:`string`,description:`Additional details about the test.`}).option(`enabled`,{type:`boolean`,description:`Determines whether or not the test is active.`}).option(`interval`,{type:`string`,description:`How often the test will run.`}).option(`name`,{type:`string`,description:`The name of the DEX test. Must be unique.`}).option(`targeted`,{type:`boolean`,description:`The targeted field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const cu={command:`update <dex-test-id>`,describe:`Update a DEX test.`,builder:su,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dex tests update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/devices/dex_tests/${e[`dex-test-id`]==null?`<dex-test-id>`:encodeURIComponent(String(e[`dex-test-id`]))}`,pathParams:{"dex-test-id":String(e[`dex-test-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({data:{host:f(e[`data-host`],`data-host`,`text`),kind:f(e[`data-kind`],`data-kind`,`text`),method:f(e[`data-method`],`data-method`,`text`)},description:f(e.description,`description`,`text`),enabled:e.enabled,interval:f(e.interval,`interval`,`text`),name:f(e.name,`name`,`text`),targeted:e.targeted}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.dex.tests.update({body:t,account_id:u,dex_test_id:e[`dex-test-id`]})),{successLabel:`Updated`});return}if(e[`data-host`]===void 0&&(e[`data-host`]=await h(`data-host`,`The desired endpoint to test.`)),e[`data-kind`]===void 0&&(e[`data-kind`]=await m(`data-kind`,`The type of test.`,[`http`,`traceroute`])),e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);e.interval===void 0&&(e.interval=await h(`interval`,`How often the test will run.`)),e.name===void 0&&(e.name=await h(`name`,`The name of the DEX test. Must be unique.`));let p=d({data:{host:f(e[`data-host`],`data-host`,`text`),kind:f(e[`data-kind`],`data-kind`,`text`),method:f(e[`data-method`],`data-method`,`text`)},description:f(e.description,`description`,`text`),enabled:e.enabled,interval:f(e.interval,`interval`,`text`),name:f(e.name,`name`,`text`),targeted:e.targeted});a(await s(`Updating`,async()=>r.zeroTrust.dex.tests.update({body:p,account_id:u,dex_test_id:e[`dex-test-id`]})),{successLabel:`Updated`})}},lu={command:`tests`,describe:`Operations for dex.tests`,builder:e=>e.command(Zl).command($l).command(tu).command(ru).command(cu).command(ou).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function uu(e){return e.option(`page`,{type:`number`,description:`Page number of paginated results.`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page.`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format.`,demandOption:!0}).option(`type`,{type:`string`,description:`Filter events by type 'config' or 'toggle'.`,choices:[`config`,`toggle`]}).option(`toggle`,{type:`string`,description:`Filter events by type toggle value. Applicable to type='toggle' events only.`,choices:[`on`,`off`]}).option(`config-name`,{type:`string`,description:`Filter events by WARP configuration name changed from or to. Applicable to type='config' events only.`}).option(`account-name`,{type:`string`,description:`Filter events by account name.`}).option(`sort-order`,{type:`string`,description:`Sort response by event timestamp.`,choices:[`ASC`,`DESC`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const du={command:`list`,describe:`List WARP configuration and enablement toggle change events by device.`,builder:_(uu),handler:async e=>{let r={page:e.page,per_page:e[`per-page`],from:e.from,to:e.to,type:e.type,toggle:e.toggle,config_name:e[`config-name`],account_name:e[`account-name`],sort_order:e[`sort-order`]};if(e.dryRun){o({command:`cf zero-trust dex warp-change-events list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dex/warp-change-events`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dex.warpChangeEvents.list({account_id:u,...r})),{successLabel:`Loaded`})}},fu={command:`warp-change-events`,describe:`Operations for dex.warp-change-events`,builder:e=>e.command(du).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},pu={command:`dex`,describe:`Operations for dex`,builder:e=>e.command(Lc).command(Zc).command(fl).command(hl).command(Sl).command(Nl).command(Yl).command(lu).command(fu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function mu(e){return e.option(`case-sensitive`,{type:`boolean`,description:`Only applies to custom word lists.
+Determines if the words should be matched in a case-sensitive manner
+Cannot be set to false if \`secret\` is true or undefined`}).option(`description`,{type:`string`,description:`The description of the dataset.`}).option(`encoding-version`,{type:`number`,description:`Dataset encoding version
+
+Non-secret custom word lists with no header are always version 1.
+Secret EDM lists with no header are version 1.
+Multicolumn CSV with headers are version 2.
+Omitting this field provides the default value 0, which is interpreted
+the same as 1.`}).option(`name`,{type:`string`,description:`The name field`}).option(`secret`,{type:`boolean`,description:`Generate a secret dataset.
+
+If true, the response will include a secret to use with the EDM encoder.
+If false, the response has no secret and the dataset is uploaded in plaintext.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset description.`})}const hu={command:`create`,describe:`Creates a new DLP (Data Loss Prevention) dataset for storing custom detection patterns. Datasets can contain exact match data, word lists, or EDM (Exact Data Match) configurations.`,builder:mu,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp datasets create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/datasets`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({case_sensitive:e[`case-sensitive`],description:f(e.description,`description`,`text`),encoding_version:e[`encoding-version`],name:f(e.name,`name`,`text`),secret:e.secret}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.dlp.datasets.create({...t,account_id:u})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await h(`name`,`The name field`));let p=d({case_sensitive:e[`case-sensitive`],description:f(e.description,`description`,`text`),encoding_version:e[`encoding-version`],name:f(e.name,`name`,`text`),secret:e.secret});a(await s(`Creating`,async()=>r.zeroTrust.dlp.datasets.create({...p,account_id:u})),{successLabel:`Created`})}};function gu(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const _u={command:`delete <dataset-id>`,describe:`This deletes all versions of the dataset.`,builder:gu,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp datasets delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}`,pathParams:{"dataset-id":String(e[`dataset-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.dlp.datasets.delete({account_id:l,dataset_id:e[`dataset-id`]})),{successLabel:`Deleted`})}};function vu(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yu={command:`get <dataset-id>`,describe:`Gets a dataset and its latest upload status.`,builder:vu,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp datasets get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}`,pathParams:{"dataset-id":String(e[`dataset-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.dlp.datasets.get({account_id:l,dataset_id:e[`dataset-id`]})),{successLabel:`Loaded`})}};function bu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $={command:`list`,describe:`Lists all DLP datasets configured for the account, including custom word lists and EDM datasets.`,builder:bu,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp datasets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/datasets`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.dlp.datasets.list({account_id:l})),{successLabel:`Loaded`})}};function xu(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`case-sensitive`,{type:`boolean`,description:`Determines if the words should be matched in a case-sensitive manner.
+
+Only required for custom word lists.`}).option(`description`,{type:`string`,description:`The description of the dataset.`}).option(`name`,{type:`string`,description:`The name of the dataset, must be unique.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset description.`})}const Su={command:`update <dataset-id>`,describe:`Updates the configuration of an existing DLP dataset, such as its name, description, or detection settings.`,builder:xu,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp datasets update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}`,pathParams:{"dataset-id":String(e[`dataset-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({case_sensitive:e[`case-sensitive`],description:f(e.description,`description`,`text`),name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.dlp.datasets.update({...t,account_id:u,dataset_id:e[`dataset-id`]})),{successLabel:`Updated`});return}let p=d({case_sensitive:e[`case-sensitive`],description:f(e.description,`description`,`text`),name:f(e.name,`name`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.dlp.datasets.update({...p,account_id:u,dataset_id:e[`dataset-id`]})),{successLabel:`Updated`})}};function Cu(e){return e.positional(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wu={command:`create <dataset-id>`,describe:`Creates a new version of a DLP dataset, allowing you to stage changes before activation. Used for single-column EDM and custom word lists.`,builder:Cu,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp datasets upload create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}/upload`,pathParams:{"dataset-id":String(e[`dataset-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Creating`,async()=>r.zeroTrust.dlp.datasets.upload.create({account_id:l,dataset_id:e[`dataset-id`]})),{successLabel:`Created`})}};function Tu(e){return e.positional(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset. For custom wordlists this contains UTF-8 patterns separated by newline characters.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Eu={command:`edit <version>`,describe:`This is used for single-column EDMv1 and Custom Word Lists. The EDM format can only be created in the Cloudflare dashboard. For other clients, this operation can only be used for non-secret Custom Word Lists. The body must be a UTF-8 encoded, newline (NL or CRNL) separated list of words to be matched.`,builder:Tu,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp datasets upload edit`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}/upload/${e.version==null?`<version>`:encodeURIComponent(String(e.version))}`,pathParams:{"dataset-id":String(e[`dataset-id`]??``),version:String(e.version??``)},bodyKind:`octet-stream`,body:e.body});return}let l=await i(e),u=e.local?c:await n();if(e.accountId=u,e.file){let t=p(e.file);a(await s(`Creating`,async()=>r(l,`POST`,`/accounts/${u}/dlp/datasets/${encodeURIComponent(String(e[`dataset-id`]))}/upload/${encodeURIComponent(String(e.version))}`,{body:t,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(e.body){let t=f(e.body,`body`,`binary`);a(await s(`Creating`,async()=>r(l,`POST`,`/accounts/${u}/dlp/datasets/${encodeURIComponent(String(e[`dataset-id`]))}/upload/${encodeURIComponent(String(e.version))}`,{body:t,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Du={command:`upload`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(wu).command(Eu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ou(e){return e.positional(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`array of new columns to create for this dataset version.`})}const ku={command:`create <version>`,describe:`This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. The columns in the response appear in the same order as in the request.`,builder:_(Ou),handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp datasets versions create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}/versions/${e.version==null?`<version>`:encodeURIComponent(String(e.version))}`,pathParams:{"dataset-id":String(e[`dataset-id`]??``),version:String(e.version??``)},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.dlp.datasets.versions.create({body:t,account_id:u,dataset_id:e[`dataset-id`],version:e.version})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Au(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset content.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const ju={command:`create <entry-id>`,describe:`This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard.`,builder:Au,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp datasets versions entries create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/datasets/${e[`dataset-id`]==null?`<dataset-id>`:encodeURIComponent(String(e[`dataset-id`]))}/versions/${e.version==null?`<version>`:encodeURIComponent(String(e.version))}/entries/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"dataset-id":String(e[`dataset-id`]??``),version:String(e.version??``),"entry-id":String(e[`entry-id`]??``)},bodyKind:`octet-stream`,body:e.body});return}let l=await i(e),u=e.local?c:await n();if(e.accountId=u,e.file){let t=p(e.file);a(await s(`Creating`,async()=>r(l,`POST`,`/accounts/${u}/dlp/datasets/${encodeURIComponent(String(e[`dataset-id`]))}/versions/${encodeURIComponent(String(e.version))}/entries/${encodeURIComponent(String(e[`entry-id`]))}`,{body:t,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(e.body){let t=f(e.body,`body`,`binary`);a(await s(`Creating`,async()=>r(l,`POST`,`/accounts/${u}/dlp/datasets/${encodeURIComponent(String(e[`dataset-id`]))}/versions/${encodeURIComponent(String(e.version))}/entries/${encodeURIComponent(String(e[`entry-id`]))}`,{body:t,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Mu={command:`entries`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(ju).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Nu={command:`versions`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(ku).command(Mu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Pu={command:`datasets`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(hu).command(_u).command(yu).command($).command(Su).command(Du).command(Nu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Fu(e){return e.option(`auth-requirements-allowed-microsoft-organizations`,{type:`string`,array:!0,description:`The auth_requirements.allowed_microsoft_organizations field`}).option(`auth-requirements-type`,{type:`string`,description:`The auth_requirements.type field`,choices:[`Org`,`NoAuth`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Account mapping.`})}const Iu={command:`create`,describe:`Creates a mapping between a Cloudflare account and an email provider for DLP email scanning integration.`,builder:Fu,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp email account-mapping create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/email/account_mapping`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({auth_requirements:{allowed_microsoft_organizations:e[`auth-requirements-allowed-microsoft-organizations`],type:f(e[`auth-requirements-type`],`auth-requirements-type`,`text`)}}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.dlp.email.accountMapping.create({...t,account_id:u})),{successLabel:`Created`});return}e[`auth-requirements-type`]===void 0&&(e[`auth-requirements-type`]=await m(`auth-requirements-type`,`The auth_requirements.type field`,[`Org`,`NoAuth`]));let p=d({auth_requirements:{allowed_microsoft_organizations:e[`auth-requirements-allowed-microsoft-organizations`],type:f(e[`auth-requirements-type`],`auth-requirements-type`,`text`)}});a(await s(`Creating`,async()=>r.zeroTrust.dlp.email.accountMapping.create({...p,account_id:u})),{successLabel:`Created`})}};function Lu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ru={command:`get`,describe:`Retrieves the email provider mapping configuration for DLP email scanning.`,builder:Lu,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp email account-mapping get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/email/account_mapping`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.dlp.email.accountMapping.get({account_id:l})),{successLabel:`Loaded`})}},zu={command:`account-mapping`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Iu).command(Ru).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bu(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule priorities.`})}const Vu={command:`bulk-edit`,describe:`Reorders DLP email scanning rules by updating their priority values. Higher priority rules are evaluated first.`,builder:Bu,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp email rules bulk-edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.dlp.email.rules.bulkEdit({...t,account_id:u})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Hu(e){return e.option(`action-action`,{type:`string`,description:`The action.action field`,choices:[`Block`]}).option(`action-message`,{type:`string`,description:`The action.message field`}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule description.`})}const Uu={command:`create`,describe:`Creates a new DLP email scanning rule that defines what content patterns to detect in email messages and what actions to take.`,builder:Hu,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp email rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({action:{action:f(e[`action-action`],`action-action`,`text`),message:f(e[`action-message`],`action-message`,`text`)},description:f(e.description,`description`,`text`),enabled:e.enabled,name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.dlp.email.rules.create({body:t,account_id:u})),{successLabel:`Created`});return}if(e[`action-action`]===void 0&&(e[`action-action`]=await m(`action-action`,`The action.action field`,[`Block`])),e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);e.name===void 0&&(e.name=await h(`name`,`The name field`));let p=d({action:{action:f(e[`action-action`],`action-action`,`text`),message:f(e[`action-message`],`action-message`,`text`)},description:f(e.description,`description`,`text`),enabled:e.enabled,name:f(e.name,`name`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.dlp.email.rules.create({body:p,account_id:u})),{successLabel:`Created`})}};function Wu(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Gu={command:`delete <rule-id>`,describe:`Removes a DLP email scanning rule. The rule will no longer be applied to email messages.`,builder:Wu,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp email rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/email/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.dlp.email.rules.delete({account_id:l,rule_id:e[`rule-id`]})),{successLabel:`Deleted`})}};function Ku(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qu={command:`get <rule-id>`,describe:`Gets detailed configuration for a specific DLP email scanning rule, including detection patterns and actions.`,builder:Ku,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp email rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/email/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.dlp.email.rules.get({account_id:l,rule_id:e[`rule-id`]})),{successLabel:`Loaded`})}};function Ju(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yu={command:`list`,describe:`Lists all email scanner rules for an account.`,builder:Ju,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp email rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.dlp.email.rules.list({account_id:l})),{successLabel:`Loaded`})}};function Xu(e){return e.positional(`rule-id`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`action-action`,{type:`string`,description:`The action.action field`,choices:[`Block`]}).option(`action-message`,{type:`string`,description:`The action.message field`}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule description.`})}const Zu={command:`update <rule-id>`,describe:`Updates a DLP email scanning rule.`,builder:Xu,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp email rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/email/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({action:{action:f(e[`action-action`],`action-action`,`text`),message:f(e[`action-message`],`action-message`,`text`)},description:f(e.description,`description`,`text`),enabled:e.enabled,name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.dlp.email.rules.update({body:t,account_id:u,rule_id:e[`rule-id`]})),{successLabel:`Updated`});return}if(e[`action-action`]===void 0&&(e[`action-action`]=await m(`action-action`,`The action.action field`,[`Block`])),e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);e.name===void 0&&(e.name=await h(`name`,`The name field`));let p=d({action:{action:f(e[`action-action`],`action-action`,`text`),message:f(e[`action-message`],`action-message`,`text`)},description:f(e.description,`description`,`text`),enabled:e.enabled,name:f(e.name,`name`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.dlp.email.rules.update({body:p,account_id:u,rule_id:e[`rule-id`]})),{successLabel:`Updated`})}},Qu={command:`rules`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Vu).command(Uu).command(Gu).command(qu).command(Yu).command(Zu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},$u={command:`email`,describe:`Operations for dlp.email`,builder:e=>e.command(zu).command(Qu).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ed(e){return e.option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new entry to create.`})}const td={command:`create`,describe:`Creates a DLP custom entry.`,builder:ed,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp entries create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({description:f(e.description,`description`,`text`),enabled:e.enabled,name:f(e.name,`name`,`text`),pattern:{regex:f(e[`pattern-regex`],`pattern-regex`,`text`)},profile_id:f(e[`profile-id`],`profile-id`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.dlp.entries.create({...t,account_id:u})),{successLabel:`Created`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);e.name===void 0&&(e.name=await h(`name`,`The name field`)),e[`pattern-regex`]===void 0&&(e[`pattern-regex`]=await h(`pattern-regex`,`The pattern.regex field`));let p=d({description:f(e.description,`description`,`text`),enabled:e.enabled,name:f(e.name,`name`,`text`),pattern:{regex:f(e[`pattern-regex`],`pattern-regex`,`text`)},profile_id:f(e[`profile-id`],`profile-id`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.dlp.entries.create({...p,account_id:u})),{successLabel:`Created`})}};function nd(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the entry.`})}const rd={command:`update <entry-id>`,describe:`Updates a DLP custom entry.`,builder:nd,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp entries custom update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/entries/custom/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({description:f(e.description,`description`,`text`),name:f(e.name,`name`,`text`),pattern:{regex:f(e[`pattern-regex`],`pattern-regex`,`text`)},enabled:e.enabled}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.dlp.entries.custom.update({...t,account_id:u,entry_id:e[`entry-id`]})),{successLabel:`Updated`});return}if(e.name===void 0&&(e.name=await h(`name`,`The name field`)),e[`pattern-regex`]===void 0&&(e[`pattern-regex`]=await h(`pattern-regex`,`The pattern.regex field`)),e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let p=d({description:f(e.description,`description`,`text`),name:f(e.name,`name`,`text`),pattern:{regex:f(e[`pattern-regex`],`pattern-regex`,`text`)},enabled:e.enabled});a(await s(`Updating`,async()=>r.zeroTrust.dlp.entries.custom.update({...p,account_id:u,entry_id:e[`entry-id`]})),{successLabel:`Updated`})}},id={command:`custom`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(rd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ad(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const od={command:`delete <entry-id>`,describe:`Deletes a DLP custom entry.`,builder:ad,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp entries delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/entries/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.dlp.entries.delete({account_id:l,entry_id:e[`entry-id`]})),{successLabel:`Deleted`})}};function sd(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const cd={command:`get <entry-id>`,describe:`Fetches a DLP entry by ID.`,builder:sd,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp entries get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/entries/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.dlp.entries.get({account_id:l,entry_id:e[`entry-id`]})),{successLabel:`Loaded`})}};function ld(e){return e.option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`entry-id`,{type:`string`,description:`The entry_id field`}).option(`profile-id`,{type:`string`,description:`This field is not used as the owning profile.
+For predefined entries it is already set to a predefined profile.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`This endpoint will update an existing integration entry. It is not possible to create new integration entries.`})}const ud={command:`create`,describe:`Integration entries can't be created, this will update an existing integration entry. This is needed for our generated terraform API.`,builder:ld,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp entries integration create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/entries/integration`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({enabled:e.enabled,entry_id:f(e[`entry-id`],`entry-id`,`text`),profile_id:f(e[`profile-id`],`profile-id`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.dlp.entries.integration.create({body:t,account_id:u})),{successLabel:`Created`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);e[`entry-id`]===void 0&&(e[`entry-id`]=await h(`entry-id`,`The entry_id field`));let p=d({enabled:e.enabled,entry_id:f(e[`entry-id`],`entry-id`,`text`),profile_id:f(e[`profile-id`],`profile-id`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.dlp.entries.integration.create({body:p,account_id:u})),{successLabel:`Created`})}};function dd(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const fd={command:`delete <entry-id>`,describe:`This is a no-op as integration entires can't be deleted but is needed for our generated terraform API.`,builder:dd,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp entries integration delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/entries/integration/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.dlp.entries.integration.delete({account_id:l,entry_id:e[`entry-id`]})),{successLabel:`Deleted`})}};function pd(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Enable or disable integration entry in owning profile.`})}const md={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:pd,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp entries integration update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/entries/integration/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({enabled:e.enabled}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.dlp.entries.integration.update({body:t,account_id:u,entry_id:e[`entry-id`]})),{successLabel:`Updated`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let f=d({enabled:e.enabled});a(await s(`Updating`,async()=>r.zeroTrust.dlp.entries.integration.update({body:f,account_id:u,entry_id:e[`entry-id`]})),{successLabel:`Updated`})}},hd={command:`integration`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(ud).command(fd).command(md).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function gd(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _d={command:`list`,describe:`Lists all DLP entries in an account.`,builder:gd,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp entries list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.dlp.entries.list({account_id:l})),{successLabel:`Loaded`})}};function vd(e){return e.option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`entry-id`,{type:`string`,description:`The entry_id field`}).option(`profile-id`,{type:`string`,description:`This field is not used as the owning profile.
+For predefined entries it is already set to a predefined profile.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`This endpoint will update an existing predefined entry. It is not possible to create new predefined entries.`})}const yd={command:`create`,describe:`Predefined entries can't be created, this will update an existing predefined entry. This is needed for our generated terraform API.`,builder:vd,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp entries predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/entries/predefined`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({enabled:e.enabled,entry_id:f(e[`entry-id`],`entry-id`,`text`),profile_id:f(e[`profile-id`],`profile-id`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.dlp.entries.predefined.create({body:t,account_id:u})),{successLabel:`Created`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);e[`entry-id`]===void 0&&(e[`entry-id`]=await h(`entry-id`,`The entry_id field`));let p=d({enabled:e.enabled,entry_id:f(e[`entry-id`],`entry-id`,`text`),profile_id:f(e[`profile-id`],`profile-id`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.dlp.entries.predefined.create({body:p,account_id:u})),{successLabel:`Created`})}};function bd(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const xd={command:`delete <entry-id>`,describe:`This is a no-op as predefined entires can't be deleted but is needed for our generated terraform API.`,builder:bd,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp entries predefined delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/entries/predefined/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.dlp.entries.predefined.delete({account_id:l,entry_id:e[`entry-id`]})),{successLabel:`Deleted`})}};function Sd(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Settings to enable or disable predefined entry in owning profile.`})}const Cd={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:Sd,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp entries predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/entries/predefined/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({enabled:e.enabled}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.dlp.entries.predefined.update({body:t,account_id:u,entry_id:e[`entry-id`]})),{successLabel:`Updated`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let f=d({enabled:e.enabled});a(await s(`Updating`,async()=>r.zeroTrust.dlp.entries.predefined.update({body:f,account_id:u,entry_id:e[`entry-id`]})),{successLabel:`Updated`})}},wd={command:`predefined`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(yd).command(xd).command(Cd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Td(e){return e.positional(`entry-id`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the entry.`})}const Ed={command:`update <entry-id>`,describe:`Updates a DLP entry.`,builder:Td,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp entries update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/entries/${e[`entry-id`]==null?`<entry-id>`:encodeURIComponent(String(e[`entry-id`]))}`,pathParams:{"entry-id":String(e[`entry-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({enabled:e.enabled}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.dlp.entries.update({body:t,account_id:u,entry_id:e[`entry-id`]})),{successLabel:`Updated`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let f=d({enabled:e.enabled});a(await s(`Updating`,async()=>r.zeroTrust.dlp.entries.update({body:f,account_id:u,entry_id:e[`entry-id`]})),{successLabel:`Updated`})}},Dd={command:`entries`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(td).command(od).command(cd).command(_d).command(Ed).command(id).command(hd).command(wd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Od(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const kd={command:`list`,describe:`Retrieves current DLP usage limits and quotas for the account, including maximum allowed counts and current usage for custom entries, dataset cells, and document fingerprints.`,builder:Od,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp limits list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/limits`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.dlp.limits.list({account_id:l})),{successLabel:`Loaded`})}},Ad={command:`limits`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(kd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function jd(e){return e.option(`max-match-bytes`,{type:`number`,description:"Maximum number of bytes that the regular expression can match.\n\nIf this is `null` then there is no limit on the length. Patterns can use\n`*` and `+`. Otherwise repeats should use a range `{m,n}` to restrict\npatterns to the length. If this field is missing, then a default length\nlimit is used.\n\nNote that the length is specified in bytes. Since regular expressions\nuse UTF-8 the pattern `.` can match up to 4 bytes. Hence `.{1,256}`\nhas a maximum length of 1024 bytes."}).option(`regex`,{type:`string`,description:`The regex field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Validation query.`})}const Md={command:`validate`,describe:"Validates whether this pattern is a valid regular expression. Rejects it if the regular expression is too complex or can match an unbounded-length string. The regex will be rejected if it uses `*` or `+`. Bound the maximum number of characters that can be matched using a range, e.g. `{1,100}`.",builder:jd,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp patterns validate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/patterns/validate`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({max_match_bytes:e[`max-match-bytes`],regex:f(e.regex,`regex`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.dlp.patterns.validate({...t,account_id:u})),{successLabel:`Created`});return}e.regex===void 0&&(e.regex=await h(`regex`,`The regex field`));let p=d({max_match_bytes:e[`max-match-bytes`],regex:f(e.regex,`regex`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.dlp.patterns.validate({...p,account_id:u})),{successLabel:`Created`})}},Nd={command:`patterns`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Md).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Pd(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fd={command:`get`,describe:`Gets the current payload logging configuration for DLP, showing whether matched content is being logged.`,builder:Pd,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp payload-logs get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/payload_log`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.dlp.payloadLogs.get({account_id:l})),{successLabel:`Loaded`})}};function Id(e){return e.option(`public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
+
+- Set to null or empty string to disable payload logging.
+- Set to a non-empty base64 string to enable payload logging with the given key.
+
+For customers with configurable payload masking feature rolled out:
+- If the field is missing, the existing setting will be kept. Note that this is different from setting to null or empty string.
+
+For all other customers:
+- If the field is missing, the existing setting will be cleared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`New payload log settings.`})}const Ld={command:`update`,describe:`Enables or disables payload logging for DLP matches. When enabled, matched content is stored for review.`,builder:Id,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp payload-logs update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/payload_log`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({public_key:f(e[`public-key`],`public-key`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.dlp.payloadLogs.update({...t,account_id:u})),{successLabel:`Updated`});return}let p=d({public_key:f(e[`public-key`],`public-key`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.dlp.payloadLogs.update({...p,account_id:u})),{successLabel:`Updated`})}},Rd={command:`payload-logs`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Fd).command(Ld).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function zd(e){return e.option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`Related DLP policies will trigger when the match count exceeds the number set.`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`data-classes`,{type:`string`,array:!0,description:`Data class IDs to associate with the profile.`}).option(`data-tags`,{type:`string`,array:!0,description:`Data tag IDs to associate with the profile.`}).option(`description`,{type:`string`,description:`The description of the profile.`}).option(`name`,{type:`string`,description:`The name field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new profile to create.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const Bd={command:`create`,describe:`Creates a DLP custom profile.`,builder:zd,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp profiles custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/profiles/custom`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:f(e[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:e[`context-awareness-enabled`],skip:{files:e[`context-awareness-skip-files`]}},data_classes:e[`data-classes`],data_tags:e[`data-tags`],description:f(e.description,`description`,`text`),name:f(e.name,`name`,`text`),ocr_enabled:e[`ocr-enabled`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.dlp.profiles.custom.create({...t,account_id:u})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await h(`name`,`The name field`));let p=d({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:f(e[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:e[`context-awareness-enabled`],skip:{files:e[`context-awareness-skip-files`]}},data_classes:e[`data-classes`],data_tags:e[`data-tags`],description:f(e.description,`description`,`text`),name:f(e.name,`name`,`text`),ocr_enabled:e[`ocr-enabled`]});a(await s(`Creating`,async()=>r.zeroTrust.dlp.profiles.custom.create({...p,account_id:u})),{successLabel:`Created`})}};function Vd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Hd={command:`delete <profile-id>`,describe:`Deletes a DLP custom profile.`,builder:Vd,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp profiles custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/profiles/custom/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.dlp.profiles.custom.delete({account_id:l,profile_id:e[`profile-id`]})),{successLabel:`Deleted`})}};function Ud(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Wd={command:`get <profile-id>`,describe:`Fetches a custom DLP profile by id.`,builder:Ud,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp profiles custom get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/profiles/custom/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.dlp.profiles.custom.get({account_id:l,profile_id:e[`profile-id`]})),{successLabel:`Loaded`})}};function Gd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`data-classes`,{type:`string`,array:!0,description:`Data class IDs to associate with the profile. If omitted, existing associations are unchanged.`}).option(`data-tags`,{type:`string`,array:!0,description:`Data tag IDs to associate with the profile. If omitted, existing associations are unchanged.`}).option(`description`,{type:`string`,description:`The description of the profile.`}).option(`name`,{type:`string`,description:`The name field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the profile.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const Kd={command:`update <profile-id>`,describe:`Updates a DLP custom profile.`,builder:Gd,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp profiles custom update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/profiles/custom/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:f(e[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:e[`context-awareness-enabled`],skip:{files:e[`context-awareness-skip-files`]}},data_classes:e[`data-classes`],data_tags:e[`data-tags`],description:f(e.description,`description`,`text`),name:f(e.name,`name`,`text`),ocr_enabled:e[`ocr-enabled`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.dlp.profiles.custom.update({...t,account_id:u,profile_id:e[`profile-id`]})),{successLabel:`Updated`});return}e.name===void 0&&(e.name=await h(`name`,`The name field`));let p=d({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:f(e[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:e[`context-awareness-enabled`],skip:{files:e[`context-awareness-skip-files`]}},data_classes:e[`data-classes`],data_tags:e[`data-tags`],description:f(e.description,`description`,`text`),name:f(e.name,`name`,`text`),ocr_enabled:e[`ocr-enabled`]});a(await s(`Updating`,async()=>r.zeroTrust.dlp.profiles.custom.update({...p,account_id:u,profile_id:e[`profile-id`]})),{successLabel:`Updated`})}},qd={command:`custom`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Bd).command(Hd).command(Wd).command(Kd).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Jd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yd={command:`get <profile-id>`,describe:`Fetches a DLP profile by ID.`,builder:Jd,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp profiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/profiles/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.dlp.profiles.get({account_id:l,profile_id:e[`profile-id`]})),{successLabel:`Loaded`})}};function Xd(e){return e.option(`all`,{type:`boolean`,description:`Return all profiles, including those that current account does not have access to.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zd={command:`list`,describe:`Lists all DLP profiles in an account.`,builder:Xd,handler:async e=>{let r={all:e.all};if(e.dryRun){o({command:`cf zero-trust dlp profiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/profiles`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.dlp.profiles.list({account_id:u,...r})),{successLabel:`Loaded`})}};function Qd(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`enabled-entries`,{type:`string`,array:!0,description:`The enabled_entries field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Predefined profiles can not be created. This endpoint will only update an existing predefined profiles settings.`})}const $d={command:`create <profile-id>`,describe:"This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Creates a DLP predefined profile. Only supports enabling/disabling entries.",builder:Qd,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp profiles predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/profiles/predefined/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}/config`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:f(e[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:e[`enabled-entries`],ocr_enabled:e[`ocr-enabled`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.dlp.profiles.predefined.create({body:t,account_id:u,profile_id:e[`profile-id`]})),{successLabel:`Created`});return}let p=d({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:f(e[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:e[`enabled-entries`],ocr_enabled:e[`ocr-enabled`]});a(await s(`Creating`,async()=>r.zeroTrust.dlp.profiles.predefined.create({body:p,account_id:u,profile_id:e[`profile-id`]})),{successLabel:`Created`})}};function ef(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const tf={command:`delete <profile-id>`,describe:`This is a no-op as predefined profiles can't be deleted but is needed for our generated terraform API.`,builder:ef,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp profiles predefined delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/profiles/predefined/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.dlp.profiles.predefined.delete({account_id:l,profile_id:e[`profile-id`]})),{successLabel:`Deleted`})}};function nf(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const rf={command:`get <profile-id>`,describe:"This is similar to `get_predefined` but only returns entries that are enabled. This is needed for our terraform API Fetches a predefined DLP profile by id.",builder:nf,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp profiles predefined get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/profiles/predefined/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}/config`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.dlp.profiles.predefined.get({account_id:l,profile_id:e[`profile-id`]})),{successLabel:`Loaded`})}};function af(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`enabled-entries`,{type:`string`,array:!0,description:`The enabled_entries field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the predefined profile.`})}const of={command:`update <profile-id>`,describe:"This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Updates a DLP predefined profile. Only supports enabling/disabling entries.",builder:af,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust dlp profiles predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/profiles/predefined/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}/config`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:f(e[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:e[`enabled-entries`],ocr_enabled:e[`ocr-enabled`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.dlp.profiles.predefined.update({body:t,account_id:u,profile_id:e[`profile-id`]})),{successLabel:`Updated`});return}let p=d({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:f(e[`confidence-threshold`],`confidence-threshold`,`text`),enabled_entries:e[`enabled-entries`],ocr_enabled:e[`ocr-enabled`]});a(await s(`Updating`,async()=>r.zeroTrust.dlp.profiles.predefined.update({body:p,account_id:u,profile_id:e[`profile-id`]})),{successLabel:`Updated`})}},sf={command:`predefined`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command($d).command(tf).command(rf).command(of).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},cf={command:`profiles`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Yd).command(Zd).command(qd).command(sf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},lf={command:`dlp`,describe:`Operations for dlp`,builder:e=>e.command(Pu).command($u).command(Dd).command(Ad).command(Nd).command(Rd).command(cf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function uf(e){return e.option(`description`,{type:`string`,description:`The description field`,default:``}).option(`match-percent`,{type:`number`,description:`The match_percent field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new document fingerprint.`})}const df={command:`fingerprints`,describe:`Creates a new document fingerprint for DLP scanning. Document fingerprints detect documents that are structurally similar to the uploaded sample.`,builder:uf,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust document-fingerprints create document fingerprints`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/document_fingerprints`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({description:f(e.description,`description`,`text`),match_percent:e[`match-percent`],name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.documentFingerprints.create.document.fingerprints({...t,account_id:u})),{successLabel:`Created`});return}if(e[`match-percent`]===void 0)throw Error(`--match-percent is required (or pass --body with this field set).`);e.name===void 0&&(e.name=await h(`name`,`The name field`));let p=d({description:f(e.description,`description`,`text`),match_percent:e[`match-percent`],name:f(e.name,`name`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.documentFingerprints.create.document.fingerprints({...p,account_id:u})),{successLabel:`Created`})}},ff={command:`document`,describe:`Document Fingerprints operations`,builder:e=>e.command(df).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pf(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`match-percent`,{type:`number`,description:`The match_percent field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the document fingerprint to update.`})}const mf={command:`v2 <document-fingerprint-id>`,describe:`Updates metadata for an existing document fingerprint, such as its name or description.`,builder:pf,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust document-fingerprints create v2`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/document_fingerprints/${e[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(e[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(e[`document-fingerprint-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({description:f(e.description,`description`,`text`),match_percent:e[`match-percent`],name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.documentFingerprints.create.v2({...t,account_id:u,document_fingerprint_id:e[`document-fingerprint-id`]})),{successLabel:`Created`});return}let p=d({description:f(e.description,`description`,`text`),match_percent:e[`match-percent`],name:f(e.name,`name`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.documentFingerprints.create.v2({...p,account_id:u,document_fingerprint_id:e[`document-fingerprint-id`]})),{successLabel:`Created`})}},hf={command:`create`,describe:`Document Fingerprints operations`,builder:e=>e.command(mf).command(ff).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function gf(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const _f={command:`delete <document-fingerprint-id>`,describe:`Removes a document fingerprint from DLP configuration. Documents matching this fingerprint will no longer be detected.`,builder:gf,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust document-fingerprints delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/document_fingerprints/${e[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(e[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(e[`document-fingerprint-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.documentFingerprints.delete({account_id:l,document_fingerprint_id:e[`document-fingerprint-id`]})),{successLabel:`Deleted`})}};function vf(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const yf={command:`fingerprints <document-fingerprint-id>`,describe:`Gets a document fingerprint and its latest upload status.`,builder:vf,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust document-fingerprints get document fingerprints`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/document_fingerprints/${e[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(e[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(e[`document-fingerprint-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.documentFingerprints.get.document.fingerprints({account_id:l,document_fingerprint_id:e[`document-fingerprint-id`]})),{successLabel:`Loaded`})}},bf={command:`document`,describe:`Document Fingerprints operations`,builder:e=>e.command(yf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function xf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sf={command:`all`,describe:`Lists all document fingerprints configured for DLP scanning in the account.`,builder:xf,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust document-fingerprints get fingerprints all`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/document_fingerprints`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.documentFingerprints.get.fingerprints.all({account_id:l})),{successLabel:`Loaded`})}},Cf={command:`fingerprints`,describe:`Document Fingerprints operations`,builder:e=>e.command(Sf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},wf={command:`get`,describe:`Operations for document-fingerprints.get`,builder:e=>e.command(bf).command(Cf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Tf(e){return e.positional(`document-fingerprint-id`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`File used for document fingerprinting.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`})}const Ef={command:`update <document-fingerprint-id>`,describe:`Uploads a new document to create or update a fingerprint. The document structure is analyzed to enable detection of similar documents.`,builder:Tf,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust document-fingerprints update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/document_fingerprints/${e[`document-fingerprint-id`]==null?`<document-fingerprint-id>`:encodeURIComponent(String(e[`document-fingerprint-id`]))}`,pathParams:{"document-fingerprint-id":String(e[`document-fingerprint-id`]??``)},bodyKind:`multipart`,body:{body:e.body,file:e.file}});return}let l=await i(e),u=e.local?c:await n();if(e.accountId=u,e.file!==void 0||e.body!==void 0){let t=new FormData;if(e.file){let n=p(e.file);t.append(`file`,new Blob([n]),e.file.split(/[\\/]/).filter(Boolean).pop())}else e.body!==void 0&&t.append(`file`,e.body);a(await s(`Updating`,async()=>r(l,`PUT`,`/accounts/${u}/dlp/document_fingerprints/${encodeURIComponent(String(e[`document-fingerprint-id`]))}`,{body:t})),{successLabel:`Updated`});return}if(e.body){let t=f(e.body,`body`,`binary`);a(await s(`Updating`,async()=>r(l,`PUT`,`/accounts/${u}/dlp/document_fingerprints/${encodeURIComponent(String(e[`document-fingerprint-id`]))}`,{body:t,headers:{"Content-Type":`multipart/form-data`}})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Df={command:`document-fingerprints`,describe:`Document Fingerprints operations`,builder:e=>e.command(_f).command(Ef).command(hf).command(wf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Of(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const kf={command:`list`,describe:`List all application and application type mappings.`,builder:Of,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway app-types list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/app_types`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.appTypes.list({account_id:l})),{successLabel:`Loaded`})}},Af={command:`app-types`,describe:`Operations for gateway.app-types`,builder:e=>e.command(kf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function jf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Mf={command:`get`,describe:`Retrieve all Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.`,builder:jf,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway audit-ssh-settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/audit_ssh_settings`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.auditSshSettings.get({account_id:l})),{successLabel:`Loaded`})}};function Nf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pf={command:`rotate-seed`,describe:`Rotate the SSH account seed that generates the host key identity when connecting through the Cloudflare SSH Proxy.`,builder:Nf,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway audit-ssh-settings rotate-seed`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/audit_ssh_settings/rotate_seed`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Creating`,async()=>r.zeroTrust.gateway.auditSshSettings.rotateSeed({account_id:l})),{successLabel:`Created`})}};function Ff(e){return e.option(`public-key`,{type:`string`,description:`Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const If={command:`update`,describe:`Update Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.`,builder:Ff,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway audit-ssh-settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/audit_ssh_settings`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({public_key:f(e[`public-key`],`public-key`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.gateway.auditSshSettings.update({...t,account_id:u})),{successLabel:`Updated`});return}e[`public-key`]===void 0&&(e[`public-key`]=await h(`public-key`,`Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging.`));let p=d({public_key:f(e[`public-key`],`public-key`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.gateway.auditSshSettings.update({...p,account_id:u})),{successLabel:`Updated`})}},Lf={command:`audit-ssh-settings`,describe:`Operations for gateway.audit-ssh-settings`,builder:e=>e.command(Mf).command(Pf).command(If).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Rf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zf={command:`list`,describe:`List all categories.`,builder:Rf,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway categories list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/categories`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.categories.list({account_id:l})),{successLabel:`Loaded`})}},Bf={command:`categories`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(zf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Vf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Hf={command:`activate <certificate-id>`,describe:`Bind a single Zero Trust certificate to the edge.`,builder:Vf,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway certificates activate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}/activate`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Creating`,async()=>r.zeroTrust.gateway.certificates.activate({account_id:l,certificate_id:e[`certificate-id`]})),{successLabel:`Created`})}};function Uf(e){return e.option(`validity-period-days`,{type:`number`,description:"Sets the certificate validity period in days (range: 1-10,950 days / ~30 years). Defaults to 1,825 days (5 years). **Important**: This field is only settable during the certificate creation.  Certificates becomes immutable after creation - use the `/activate` and `/deactivate` endpoints to manage certificate lifecycle."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wf={command:`create`,describe:`Create a new Zero Trust certificate.`,builder:Uf,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/certificates`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({validity_period_days:e[`validity-period-days`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.gateway.certificates.create({...t,account_id:u})),{successLabel:`Created`});return}let f=d({validity_period_days:e[`validity-period-days`]});a(await s(`Creating`,async()=>r.zeroTrust.gateway.certificates.create({...f,account_id:u})),{successLabel:`Created`})}};function Gf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kf={command:`deactivate <certificate-id>`,describe:`Unbind a single Zero Trust certificate from the edge.`,builder:Gf,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway certificates deactivate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}/deactivate`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Creating`,async()=>r.zeroTrust.gateway.certificates.deactivate({account_id:l,certificate_id:e[`certificate-id`]})),{successLabel:`Created`})}};function qf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Jf={command:`delete <certificate-id>`,describe:`Delete a gateway-managed Zero Trust certificate. You must deactivate the certificate from the edge (inactive) before deleting it.`,builder:qf,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.gateway.certificates.delete({account_id:l,certificate_id:e[`certificate-id`]})),{successLabel:`Deleted`})}};function Yf(e){return e.positional(`certificate-id`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xf={command:`get <certificate-id>`,describe:`Get a single Zero Trust certificate.`,builder:Yf,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway certificates get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/certificates/${e[`certificate-id`]==null?`<certificate-id>`:encodeURIComponent(String(e[`certificate-id`]))}`,pathParams:{"certificate-id":String(e[`certificate-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.certificates.get({account_id:l,certificate_id:e[`certificate-id`]})),{successLabel:`Loaded`})}};function Zf(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qf={command:`list`,describe:`List all Zero Trust certificates for an account.`,builder:Zf,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway certificates list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/certificates`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.certificates.list({account_id:l})),{successLabel:`Loaded`})}},$f={command:`certificates`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(Hf).command(Wf).command(Kf).command(Jf).command(Xf).command(Qf).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ep(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const tp={command:`get`,describe:`Retrieve the current Zero Trust certificate configuration.`,builder:ep,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway configurations custom-certificate get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/configuration/custom_certificate`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.configurations.customCertificate.get({account_id:l})),{successLabel:`Loaded`})}},np={command:`custom-certificate`,describe:`Operations for gateway.configurations.custom-certificate`,builder:e=>e.command(tp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function rp(e){return e.option(`settings-activity-log-enabled`,{type:`boolean`,description:`Specify whether to log activity.`}).option(`settings-antivirus-enabled-download-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on downloads.`}).option(`settings-antivirus-enabled-upload-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on uploads.`}).option(`settings-antivirus-fail-closed`,{type:`boolean`,description:`Specify whether to block requests for unscannable files.`}).option(`settings-antivirus-notification-settings-enabled`,{type:`boolean`,description:`Specify whether to enable notifications.`}).option(`settings-antivirus-notification-settings-include-context`,{type:`boolean`,description:`Specify whether to include context information as query parameters.`}).option(`settings-antivirus-notification-settings-msg`,{type:`string`,description:`Specify the message to show in the notification.`}).option(`settings-antivirus-notification-settings-support-url`,{type:`string`,description:`Specify a URL that directs users to more information. If unset, the notification opens a block page.`}).option(`settings-block-page-background-color`,{type:`string`,description:"Specify the block page background color in `#rrggbb` format when the mode is customized_block_page."}).option(`settings-block-page-enabled`,{type:`boolean`,description:`Specify whether to enable the custom block page.`}).option(`settings-block-page-footer-text`,{type:`string`,description:`Specify the block page footer text when the mode is customized_block_page.`}).option(`settings-block-page-header-text`,{type:`string`,description:`Specify the block page header text when the mode is customized_block_page.`}).option(`settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to append context to target_uri as query parameters. This applies only when the mode is redirect_uri.`}).option(`settings-block-page-logo-path`,{type:`string`,description:`Specify the full URL to the logo file when the mode is customized_block_page.`}).option(`settings-block-page-mailto-address`,{type:`string`,description:`Specify the admin email for users to contact when the mode is customized_block_page.`}).option(`settings-block-page-mailto-subject`,{type:`string`,description:`Specify the subject line for emails created from the block page when the mode is customized_block_page.`}).option(`settings-block-page-mode`,{type:`string`,description:`Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.`,choices:[`customized_block_page`,`redirect_uri`]}).option(`settings-block-page-name`,{type:`string`,description:`Specify the block page title when the mode is customized_block_page.`}).option(`settings-block-page-suppress-footer`,{type:`boolean`,description:`Specify whether to suppress detailed information at the bottom of the block page when the mode is customized_block_page.`}).option(`settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to redirect users to when the mode is redirect_uri.`}).option(`settings-body-scanning-inspection-mode`,{type:`string`,description:"Specify the inspection mode as either `deep` or `shallow`.",choices:[`deep`,`shallow`]}).option(`settings-browser-isolation-non-identity-enabled`,{type:`boolean`,description:`Specify whether to enable non-identity onramp support for Browser Isolation.`}).option(`settings-browser-isolation-url-browser-isolation-enabled`,{type:`boolean`,description:`Specify whether to enable Clientless Browser Isolation.`}).option(`settings-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.`}).option(`settings-custom-certificate-enabled`,{type:`boolean`,description:`Specify whether to enable a custom certificate authority for signing Gateway traffic.`}).option(`settings-custom-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate (ID from MTLS certificate store).`}).option(`settings-extended-email-matching-enabled`,{type:`boolean`,description:`Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.`}).option(`settings-fips-tls`,{type:`boolean`,description:`Enforce cipher suites and TLS versions compliant with FIPS 140-2.`}).option(`settings-host-selector-enabled`,{type:`boolean`,description:`Specify whether to enable filtering via hosts for egress policies.`}).option(`settings-inspection-mode`,{type:`string`,description:`Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.`,choices:[`static`,`dynamic`]}).option(`settings-max-ttl-secs`,{type:`number`,description:"Account-level cap on DNS response TTLs, in seconds. Gateway rewrites DNS responses so returned record TTLs do not exceed this value. Null means no cap. Each DNS location can inherit, override, or disable it through the location `max_ttl` setting."}).option(`settings-protocol-detection-enabled`,{type:`boolean`,description:`Specify whether to detect protocols from the initial bytes of client traffic.`}).option(`settings-sandbox-enabled`,{type:`boolean`,description:`Specify whether to enable the sandbox.`}).option(`settings-sandbox-fallback-action`,{type:`string`,description:`Specify the action to take when the system cannot scan the file.`,choices:[`allow`,`block`]}).option(`settings-tls-decrypt-enabled`,{type:`boolean`,description:`Specify whether to inspect encrypted HTTP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Specify account settings.`}).check(e=>{if(`settings-activity-log-enabled.settings-antivirus-enabled-download-phase.settings-antivirus-enabled-upload-phase.settings-antivirus-fail-closed.settings-antivirus-notification-settings-enabled.settings-antivirus-notification-settings-include-context.settings-antivirus-notification-settings-msg.settings-antivirus-notification-settings-support-url.settings-block-page-background-color.settings-block-page-enabled.settings-block-page-footer-text.settings-block-page-header-text.settings-block-page-include-context.settings-block-page-logo-path.settings-block-page-mailto-address.settings-block-page-mailto-subject.settings-block-page-name.settings-block-page-suppress-footer.settings-block-page-target-uri.settings-body-scanning-inspection-mode.settings-browser-isolation-non-identity-enabled.settings-browser-isolation-url-browser-isolation-enabled.settings-certificate-id.settings-custom-certificate-enabled.settings-custom-certificate-id.settings-extended-email-matching-enabled.settings-fips-tls.settings-host-selector-enabled.settings-inspection-mode.settings-max-ttl-secs.settings-protocol-detection-enabled.settings-sandbox-enabled.settings-sandbox-fallback-action.settings-tls-decrypt-enabled`.split(`.`).some(t=>e[t]!==void 0)){let t=[`settings-certificate-id`,`settings-custom-certificate-enabled`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --settings-* flag is set`)}return!0})}const ip={command:`edit`,describe:"Update (PATCH) a single subcollection of settings such as `antivirus`, `tls_decrypt`, `activity_log`, `block_page`, `browser_isolation`, `fips`, `body_scanning`, `certificate`, or `max_ttl_secs` without updating the entire configuration object. This endpoint returns an error if any settings collection lacks proper configuration.",builder:rp,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway configurations edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({settings:{activity_log:{enabled:e[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:e[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:e[`settings-antivirus-enabled-upload-phase`],fail_closed:e[`settings-antivirus-fail-closed`],notification_settings:{enabled:e[`settings-antivirus-notification-settings-enabled`],include_context:e[`settings-antivirus-notification-settings-include-context`],msg:f(e[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:f(e[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:f(e[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:e[`settings-block-page-enabled`],footer_text:f(e[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:f(e[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:e[`settings-block-page-include-context`],logo_path:f(e[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:f(e[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:f(e[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:f(e[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:f(e[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:e[`settings-block-page-suppress-footer`],target_uri:f(e[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:f(e[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:e[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:e[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:f(e[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:e[`settings-custom-certificate-enabled`],id:f(e[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:e[`settings-extended-email-matching-enabled`]},fips:{tls:e[`settings-fips-tls`]},host_selector:{enabled:e[`settings-host-selector-enabled`]},inspection:{mode:f(e[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:e[`settings-max-ttl-secs`],protocol_detection:{enabled:e[`settings-protocol-detection-enabled`]},sandbox:{enabled:e[`settings-sandbox-enabled`],fallback_action:f(e[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:e[`settings-tls-decrypt-enabled`]}}}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.gateway.configurations.edit({body:t,account_id:u})),{successLabel:`Updated`});return}let p=d({settings:{activity_log:{enabled:e[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:e[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:e[`settings-antivirus-enabled-upload-phase`],fail_closed:e[`settings-antivirus-fail-closed`],notification_settings:{enabled:e[`settings-antivirus-notification-settings-enabled`],include_context:e[`settings-antivirus-notification-settings-include-context`],msg:f(e[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:f(e[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:f(e[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:e[`settings-block-page-enabled`],footer_text:f(e[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:f(e[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:e[`settings-block-page-include-context`],logo_path:f(e[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:f(e[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:f(e[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:f(e[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:f(e[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:e[`settings-block-page-suppress-footer`],target_uri:f(e[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:f(e[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:e[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:e[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:f(e[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:e[`settings-custom-certificate-enabled`],id:f(e[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:e[`settings-extended-email-matching-enabled`]},fips:{tls:e[`settings-fips-tls`]},host_selector:{enabled:e[`settings-host-selector-enabled`]},inspection:{mode:f(e[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:e[`settings-max-ttl-secs`],protocol_detection:{enabled:e[`settings-protocol-detection-enabled`]},sandbox:{enabled:e[`settings-sandbox-enabled`],fallback_action:f(e[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:e[`settings-tls-decrypt-enabled`]}}});a(await s(`Updating`,async()=>r.zeroTrust.gateway.configurations.edit({body:p,account_id:u})),{successLabel:`Updated`})}};function ap(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const op={command:`get`,describe:`Retrieve the current Zero Trust account configuration.`,builder:ap,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway configurations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.configurations.get({account_id:l})),{successLabel:`Loaded`})}};function sp(e){return e.option(`settings-activity-log-enabled`,{type:`boolean`,description:`Specify whether to log activity.`}).option(`settings-antivirus-enabled-download-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on downloads.`}).option(`settings-antivirus-enabled-upload-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on uploads.`}).option(`settings-antivirus-fail-closed`,{type:`boolean`,description:`Specify whether to block requests for unscannable files.`}).option(`settings-antivirus-notification-settings-enabled`,{type:`boolean`,description:`Specify whether to enable notifications.`}).option(`settings-antivirus-notification-settings-include-context`,{type:`boolean`,description:`Specify whether to include context information as query parameters.`}).option(`settings-antivirus-notification-settings-msg`,{type:`string`,description:`Specify the message to show in the notification.`}).option(`settings-antivirus-notification-settings-support-url`,{type:`string`,description:`Specify a URL that directs users to more information. If unset, the notification opens a block page.`}).option(`settings-block-page-background-color`,{type:`string`,description:"Specify the block page background color in `#rrggbb` format when the mode is customized_block_page."}).option(`settings-block-page-enabled`,{type:`boolean`,description:`Specify whether to enable the custom block page.`}).option(`settings-block-page-footer-text`,{type:`string`,description:`Specify the block page footer text when the mode is customized_block_page.`}).option(`settings-block-page-header-text`,{type:`string`,description:`Specify the block page header text when the mode is customized_block_page.`}).option(`settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to append context to target_uri as query parameters. This applies only when the mode is redirect_uri.`}).option(`settings-block-page-logo-path`,{type:`string`,description:`Specify the full URL to the logo file when the mode is customized_block_page.`}).option(`settings-block-page-mailto-address`,{type:`string`,description:`Specify the admin email for users to contact when the mode is customized_block_page.`}).option(`settings-block-page-mailto-subject`,{type:`string`,description:`Specify the subject line for emails created from the block page when the mode is customized_block_page.`}).option(`settings-block-page-mode`,{type:`string`,description:`Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.`,choices:[`customized_block_page`,`redirect_uri`]}).option(`settings-block-page-name`,{type:`string`,description:`Specify the block page title when the mode is customized_block_page.`}).option(`settings-block-page-suppress-footer`,{type:`boolean`,description:`Specify whether to suppress detailed information at the bottom of the block page when the mode is customized_block_page.`}).option(`settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to redirect users to when the mode is redirect_uri.`}).option(`settings-body-scanning-inspection-mode`,{type:`string`,description:"Specify the inspection mode as either `deep` or `shallow`.",choices:[`deep`,`shallow`]}).option(`settings-browser-isolation-non-identity-enabled`,{type:`boolean`,description:`Specify whether to enable non-identity onramp support for Browser Isolation.`}).option(`settings-browser-isolation-url-browser-isolation-enabled`,{type:`boolean`,description:`Specify whether to enable Clientless Browser Isolation.`}).option(`settings-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.`}).option(`settings-custom-certificate-enabled`,{type:`boolean`,description:`Specify whether to enable a custom certificate authority for signing Gateway traffic.`}).option(`settings-custom-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate (ID from MTLS certificate store).`}).option(`settings-extended-email-matching-enabled`,{type:`boolean`,description:`Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.`}).option(`settings-fips-tls`,{type:`boolean`,description:`Enforce cipher suites and TLS versions compliant with FIPS 140-2.`}).option(`settings-host-selector-enabled`,{type:`boolean`,description:`Specify whether to enable filtering via hosts for egress policies.`}).option(`settings-inspection-mode`,{type:`string`,description:`Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.`,choices:[`static`,`dynamic`]}).option(`settings-max-ttl-secs`,{type:`number`,description:"Account-level cap on DNS response TTLs, in seconds. Gateway rewrites DNS responses so returned record TTLs do not exceed this value. Null means no cap. Each DNS location can inherit, override, or disable it through the location `max_ttl` setting."}).option(`settings-protocol-detection-enabled`,{type:`boolean`,description:`Specify whether to detect protocols from the initial bytes of client traffic.`}).option(`settings-sandbox-enabled`,{type:`boolean`,description:`Specify whether to enable the sandbox.`}).option(`settings-sandbox-fallback-action`,{type:`string`,description:`Specify the action to take when the system cannot scan the file.`,choices:[`allow`,`block`]}).option(`settings-tls-decrypt-enabled`,{type:`boolean`,description:`Specify whether to inspect encrypted HTTP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Specify account settings.`}).check(e=>{if(`settings-activity-log-enabled.settings-antivirus-enabled-download-phase.settings-antivirus-enabled-upload-phase.settings-antivirus-fail-closed.settings-antivirus-notification-settings-enabled.settings-antivirus-notification-settings-include-context.settings-antivirus-notification-settings-msg.settings-antivirus-notification-settings-support-url.settings-block-page-background-color.settings-block-page-enabled.settings-block-page-footer-text.settings-block-page-header-text.settings-block-page-include-context.settings-block-page-logo-path.settings-block-page-mailto-address.settings-block-page-mailto-subject.settings-block-page-name.settings-block-page-suppress-footer.settings-block-page-target-uri.settings-body-scanning-inspection-mode.settings-browser-isolation-non-identity-enabled.settings-browser-isolation-url-browser-isolation-enabled.settings-certificate-id.settings-custom-certificate-enabled.settings-custom-certificate-id.settings-extended-email-matching-enabled.settings-fips-tls.settings-host-selector-enabled.settings-inspection-mode.settings-max-ttl-secs.settings-protocol-detection-enabled.settings-sandbox-enabled.settings-sandbox-fallback-action.settings-tls-decrypt-enabled`.split(`.`).some(t=>e[t]!==void 0)){let t=[`settings-certificate-id`,`settings-custom-certificate-enabled`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --settings-* flag is set`)}return!0})}const cp={command:`update`,describe:`Update the current Zero Trust account configuration.`,builder:sp,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway configurations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({settings:{activity_log:{enabled:e[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:e[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:e[`settings-antivirus-enabled-upload-phase`],fail_closed:e[`settings-antivirus-fail-closed`],notification_settings:{enabled:e[`settings-antivirus-notification-settings-enabled`],include_context:e[`settings-antivirus-notification-settings-include-context`],msg:f(e[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:f(e[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:f(e[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:e[`settings-block-page-enabled`],footer_text:f(e[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:f(e[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:e[`settings-block-page-include-context`],logo_path:f(e[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:f(e[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:f(e[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:f(e[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:f(e[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:e[`settings-block-page-suppress-footer`],target_uri:f(e[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:f(e[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:e[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:e[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:f(e[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:e[`settings-custom-certificate-enabled`],id:f(e[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:e[`settings-extended-email-matching-enabled`]},fips:{tls:e[`settings-fips-tls`]},host_selector:{enabled:e[`settings-host-selector-enabled`]},inspection:{mode:f(e[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:e[`settings-max-ttl-secs`],protocol_detection:{enabled:e[`settings-protocol-detection-enabled`]},sandbox:{enabled:e[`settings-sandbox-enabled`],fallback_action:f(e[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:e[`settings-tls-decrypt-enabled`]}}}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.gateway.configurations.update({body:t,account_id:u})),{successLabel:`Updated`});return}let p=d({settings:{activity_log:{enabled:e[`settings-activity-log-enabled`]},antivirus:{enabled_download_phase:e[`settings-antivirus-enabled-download-phase`],enabled_upload_phase:e[`settings-antivirus-enabled-upload-phase`],fail_closed:e[`settings-antivirus-fail-closed`],notification_settings:{enabled:e[`settings-antivirus-notification-settings-enabled`],include_context:e[`settings-antivirus-notification-settings-include-context`],msg:f(e[`settings-antivirus-notification-settings-msg`],`settings-antivirus-notification-settings-msg`,`text`),support_url:f(e[`settings-antivirus-notification-settings-support-url`],`settings-antivirus-notification-settings-support-url`,`text`)}},block_page:{background_color:f(e[`settings-block-page-background-color`],`settings-block-page-background-color`,`text`),enabled:e[`settings-block-page-enabled`],footer_text:f(e[`settings-block-page-footer-text`],`settings-block-page-footer-text`,`text`),header_text:f(e[`settings-block-page-header-text`],`settings-block-page-header-text`,`text`),include_context:e[`settings-block-page-include-context`],logo_path:f(e[`settings-block-page-logo-path`],`settings-block-page-logo-path`,`text`),mailto_address:f(e[`settings-block-page-mailto-address`],`settings-block-page-mailto-address`,`text`),mailto_subject:f(e[`settings-block-page-mailto-subject`],`settings-block-page-mailto-subject`,`text`),mode:f(e[`settings-block-page-mode`],`settings-block-page-mode`,`text`),name:f(e[`settings-block-page-name`],`settings-block-page-name`,`text`),suppress_footer:e[`settings-block-page-suppress-footer`],target_uri:f(e[`settings-block-page-target-uri`],`settings-block-page-target-uri`,`text`)},body_scanning:{inspection_mode:f(e[`settings-body-scanning-inspection-mode`],`settings-body-scanning-inspection-mode`,`text`)},browser_isolation:{non_identity_enabled:e[`settings-browser-isolation-non-identity-enabled`],url_browser_isolation_enabled:e[`settings-browser-isolation-url-browser-isolation-enabled`]},certificate:{id:f(e[`settings-certificate-id`],`settings-certificate-id`,`text`)},custom_certificate:{enabled:e[`settings-custom-certificate-enabled`],id:f(e[`settings-custom-certificate-id`],`settings-custom-certificate-id`,`text`)},extended_email_matching:{enabled:e[`settings-extended-email-matching-enabled`]},fips:{tls:e[`settings-fips-tls`]},host_selector:{enabled:e[`settings-host-selector-enabled`]},inspection:{mode:f(e[`settings-inspection-mode`],`settings-inspection-mode`,`text`)},max_ttl_secs:e[`settings-max-ttl-secs`],protocol_detection:{enabled:e[`settings-protocol-detection-enabled`]},sandbox:{enabled:e[`settings-sandbox-enabled`],fallback_action:f(e[`settings-sandbox-fallback-action`],`settings-sandbox-fallback-action`,`text`)},tls_decrypt:{enabled:e[`settings-tls-decrypt-enabled`]}}});a(await s(`Updating`,async()=>r.zeroTrust.gateway.configurations.update({body:p,account_id:u})),{successLabel:`Updated`})}},lp={command:`configurations`,describe:`Operations for gateway.configurations`,builder:e=>e.command(ip).command(op).command(cp).command(np).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function up(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const dp={command:`create`,describe:`Create a Zero Trust account for an existing Cloudflare account.`,builder:up,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Creating`,async()=>r.zeroTrust.gateway.create({account_id:l})),{successLabel:`Created`})}};function fp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pp={command:`list`,describe:`Retrieve information about the current Zero Trust account.`,builder:fp,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.list({account_id:l})),{successLabel:`Loaded`})}};function mp(e){return e.option(`description`,{type:`string`,description:`Provide the list description.`}).option(`name`,{type:`string`,description:`Specify the list name.`}).option(`type`,{type:`string`,description:`Specify the list type.`,choices:[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const hp={command:`create`,describe:`Creates a new Zero Trust list.`,builder:mp,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway lists create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/lists`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({description:f(e.description,`description`,`text`),name:f(e.name,`name`,`text`),type:f(e.type,`type`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.gateway.lists.create({...t,account_id:u})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await h(`name`,`Specify the list name.`)),e.type===void 0&&(e.type=await m(`type`,`Specify the list type.`,[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]));let p=d({description:f(e.description,`description`,`text`),name:f(e.name,`name`,`text`),type:f(e.type,`type`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.gateway.lists.create({...p,account_id:u})),{successLabel:`Created`})}};function gp(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const _p={command:`delete <list-id>`,describe:`Deletes a Zero Trust list.`,builder:gp,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway lists delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/lists/${e[`list-id`]==null?`<list-id>`:encodeURIComponent(String(e[`list-id`]))}`,pathParams:{"list-id":String(e[`list-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.gateway.lists.delete({account_id:l,list_id:e[`list-id`]})),{successLabel:`Deleted`})}};function vp(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`remove`,{type:`string`,array:!0,description:`Lists of item values you want to remove.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const yp={command:`edit <list-id>`,describe:`Appends or removes an item from a configured Zero Trust list.`,builder:vp,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway lists edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/lists/${e[`list-id`]==null?`<list-id>`:encodeURIComponent(String(e[`list-id`]))}`,pathParams:{"list-id":String(e[`list-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({remove:e.remove}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.gateway.lists.edit({...t,account_id:u,list_id:e[`list-id`]})),{successLabel:`Updated`});return}let f=d({remove:e.remove});a(await s(`Updating`,async()=>r.zeroTrust.gateway.lists.edit({...f,account_id:u,list_id:e[`list-id`]})),{successLabel:`Updated`})}};function bp(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xp={command:`get <list-id>`,describe:`Fetch a single Zero Trust list.`,builder:bp,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway lists get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/lists/${e[`list-id`]==null?`<list-id>`:encodeURIComponent(String(e[`list-id`]))}`,pathParams:{"list-id":String(e[`list-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.lists.get({account_id:l,list_id:e[`list-id`]})),{successLabel:`Loaded`})}};function Sp(e){return e.option(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cp={command:`list`,describe:`Fetch all items in a single Zero Trust list.`,builder:Sp,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway lists items list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/lists/${e[`list-id`]==null?`<list-id>`:encodeURIComponent(String(e[`list-id`]))}/items`,pathParams:{"list-id":String(e[`list-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.lists.items.list({account_id:l,list_id:e[`list-id`]})),{successLabel:`Loaded`})}},wp={command:`items`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(Cp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Tp(e){return e.option(`type`,{type:`string`,description:`Specify the list type.`,choices:[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ep={command:`list`,describe:`Fetch all Zero Trust lists for an account.`,builder:_(Tp),handler:async e=>{let r={type:e.type};if(e.dryRun){o({command:`cf zero-trust gateway lists list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/lists`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.gateway.lists.list({account_id:u,...r})),{successLabel:`Loaded`})}};function Dp(e){return e.positional(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`Provide the list description.`}).option(`name`,{type:`string`,description:`Specify the list name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Op={command:`update <list-id>`,describe:`Updates a configured Zero Trust list. Skips updating list items if not included in the payload. A non empty list items will overwrite the existing list.`,builder:Dp,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway lists update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/lists/${e[`list-id`]==null?`<list-id>`:encodeURIComponent(String(e[`list-id`]))}`,pathParams:{"list-id":String(e[`list-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({description:f(e.description,`description`,`text`),name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.gateway.lists.update({...t,account_id:u,list_id:e[`list-id`]})),{successLabel:`Updated`});return}e.name===void 0&&(e.name=await h(`name`,`Specify the list name.`));let p=d({description:f(e.description,`description`,`text`),name:f(e.name,`name`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.gateway.lists.update({...p,account_id:u,list_id:e[`list-id`]})),{successLabel:`Updated`})}},kp={command:`lists`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(hp).command(_p).command(yp).command(xp).command(Ep).command(Op).command(wp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ap(e){return e.option(`client-default`,{type:`boolean`,description:`Indicate whether this location is the default location.`,default:!1}).option(`dns-destination-ips-id`,{type:`string`,description:`Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.`}).option(`ecs-support`,{type:`boolean`,description:`Indicate whether the location must resolve EDNS queries.`,default:!1}).option(`endpoints-doh-enabled`,{type:`boolean`,description:`Indicate whether the DOH endpoint is enabled for this location.`}).option(`endpoints-doh-require-token`,{type:`boolean`,description:`Specify whether the DOH endpoint requires user identity authentication.`}).option(`endpoints-dot-enabled`,{type:`boolean`,description:`Indicate whether the DOT endpoint is enabled for this location.`}).option(`endpoints-ipv4-enabled`,{type:`boolean`,description:`Indicate whether the IPv4 endpoint is enabled for this location.`}).option(`endpoints-ipv6-enabled`,{type:`boolean`,description:`Indicate whether the IPV6 endpoint is enabled for this location.`}).option(`max-ttl-mode`,{type:`string`,description:"`inherit` uses the account `max_ttl_secs`. `override` uses this location's `ttl_secs`. `disabled` leaves returned TTLs unchanged.",choices:[`inherit`,`override`,`disabled`]}).option(`max-ttl-ttl-secs`,{type:`number`,description:"Location-specific cap on DNS response TTLs, in seconds. Required when `mode` is `override`. Must be omitted when `mode` is `inherit` or `disabled`."}).option(`name`,{type:`string`,description:`Specify the location name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`max-ttl-mode`,`max-ttl-ttl-secs`].some(t=>e[t]!==void 0)){let t=[`max-ttl-mode`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --max_ttl-* flag is set`)}return!0})}const jp={command:`create`,describe:`Create a new Zero Trust Gateway location.`,builder:Ap,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway locations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/locations`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({client_default:e[`client-default`],dns_destination_ips_id:f(e[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:e[`ecs-support`],endpoints:{doh:{enabled:e[`endpoints-doh-enabled`],require_token:e[`endpoints-doh-require-token`]},dot:{enabled:e[`endpoints-dot-enabled`]},ipv4:{enabled:e[`endpoints-ipv4-enabled`]},ipv6:{enabled:e[`endpoints-ipv6-enabled`]}},max_ttl:{mode:f(e[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:e[`max-ttl-ttl-secs`]},name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.gateway.locations.create({...t,account_id:u})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await h(`name`,`Specify the location name.`));let p=d({client_default:e[`client-default`],dns_destination_ips_id:f(e[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:e[`ecs-support`],endpoints:{doh:{enabled:e[`endpoints-doh-enabled`],require_token:e[`endpoints-doh-require-token`]},dot:{enabled:e[`endpoints-dot-enabled`]},ipv4:{enabled:e[`endpoints-ipv4-enabled`]},ipv6:{enabled:e[`endpoints-ipv6-enabled`]}},max_ttl:{mode:f(e[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:e[`max-ttl-ttl-secs`]},name:f(e.name,`name`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.gateway.locations.create({...p,account_id:u})),{successLabel:`Created`})}};function Mp(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Np={command:`delete <location-id>`,describe:`Delete a configured Zero Trust Gateway location.`,builder:Mp,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway locations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/locations/${e[`location-id`]==null?`<location-id>`:encodeURIComponent(String(e[`location-id`]))}`,pathParams:{"location-id":String(e[`location-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.gateway.locations.delete({account_id:l,location_id:e[`location-id`]})),{successLabel:`Deleted`})}};function Pp(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fp={command:`get <location-id>`,describe:`Get a single Zero Trust Gateway location.`,builder:Pp,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway locations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/locations/${e[`location-id`]==null?`<location-id>`:encodeURIComponent(String(e[`location-id`]))}`,pathParams:{"location-id":String(e[`location-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.locations.get({account_id:l,location_id:e[`location-id`]})),{successLabel:`Loaded`})}};function Ip(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Lp={command:`list`,describe:`List Zero Trust Gateway locations for an account.`,builder:Ip,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway locations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/locations`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.locations.list({account_id:l})),{successLabel:`Loaded`})}};function Rp(e){return e.positional(`location-id`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`client-default`,{type:`boolean`,description:`Indicate whether this location is the default location.`}).option(`dns-destination-ips-id`,{type:`string`,description:`Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.`}).option(`ecs-support`,{type:`boolean`,description:`Indicate whether the location must resolve EDNS queries.`}).option(`endpoints-doh-enabled`,{type:`boolean`,description:`Indicate whether the DOH endpoint is enabled for this location.`}).option(`endpoints-doh-require-token`,{type:`boolean`,description:`Specify whether the DOH endpoint requires user identity authentication.`}).option(`endpoints-dot-enabled`,{type:`boolean`,description:`Indicate whether the DOT endpoint is enabled for this location.`}).option(`endpoints-ipv4-enabled`,{type:`boolean`,description:`Indicate whether the IPv4 endpoint is enabled for this location.`}).option(`endpoints-ipv6-enabled`,{type:`boolean`,description:`Indicate whether the IPV6 endpoint is enabled for this location.`}).option(`max-ttl-mode`,{type:`string`,description:"`inherit` uses the account `max_ttl_secs`. `override` uses this location's `ttl_secs`. `disabled` leaves returned TTLs unchanged.",choices:[`inherit`,`override`,`disabled`]}).option(`max-ttl-ttl-secs`,{type:`number`,description:"Location-specific cap on DNS response TTLs, in seconds. Required when `mode` is `override`. Must be omitted when `mode` is `inherit` or `disabled`."}).option(`name`,{type:`string`,description:`Specify the location name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`max-ttl-mode`,`max-ttl-ttl-secs`].some(t=>e[t]!==void 0)){let t=[`max-ttl-mode`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --max_ttl-* flag is set`)}return!0})}const zp={command:`update <location-id>`,describe:`Update a configured Zero Trust Gateway location.`,builder:Rp,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway locations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/locations/${e[`location-id`]==null?`<location-id>`:encodeURIComponent(String(e[`location-id`]))}`,pathParams:{"location-id":String(e[`location-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({client_default:e[`client-default`],dns_destination_ips_id:f(e[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:e[`ecs-support`],endpoints:{doh:{enabled:e[`endpoints-doh-enabled`],require_token:e[`endpoints-doh-require-token`]},dot:{enabled:e[`endpoints-dot-enabled`]},ipv4:{enabled:e[`endpoints-ipv4-enabled`]},ipv6:{enabled:e[`endpoints-ipv6-enabled`]}},max_ttl:{mode:f(e[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:e[`max-ttl-ttl-secs`]},name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.gateway.locations.update({...t,account_id:u,location_id:e[`location-id`]})),{successLabel:`Updated`});return}e.name===void 0&&(e.name=await h(`name`,`Specify the location name.`));let p=d({client_default:e[`client-default`],dns_destination_ips_id:f(e[`dns-destination-ips-id`],`dns-destination-ips-id`,`text`),ecs_support:e[`ecs-support`],endpoints:{doh:{enabled:e[`endpoints-doh-enabled`],require_token:e[`endpoints-doh-require-token`]},dot:{enabled:e[`endpoints-dot-enabled`]},ipv4:{enabled:e[`endpoints-ipv4-enabled`]},ipv6:{enabled:e[`endpoints-ipv6-enabled`]}},max_ttl:{mode:f(e[`max-ttl-mode`],`max-ttl-mode`,`text`),ttl_secs:e[`max-ttl-ttl-secs`]},name:f(e.name,`name`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.gateway.locations.update({...p,account_id:u,location_id:e[`location-id`]})),{successLabel:`Updated`})}},Bp={command:`locations`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(jp).command(Np).command(Fp).command(Lp).command(zp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Vp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Hp={command:`get`,describe:`Retrieve the current logging settings for the Zero Trust account.`,builder:Vp,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway logging get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/logging`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.logging.get({account_id:l})),{successLabel:`Loaded`})}};function Up(e){return e.option(`redact-pii`,{type:`boolean`,description:`Indicate whether to redact personally identifiable information from activity logging (PII fields include source IP, user email, user ID, device ID, URL, referrer, and user agent).`}).option(`settings-by-rule-type-dns-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-dns-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`settings-by-rule-type-http-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-http-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`settings-by-rule-type-l4-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`}).option(`settings-by-rule-type-l4-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wp={command:`update`,describe:`Update logging settings for the current Zero Trust account.`,builder:Up,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway logging update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/logging`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({redact_pii:e[`redact-pii`],settings_by_rule_type:{dns:{log_all:e[`settings-by-rule-type-dns-log-all`],log_blocks:e[`settings-by-rule-type-dns-log-blocks`]},http:{log_all:e[`settings-by-rule-type-http-log-all`],log_blocks:e[`settings-by-rule-type-http-log-blocks`]},l4:{log_all:e[`settings-by-rule-type-l4-log-all`],log_blocks:e[`settings-by-rule-type-l4-log-blocks`]}}}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.gateway.logging.update({body:t,account_id:u})),{successLabel:`Updated`});return}let f=d({redact_pii:e[`redact-pii`],settings_by_rule_type:{dns:{log_all:e[`settings-by-rule-type-dns-log-all`],log_blocks:e[`settings-by-rule-type-dns-log-blocks`]},http:{log_all:e[`settings-by-rule-type-http-log-all`],log_blocks:e[`settings-by-rule-type-http-log-blocks`]},l4:{log_all:e[`settings-by-rule-type-l4-log-all`],log_blocks:e[`settings-by-rule-type-l4-log-blocks`]}}});a(await s(`Updating`,async()=>r.zeroTrust.gateway.logging.update({body:f,account_id:u})),{successLabel:`Updated`})}},Gp={command:`logging`,describe:`Operations for gateway.logging`,builder:e=>e.command(Hp).command(Wp).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Kp(e){return e.option(`contents`,{type:`string`,description:`Actual contents of the PAC file`}).option(`description`,{type:`string`,description:`Detailed description of the PAC file.`}).option(`name`,{type:`string`,description:`Name of the PAC file.`}).option(`slug`,{type:`string`,description:`URL-friendly version of the PAC file name. If not provided, it will be auto-generated`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const qp={command:`create`,describe:`Create a new Zero Trust Gateway PAC file.`,builder:Kp,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway pacfiles create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/pacfiles`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({contents:f(e.contents,`contents`,`text`),description:f(e.description,`description`,`text`),name:f(e.name,`name`,`text`),slug:f(e.slug,`slug`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.gateway.pacfiles.create({...t,account_id:u})),{successLabel:`Created`});return}e.contents===void 0&&(e.contents=await h(`contents`,`Actual contents of the PAC file`)),e.name===void 0&&(e.name=await h(`name`,`Name of the PAC file.`));let p=d({contents:f(e.contents,`contents`,`text`),description:f(e.description,`description`,`text`),name:f(e.name,`name`,`text`),slug:f(e.slug,`slug`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.gateway.pacfiles.create({...p,account_id:u})),{successLabel:`Created`})}};function Jp(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Yp={command:`delete <pacfile-id>`,describe:`Delete a configured Zero Trust Gateway PAC file.`,builder:Jp,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway pacfiles delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/pacfiles/${e[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(e[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(e[`pacfile-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.gateway.pacfiles.delete({account_id:l,pacfile_id:e[`pacfile-id`]})),{successLabel:`Deleted`})}};function Xp(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Zp={command:`get <pacfile-id>`,describe:`Get a single Zero Trust Gateway PAC file.`,builder:Xp,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway pacfiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/pacfiles/${e[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(e[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(e[`pacfile-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.pacfiles.get({account_id:l,pacfile_id:e[`pacfile-id`]})),{successLabel:`Loaded`})}};function Qp(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $p={command:`list`,describe:`List all Zero Trust Gateway PAC files for an account.`,builder:Qp,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway pacfiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/pacfiles`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.pacfiles.list({account_id:l})),{successLabel:`Loaded`})}};function em(e){return e.positional(`pacfile-id`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`contents`,{type:`string`,description:`Actual contents of the PAC file`}).option(`description`,{type:`string`,description:`Detailed description of the PAC file.`}).option(`name`,{type:`string`,description:`Name of the PAC file.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const tm={command:`update <pacfile-id>`,describe:`Update a configured Zero Trust Gateway PAC file.`,builder:em,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway pacfiles update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/pacfiles/${e[`pacfile-id`]==null?`<pacfile-id>`:encodeURIComponent(String(e[`pacfile-id`]))}`,pathParams:{"pacfile-id":String(e[`pacfile-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({contents:f(e.contents,`contents`,`text`),description:f(e.description,`description`,`text`),name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.gateway.pacfiles.update({...t,account_id:u,pacfile_id:e[`pacfile-id`]})),{successLabel:`Updated`});return}e.contents===void 0&&(e.contents=await h(`contents`,`Actual contents of the PAC file`)),e.description===void 0&&(e.description=await h(`description`,`Detailed description of the PAC file.`)),e.name===void 0&&(e.name=await h(`name`,`Name of the PAC file.`));let p=d({contents:f(e.contents,`contents`,`text`),description:f(e.description,`description`,`text`),name:f(e.name,`name`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.gateway.pacfiles.update({...p,account_id:u,pacfile_id:e[`pacfile-id`]})),{successLabel:`Updated`})}},nm={command:`pacfiles`,describe:`Operations for gateway.pacfiles`,builder:e=>e.command(qp).command(Yp).command(Zp).command($p).command(tm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function rm(e){return e.option(`kind`,{type:`string`,description:`The proxy endpoint kind.`,choices:[`ip`,`identity`],default:`ip`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const im={command:`create`,describe:`Create a new Zero Trust Gateway proxy endpoint.`,builder:rm,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway proxy-endpoints create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/proxy_endpoints`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({kind:f(e.kind,`kind`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.gateway.proxyEndpoints.create({body:t,account_id:u})),{successLabel:`Created`});return}e.kind===`identity`&&e.kind===void 0&&(e.kind=await h(`kind`,`The proxy endpoint kind.`,{question:`Enter value for --kind`}));let p=d({kind:f(e.kind,`kind`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.gateway.proxyEndpoints.create({body:p,account_id:u})),{successLabel:`Created`})}};function am(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const om={command:`delete <proxy-endpoint-id>`,describe:`Delete a configured Zero Trust Gateway proxy endpoint.`,builder:am,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway proxy-endpoints delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/proxy_endpoints/${e[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(e[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(e[`proxy-endpoint-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.gateway.proxyEndpoints.delete({account_id:l,proxy_endpoint_id:e[`proxy-endpoint-id`]})),{successLabel:`Deleted`})}};function sm(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`ips`,{type:`string`,array:!0,description:`Specify the list of CIDRs to restrict ingress connections.`}).option(`name`,{type:`string`,description:`Specify the name of the proxy endpoint.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const cm={command:`edit <proxy-endpoint-id>`,describe:`Update a configured Zero Trust Gateway proxy endpoint.`,builder:sm,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway proxy-endpoints edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/proxy_endpoints/${e[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(e[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(e[`proxy-endpoint-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({ips:e.ips,name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.gateway.proxyEndpoints.edit({...t,account_id:u,proxy_endpoint_id:e[`proxy-endpoint-id`]})),{successLabel:`Updated`});return}let p=d({ips:e.ips,name:f(e.name,`name`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.gateway.proxyEndpoints.edit({...p,account_id:u,proxy_endpoint_id:e[`proxy-endpoint-id`]})),{successLabel:`Updated`})}};function lm(e){return e.positional(`proxy-endpoint-id`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const um={command:`get <proxy-endpoint-id>`,describe:`Get a single Zero Trust Gateway proxy endpoint.`,builder:lm,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway proxy-endpoints get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/proxy_endpoints/${e[`proxy-endpoint-id`]==null?`<proxy-endpoint-id>`:encodeURIComponent(String(e[`proxy-endpoint-id`]))}`,pathParams:{"proxy-endpoint-id":String(e[`proxy-endpoint-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.proxyEndpoints.get({account_id:l,proxy_endpoint_id:e[`proxy-endpoint-id`]})),{successLabel:`Loaded`})}};function dm(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fm={command:`list`,describe:`List all Zero Trust Gateway proxy endpoints for an account.`,builder:dm,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway proxy-endpoints list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/proxy_endpoints`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.proxyEndpoints.list({account_id:l})),{successLabel:`Loaded`})}},pm={command:`proxy-endpoints`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(im).command(om).command(cm).command(um).command(fm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function mm(e){return e.option(`action`,{type:`string`,description:"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",choices:[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`]}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`device-posture`,{type:`string`,description:`Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`,default:!1}).option(`expiration-duration`,{type:`number`,description:"Defines the default duration a policy active in minutes. Must set in order to use the `reset_expiration` endpoint on this rule."}).option(`filters`,{type:`string`,array:!0,description:`Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.`}).option(`identity`,{type:`string`,description:`Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`rule-settings-allow-child-bypass`,{type:`boolean`,description:`Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.`}).option(`rule-settings-audit-ssh-command-logging`,{type:`boolean`,description:`Enable SSH command logging.`}).option(`rule-settings-biso-admin-controls-copy`,{type:`string`,description:`Configure copy behavior. If set to remote_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dcp`,{type:`boolean`,description:'Set to false to enable copy-pasting. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dd`,{type:`boolean`,description:'Set to false to enable downloading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dk`,{type:`boolean`,description:'Set to false to enable keyboard usage. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-download`,{type:`string`,description:`Configure download behavior. When set to remote_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dp`,{type:`boolean`,description:'Set to false to enable printing. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-du`,{type:`boolean`,description:'Set to false to enable uploading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-keyboard`,{type:`string`,description:`Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-paste`,{type:`string`,description:`Configure paste behavior. If set to remote_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-printing`,{type:`string`,description:`Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-upload`,{type:`string`,description:`Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-version`,{type:`string`,description:`Indicate which version of the browser isolation controls should apply.`,choices:[`v1`,`v2`],default:`v1`}).option(`rule-settings-biso-admin-controls-wm-id`,{type:`string`,description:`Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser.`}).option(`rule-settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-block-page-enabled`,{type:`boolean`,description:"Enable the custom block page. Settable only for `dns` rules with action `block`."}).option(`rule-settings-block-reason`,{type:`string`,description:"Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`."}).option(`rule-settings-bypass-parent-rule`,{type:`boolean`,description:`Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.`}).option(`rule-settings-check-session-duration`,{type:`string`,description:`Sets the required session freshness threshold. The API returns a normalized version of this value.`}).option(`rule-settings-check-session-enforce`,{type:`boolean`,description:`Enable session enforcement.`}).option(`rule-settings-delete-headers`,{type:`string`,array:!0,description:"Remove headers from allowed requests by name. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes. Settable only for `http` rules with the action set to `allow`."}).option(`rule-settings-egress-ipv4`,{type:`string`,description:`Specify the IPv4 address to use for egress.`}).option(`rule-settings-egress-ipv4-fallback`,{type:`string`,description:`Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.`}).option(`rule-settings-egress-ipv6`,{type:`string`,description:`Specify the IPv6 range to use for egress.`}).option(`rule-settings-forensic-copy-enabled`,{type:`boolean`,description:`Enable sending the copy to storage.`}).option(`rule-settings-ignore-cname-category-matches`,{type:`boolean`,description:"Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-insecure-disable-dnssec-validation`,{type:`boolean`,description:"Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules."}).option(`rule-settings-ip-categories`,{type:`boolean`,description:"Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-ip-indicator-feeds`,{type:`boolean`,description:"Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-l4override-ip`,{type:`string`,description:`Defines the IPv4 or IPv6 address.`}).option(`rule-settings-l4override-port`,{type:`number`,description:`Defines a port number to use for TCP/UDP overrides.`}).option(`rule-settings-notification-settings-enabled`,{type:`boolean`,description:`Enable notification.`}).option(`rule-settings-notification-settings-include-context`,{type:`boolean`,description:`Indicates whether to pass the context information as query parameters.`}).option(`rule-settings-notification-settings-msg`,{type:`string`,description:`Customize the message shown in the notification.`}).option(`rule-settings-notification-settings-support-url`,{type:`string`,description:`Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.`}).option(`rule-settings-override-host`,{type:`string`,description:"Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-override-ips`,{type:`string`,array:!0,description:"Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-payload-log-enabled`,{type:`boolean`,description:`Enable DLP payload logging for this rule.`}).option(`rule-settings-quarantine-file-types`,{type:`string`,array:!0,description:`Specify the types of files to sandbox.`}).option(`rule-settings-redirect-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-redirect-preserve-path-and-query`,{type:`boolean`,description:`Specify whether to append the path and query parameters from the original request to target_uri.`}).option(`rule-settings-redirect-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-resolve-dns-internally-fallback`,{type:`string`,description:`Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.`,choices:[`none`,`public_dns`]}).option(`rule-settings-resolve-dns-internally-view-id`,{type:`string`,description:`Specify the internal DNS view identifier to pass to the internal DNS service.`}).option(`rule-settings-resolve-dns-through-cloudflare`,{type:`boolean`,description:"Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dns_resolver` rules."}).option(`rule-settings-untrusted-cert-action`,{type:`string`,description:`Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.`,choices:[`pass_through`,`block`,`error`]}).option(`schedule-fri`,{type:`string`,description:`Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-mon`,{type:`string`,description:`Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sat`,{type:`string`,description:`Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sun`,{type:`string`,description:`Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-thu`,{type:`string`,description:`Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-time-zone`,{type:`string`,description:`Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.`}).option(`schedule-tue`,{type:`string`,description:`Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-wed`,{type:`string`,description:`Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`traffic`,{type:`string`,description:`Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if(`rule-settings-allow-child-bypass.rule-settings-audit-ssh-command-logging.rule-settings-biso-admin-controls-copy.rule-settings-biso-admin-controls-dcp.rule-settings-biso-admin-controls-dd.rule-settings-biso-admin-controls-dk.rule-settings-biso-admin-controls-download.rule-settings-biso-admin-controls-dp.rule-settings-biso-admin-controls-du.rule-settings-biso-admin-controls-keyboard.rule-settings-biso-admin-controls-paste.rule-settings-biso-admin-controls-printing.rule-settings-biso-admin-controls-upload.rule-settings-biso-admin-controls-wm-id.rule-settings-block-page-include-context.rule-settings-block-page-target-uri.rule-settings-block-page-enabled.rule-settings-block-reason.rule-settings-bypass-parent-rule.rule-settings-check-session-duration.rule-settings-check-session-enforce.rule-settings-delete-headers.rule-settings-egress-ipv4.rule-settings-egress-ipv4-fallback.rule-settings-egress-ipv6.rule-settings-forensic-copy-enabled.rule-settings-ignore-cname-category-matches.rule-settings-insecure-disable-dnssec-validation.rule-settings-ip-categories.rule-settings-ip-indicator-feeds.rule-settings-l4override-ip.rule-settings-l4override-port.rule-settings-notification-settings-enabled.rule-settings-notification-settings-include-context.rule-settings-notification-settings-msg.rule-settings-notification-settings-support-url.rule-settings-override-host.rule-settings-override-ips.rule-settings-payload-log-enabled.rule-settings-quarantine-file-types.rule-settings-redirect-include-context.rule-settings-redirect-preserve-path-and-query.rule-settings-redirect-target-uri.rule-settings-resolve-dns-internally-fallback.rule-settings-resolve-dns-internally-view-id.rule-settings-resolve-dns-through-cloudflare.rule-settings-untrusted-cert-action`.split(`.`).some(t=>e[t]!==void 0)){let t=[`rule-settings-block-page-target-uri`,`rule-settings-redirect-target-uri`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --rule_settings-* flag is set`)}return!0})}const hm={command:`create`,describe:`Create a new Zero Trust Gateway rule.`,builder:mm,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/rules`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({action:f(e.action,`action`,`text`),description:f(e.description,`description`,`text`),device_posture:f(e[`device-posture`],`device-posture`,`text`),enabled:e.enabled,expiration:{duration:e[`expiration-duration`]},filters:e.filters,identity:f(e.identity,`identity`,`text`),name:f(e.name,`name`,`text`),precedence:e.precedence,rule_settings:{allow_child_bypass:e[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:e[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:f(e[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:e[`rule-settings-biso-admin-controls-dcp`],dd:e[`rule-settings-biso-admin-controls-dd`],dk:e[`rule-settings-biso-admin-controls-dk`],download:f(e[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:e[`rule-settings-biso-admin-controls-dp`],du:e[`rule-settings-biso-admin-controls-du`],keyboard:f(e[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:f(e[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:f(e[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:f(e[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:f(e[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:f(e[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:e[`rule-settings-block-page-include-context`],target_uri:f(e[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:e[`rule-settings-block-page-enabled`],block_reason:f(e[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:e[`rule-settings-bypass-parent-rule`],check_session:{duration:f(e[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:e[`rule-settings-check-session-enforce`]},delete_headers:e[`rule-settings-delete-headers`],egress:{ipv4:f(e[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:f(e[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:f(e[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:e[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:e[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:e[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:e[`rule-settings-ip-categories`],ip_indicator_feeds:e[`rule-settings-ip-indicator-feeds`],l4override:{ip:f(e[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:e[`rule-settings-l4override-port`]},notification_settings:{enabled:e[`rule-settings-notification-settings-enabled`],include_context:e[`rule-settings-notification-settings-include-context`],msg:f(e[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:f(e[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:f(e[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:e[`rule-settings-override-ips`],payload_log:{enabled:e[`rule-settings-payload-log-enabled`]},quarantine:{file_types:e[`rule-settings-quarantine-file-types`]},redirect:{include_context:e[`rule-settings-redirect-include-context`],preserve_path_and_query:e[`rule-settings-redirect-preserve-path-and-query`],target_uri:f(e[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:f(e[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:f(e[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:e[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:f(e[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:f(e[`schedule-fri`],`schedule-fri`,`text`),mon:f(e[`schedule-mon`],`schedule-mon`,`text`),sat:f(e[`schedule-sat`],`schedule-sat`,`text`),sun:f(e[`schedule-sun`],`schedule-sun`,`text`),thu:f(e[`schedule-thu`],`schedule-thu`,`text`),time_zone:f(e[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:f(e[`schedule-tue`],`schedule-tue`,`text`),wed:f(e[`schedule-wed`],`schedule-wed`,`text`)},traffic:f(e.traffic,`traffic`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.gateway.rules.create({...t,account_id:u})),{successLabel:`Created`});return}e.action===void 0&&(e.action=await m(`action`,"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`])),e.name===void 0&&(e.name=await h(`name`,`Specify the rule name.`));let p=d({action:f(e.action,`action`,`text`),description:f(e.description,`description`,`text`),device_posture:f(e[`device-posture`],`device-posture`,`text`),enabled:e.enabled,expiration:{duration:e[`expiration-duration`]},filters:e.filters,identity:f(e.identity,`identity`,`text`),name:f(e.name,`name`,`text`),precedence:e.precedence,rule_settings:{allow_child_bypass:e[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:e[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:f(e[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:e[`rule-settings-biso-admin-controls-dcp`],dd:e[`rule-settings-biso-admin-controls-dd`],dk:e[`rule-settings-biso-admin-controls-dk`],download:f(e[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:e[`rule-settings-biso-admin-controls-dp`],du:e[`rule-settings-biso-admin-controls-du`],keyboard:f(e[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:f(e[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:f(e[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:f(e[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:f(e[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:f(e[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:e[`rule-settings-block-page-include-context`],target_uri:f(e[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:e[`rule-settings-block-page-enabled`],block_reason:f(e[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:e[`rule-settings-bypass-parent-rule`],check_session:{duration:f(e[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:e[`rule-settings-check-session-enforce`]},delete_headers:e[`rule-settings-delete-headers`],egress:{ipv4:f(e[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:f(e[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:f(e[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:e[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:e[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:e[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:e[`rule-settings-ip-categories`],ip_indicator_feeds:e[`rule-settings-ip-indicator-feeds`],l4override:{ip:f(e[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:e[`rule-settings-l4override-port`]},notification_settings:{enabled:e[`rule-settings-notification-settings-enabled`],include_context:e[`rule-settings-notification-settings-include-context`],msg:f(e[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:f(e[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:f(e[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:e[`rule-settings-override-ips`],payload_log:{enabled:e[`rule-settings-payload-log-enabled`]},quarantine:{file_types:e[`rule-settings-quarantine-file-types`]},redirect:{include_context:e[`rule-settings-redirect-include-context`],preserve_path_and_query:e[`rule-settings-redirect-preserve-path-and-query`],target_uri:f(e[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:f(e[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:f(e[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:e[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:f(e[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:f(e[`schedule-fri`],`schedule-fri`,`text`),mon:f(e[`schedule-mon`],`schedule-mon`,`text`),sat:f(e[`schedule-sat`],`schedule-sat`,`text`),sun:f(e[`schedule-sun`],`schedule-sun`,`text`),thu:f(e[`schedule-thu`],`schedule-thu`,`text`),time_zone:f(e[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:f(e[`schedule-tue`],`schedule-tue`,`text`),wed:f(e[`schedule-wed`],`schedule-wed`,`text`)},traffic:f(e.traffic,`traffic`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.gateway.rules.create({...p,account_id:u})),{successLabel:`Created`})}};function gm(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const _m={command:`delete <rule-id>`,describe:`Delete a Zero Trust Gateway rule.`,builder:gm,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.gateway.rules.delete({account_id:l,rule_id:e[`rule-id`]})),{successLabel:`Deleted`})}};function vm(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ym={command:`get <rule-id>`,describe:`Get a single Zero Trust Gateway rule.`,builder:vm,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.rules.get({account_id:l,rule_id:e[`rule-id`]})),{successLabel:`Loaded`})}};function bm(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xm={command:`list-tenant`,describe:`List Zero Trust Gateway rules for the parent account of an account in the MSP configuration.`,builder:bm,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway rules list-tenant`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/rules/tenant`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.rules.listTenant({account_id:l})),{successLabel:`Loaded`})}};function Sm(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cm={command:`list`,describe:`List Zero Trust Gateway rules for an account.`,builder:Sm,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/rules`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.gateway.rules.list({account_id:l})),{successLabel:`Loaded`})}};function wm(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Tm={command:`reset-expiration <rule-id>`,describe:"Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and it has a default duration. The Zero Trust Gateway Rule must have values for both `expiration.expires_at` and `expiration.duration`.",builder:wm,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway rules reset-expiration`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}/reset_expiration`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Creating`,async()=>r.zeroTrust.gateway.rules.resetExpiration({account_id:l,rule_id:e[`rule-id`]})),{successLabel:`Created`})}};function Em(e){return e.positional(`rule-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`action`,{type:`string`,description:"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",choices:[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`]}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`device-posture`,{type:`string`,description:`Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`}).option(`expiration-duration`,{type:`number`,description:"Defines the default duration a policy active in minutes. Must set in order to use the `reset_expiration` endpoint on this rule."}).option(`filters`,{type:`string`,array:!0,description:`Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.`}).option(`identity`,{type:`string`,description:`Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`rule-settings-allow-child-bypass`,{type:`boolean`,description:`Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.`}).option(`rule-settings-audit-ssh-command-logging`,{type:`boolean`,description:`Enable SSH command logging.`}).option(`rule-settings-biso-admin-controls-copy`,{type:`string`,description:`Configure copy behavior. If set to remote_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dcp`,{type:`boolean`,description:'Set to false to enable copy-pasting. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dd`,{type:`boolean`,description:'Set to false to enable downloading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dk`,{type:`boolean`,description:'Set to false to enable keyboard usage. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-download`,{type:`string`,description:`Configure download behavior. When set to remote_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dp`,{type:`boolean`,description:'Set to false to enable printing. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-du`,{type:`boolean`,description:'Set to false to enable uploading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-keyboard`,{type:`string`,description:`Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-paste`,{type:`string`,description:`Configure paste behavior. If set to remote_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-printing`,{type:`string`,description:`Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-upload`,{type:`string`,description:`Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-version`,{type:`string`,description:`Indicate which version of the browser isolation controls should apply.`,choices:[`v1`,`v2`]}).option(`rule-settings-biso-admin-controls-wm-id`,{type:`string`,description:`Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser.`}).option(`rule-settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-block-page-enabled`,{type:`boolean`,description:"Enable the custom block page. Settable only for `dns` rules with action `block`."}).option(`rule-settings-block-reason`,{type:`string`,description:"Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`."}).option(`rule-settings-bypass-parent-rule`,{type:`boolean`,description:`Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.`}).option(`rule-settings-check-session-duration`,{type:`string`,description:`Sets the required session freshness threshold. The API returns a normalized version of this value.`}).option(`rule-settings-check-session-enforce`,{type:`boolean`,description:`Enable session enforcement.`}).option(`rule-settings-delete-headers`,{type:`string`,array:!0,description:"Remove headers from allowed requests by name. A maximum of 20 header operations (add + set + delete) is allowed per policy. Each header name may not exceed 256 bytes. Settable only for `http` rules with the action set to `allow`."}).option(`rule-settings-egress-ipv4`,{type:`string`,description:`Specify the IPv4 address to use for egress.`}).option(`rule-settings-egress-ipv4-fallback`,{type:`string`,description:`Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.`}).option(`rule-settings-egress-ipv6`,{type:`string`,description:`Specify the IPv6 range to use for egress.`}).option(`rule-settings-forensic-copy-enabled`,{type:`boolean`,description:`Enable sending the copy to storage.`}).option(`rule-settings-ignore-cname-category-matches`,{type:`boolean`,description:"Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-insecure-disable-dnssec-validation`,{type:`boolean`,description:"Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules."}).option(`rule-settings-ip-categories`,{type:`boolean`,description:"Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-ip-indicator-feeds`,{type:`boolean`,description:"Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-l4override-ip`,{type:`string`,description:`Defines the IPv4 or IPv6 address.`}).option(`rule-settings-l4override-port`,{type:`number`,description:`Defines a port number to use for TCP/UDP overrides.`}).option(`rule-settings-notification-settings-enabled`,{type:`boolean`,description:`Enable notification.`}).option(`rule-settings-notification-settings-include-context`,{type:`boolean`,description:`Indicates whether to pass the context information as query parameters.`}).option(`rule-settings-notification-settings-msg`,{type:`string`,description:`Customize the message shown in the notification.`}).option(`rule-settings-notification-settings-support-url`,{type:`string`,description:`Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.`}).option(`rule-settings-override-host`,{type:`string`,description:"Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-override-ips`,{type:`string`,array:!0,description:"Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-payload-log-enabled`,{type:`boolean`,description:`Enable DLP payload logging for this rule.`}).option(`rule-settings-quarantine-file-types`,{type:`string`,array:!0,description:`Specify the types of files to sandbox.`}).option(`rule-settings-redirect-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-redirect-preserve-path-and-query`,{type:`boolean`,description:`Specify whether to append the path and query parameters from the original request to target_uri.`}).option(`rule-settings-redirect-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-resolve-dns-internally-fallback`,{type:`string`,description:`Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.`,choices:[`none`,`public_dns`]}).option(`rule-settings-resolve-dns-internally-view-id`,{type:`string`,description:`Specify the internal DNS view identifier to pass to the internal DNS service.`}).option(`rule-settings-resolve-dns-through-cloudflare`,{type:`boolean`,description:"Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dns_resolver` rules."}).option(`rule-settings-untrusted-cert-action`,{type:`string`,description:`Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.`,choices:[`pass_through`,`block`,`error`]}).option(`schedule-fri`,{type:`string`,description:`Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-mon`,{type:`string`,description:`Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sat`,{type:`string`,description:`Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sun`,{type:`string`,description:`Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-thu`,{type:`string`,description:`Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-time-zone`,{type:`string`,description:`Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.`}).option(`schedule-tue`,{type:`string`,description:`Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-wed`,{type:`string`,description:`Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`traffic`,{type:`string`,description:`Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if(`rule-settings-allow-child-bypass.rule-settings-audit-ssh-command-logging.rule-settings-biso-admin-controls-copy.rule-settings-biso-admin-controls-dcp.rule-settings-biso-admin-controls-dd.rule-settings-biso-admin-controls-dk.rule-settings-biso-admin-controls-download.rule-settings-biso-admin-controls-dp.rule-settings-biso-admin-controls-du.rule-settings-biso-admin-controls-keyboard.rule-settings-biso-admin-controls-paste.rule-settings-biso-admin-controls-printing.rule-settings-biso-admin-controls-upload.rule-settings-biso-admin-controls-wm-id.rule-settings-block-page-include-context.rule-settings-block-page-target-uri.rule-settings-block-page-enabled.rule-settings-block-reason.rule-settings-bypass-parent-rule.rule-settings-check-session-duration.rule-settings-check-session-enforce.rule-settings-delete-headers.rule-settings-egress-ipv4.rule-settings-egress-ipv4-fallback.rule-settings-egress-ipv6.rule-settings-forensic-copy-enabled.rule-settings-ignore-cname-category-matches.rule-settings-insecure-disable-dnssec-validation.rule-settings-ip-categories.rule-settings-ip-indicator-feeds.rule-settings-l4override-ip.rule-settings-l4override-port.rule-settings-notification-settings-enabled.rule-settings-notification-settings-include-context.rule-settings-notification-settings-msg.rule-settings-notification-settings-support-url.rule-settings-override-host.rule-settings-override-ips.rule-settings-payload-log-enabled.rule-settings-quarantine-file-types.rule-settings-redirect-include-context.rule-settings-redirect-preserve-path-and-query.rule-settings-redirect-target-uri.rule-settings-resolve-dns-internally-fallback.rule-settings-resolve-dns-internally-view-id.rule-settings-resolve-dns-through-cloudflare.rule-settings-untrusted-cert-action`.split(`.`).some(t=>e[t]!==void 0)){let t=[`rule-settings-block-page-target-uri`,`rule-settings-redirect-target-uri`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --rule_settings-* flag is set`)}return!0})}const Dm={command:`update <rule-id>`,describe:`Update a configured Zero Trust Gateway rule.`,builder:Em,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust gateway rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/gateway/rules/${e[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(e[`rule-id`]))}`,pathParams:{"rule-id":String(e[`rule-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({action:f(e.action,`action`,`text`),description:f(e.description,`description`,`text`),device_posture:f(e[`device-posture`],`device-posture`,`text`),enabled:e.enabled,expiration:{duration:e[`expiration-duration`]},filters:e.filters,identity:f(e.identity,`identity`,`text`),name:f(e.name,`name`,`text`),precedence:e.precedence,rule_settings:{allow_child_bypass:e[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:e[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:f(e[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:e[`rule-settings-biso-admin-controls-dcp`],dd:e[`rule-settings-biso-admin-controls-dd`],dk:e[`rule-settings-biso-admin-controls-dk`],download:f(e[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:e[`rule-settings-biso-admin-controls-dp`],du:e[`rule-settings-biso-admin-controls-du`],keyboard:f(e[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:f(e[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:f(e[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:f(e[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:f(e[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:f(e[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:e[`rule-settings-block-page-include-context`],target_uri:f(e[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:e[`rule-settings-block-page-enabled`],block_reason:f(e[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:e[`rule-settings-bypass-parent-rule`],check_session:{duration:f(e[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:e[`rule-settings-check-session-enforce`]},delete_headers:e[`rule-settings-delete-headers`],egress:{ipv4:f(e[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:f(e[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:f(e[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:e[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:e[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:e[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:e[`rule-settings-ip-categories`],ip_indicator_feeds:e[`rule-settings-ip-indicator-feeds`],l4override:{ip:f(e[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:e[`rule-settings-l4override-port`]},notification_settings:{enabled:e[`rule-settings-notification-settings-enabled`],include_context:e[`rule-settings-notification-settings-include-context`],msg:f(e[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:f(e[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:f(e[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:e[`rule-settings-override-ips`],payload_log:{enabled:e[`rule-settings-payload-log-enabled`]},quarantine:{file_types:e[`rule-settings-quarantine-file-types`]},redirect:{include_context:e[`rule-settings-redirect-include-context`],preserve_path_and_query:e[`rule-settings-redirect-preserve-path-and-query`],target_uri:f(e[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:f(e[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:f(e[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:e[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:f(e[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:f(e[`schedule-fri`],`schedule-fri`,`text`),mon:f(e[`schedule-mon`],`schedule-mon`,`text`),sat:f(e[`schedule-sat`],`schedule-sat`,`text`),sun:f(e[`schedule-sun`],`schedule-sun`,`text`),thu:f(e[`schedule-thu`],`schedule-thu`,`text`),time_zone:f(e[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:f(e[`schedule-tue`],`schedule-tue`,`text`),wed:f(e[`schedule-wed`],`schedule-wed`,`text`)},traffic:f(e.traffic,`traffic`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.gateway.rules.update({...t,account_id:u,rule_id:e[`rule-id`]})),{successLabel:`Updated`});return}e.action===void 0&&(e.action=await m(`action`,"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`])),e.name===void 0&&(e.name=await h(`name`,`Specify the rule name.`));let p=d({action:f(e.action,`action`,`text`),description:f(e.description,`description`,`text`),device_posture:f(e[`device-posture`],`device-posture`,`text`),enabled:e.enabled,expiration:{duration:e[`expiration-duration`]},filters:e.filters,identity:f(e.identity,`identity`,`text`),name:f(e.name,`name`,`text`),precedence:e.precedence,rule_settings:{allow_child_bypass:e[`rule-settings-allow-child-bypass`],audit_ssh:{command_logging:e[`rule-settings-audit-ssh-command-logging`]},biso_admin_controls:{copy:f(e[`rule-settings-biso-admin-controls-copy`],`rule-settings-biso-admin-controls-copy`,`text`),dcp:e[`rule-settings-biso-admin-controls-dcp`],dd:e[`rule-settings-biso-admin-controls-dd`],dk:e[`rule-settings-biso-admin-controls-dk`],download:f(e[`rule-settings-biso-admin-controls-download`],`rule-settings-biso-admin-controls-download`,`text`),dp:e[`rule-settings-biso-admin-controls-dp`],du:e[`rule-settings-biso-admin-controls-du`],keyboard:f(e[`rule-settings-biso-admin-controls-keyboard`],`rule-settings-biso-admin-controls-keyboard`,`text`),paste:f(e[`rule-settings-biso-admin-controls-paste`],`rule-settings-biso-admin-controls-paste`,`text`),printing:f(e[`rule-settings-biso-admin-controls-printing`],`rule-settings-biso-admin-controls-printing`,`text`),upload:f(e[`rule-settings-biso-admin-controls-upload`],`rule-settings-biso-admin-controls-upload`,`text`),version:f(e[`rule-settings-biso-admin-controls-version`],`rule-settings-biso-admin-controls-version`,`text`),wm_id:f(e[`rule-settings-biso-admin-controls-wm-id`],`rule-settings-biso-admin-controls-wm-id`,`text`)},block_page:{include_context:e[`rule-settings-block-page-include-context`],target_uri:f(e[`rule-settings-block-page-target-uri`],`rule-settings-block-page-target-uri`,`text`)},block_page_enabled:e[`rule-settings-block-page-enabled`],block_reason:f(e[`rule-settings-block-reason`],`rule-settings-block-reason`,`text`),bypass_parent_rule:e[`rule-settings-bypass-parent-rule`],check_session:{duration:f(e[`rule-settings-check-session-duration`],`rule-settings-check-session-duration`,`text`),enforce:e[`rule-settings-check-session-enforce`]},delete_headers:e[`rule-settings-delete-headers`],egress:{ipv4:f(e[`rule-settings-egress-ipv4`],`rule-settings-egress-ipv4`,`text`),ipv4_fallback:f(e[`rule-settings-egress-ipv4-fallback`],`rule-settings-egress-ipv4-fallback`,`text`),ipv6:f(e[`rule-settings-egress-ipv6`],`rule-settings-egress-ipv6`,`text`)},forensic_copy:{enabled:e[`rule-settings-forensic-copy-enabled`]},ignore_cname_category_matches:e[`rule-settings-ignore-cname-category-matches`],insecure_disable_dnssec_validation:e[`rule-settings-insecure-disable-dnssec-validation`],ip_categories:e[`rule-settings-ip-categories`],ip_indicator_feeds:e[`rule-settings-ip-indicator-feeds`],l4override:{ip:f(e[`rule-settings-l4override-ip`],`rule-settings-l4override-ip`,`text`),port:e[`rule-settings-l4override-port`]},notification_settings:{enabled:e[`rule-settings-notification-settings-enabled`],include_context:e[`rule-settings-notification-settings-include-context`],msg:f(e[`rule-settings-notification-settings-msg`],`rule-settings-notification-settings-msg`,`text`),support_url:f(e[`rule-settings-notification-settings-support-url`],`rule-settings-notification-settings-support-url`,`text`)},override_host:f(e[`rule-settings-override-host`],`rule-settings-override-host`,`text`),override_ips:e[`rule-settings-override-ips`],payload_log:{enabled:e[`rule-settings-payload-log-enabled`]},quarantine:{file_types:e[`rule-settings-quarantine-file-types`]},redirect:{include_context:e[`rule-settings-redirect-include-context`],preserve_path_and_query:e[`rule-settings-redirect-preserve-path-and-query`],target_uri:f(e[`rule-settings-redirect-target-uri`],`rule-settings-redirect-target-uri`,`text`)},resolve_dns_internally:{fallback:f(e[`rule-settings-resolve-dns-internally-fallback`],`rule-settings-resolve-dns-internally-fallback`,`text`),view_id:f(e[`rule-settings-resolve-dns-internally-view-id`],`rule-settings-resolve-dns-internally-view-id`,`text`)},resolve_dns_through_cloudflare:e[`rule-settings-resolve-dns-through-cloudflare`],untrusted_cert:{action:f(e[`rule-settings-untrusted-cert-action`],`rule-settings-untrusted-cert-action`,`text`)}},schedule:{fri:f(e[`schedule-fri`],`schedule-fri`,`text`),mon:f(e[`schedule-mon`],`schedule-mon`,`text`),sat:f(e[`schedule-sat`],`schedule-sat`,`text`),sun:f(e[`schedule-sun`],`schedule-sun`,`text`),thu:f(e[`schedule-thu`],`schedule-thu`,`text`),time_zone:f(e[`schedule-time-zone`],`schedule-time-zone`,`text`),tue:f(e[`schedule-tue`],`schedule-tue`,`text`),wed:f(e[`schedule-wed`],`schedule-wed`,`text`)},traffic:f(e.traffic,`traffic`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.gateway.rules.update({...p,account_id:u,rule_id:e[`rule-id`]})),{successLabel:`Updated`})}},Om={command:`rules`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(hm).command(_m).command(ym).command(Cm).command(xm).command(Tm).command(Dm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},km={command:`gateway`,describe:`Operations for gateway`,builder:e=>e.command(dp).command(pp).command(Af).command(Lf).command(Bf).command($f).command(lp).command(kp).command(Bp).command(Gp).command(nm).command(pm).command(Om).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Am(e){return e.option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const jm={command:`create`,describe:`Creates a new Access group.`,builder:Am,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/groups`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?d({name:f(t.name,`name`,`text`)}):l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=l(t.body);a(await s(`Creating`,async()=>n.zeroTrust.groups.create({...e,zone_id:r})),{successLabel:`Created`});return}t.name===void 0&&(t.name=await h(`name`,`The name of the Access group.`));let c=d({name:f(t.name,`name`,`text`)});a(await s(`Creating`,async()=>n.zeroTrust.groups.create({...c,zone_id:r})),{successLabel:`Created`})}};function Mm(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Nm={command:`delete <group-id>`,describe:`Deletes an Access group.`,builder:Mm,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/groups/${t[`group-id`]==null?`<group-id>`:encodeURIComponent(String(t[`group-id`]))}`,pathParams:{"group-id":String(t[`group-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,!await g({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>n.zeroTrust.groups.delete({zone_id:r,group_id:t[`group-id`]})),{successLabel:`Deleted`})}};function Pm(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fm={command:`get <group-id>`,describe:`Fetches a single Access group.`,builder:Pm,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/groups/${t[`group-id`]==null?`<group-id>`:encodeURIComponent(String(t[`group-id`]))}`,pathParams:{"group-id":String(t[`group-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.groups.get({zone_id:r,group_id:t[`group-id`]})),{successLabel:`Loaded`})}};function Im(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Lm={command:`list`,describe:`Lists all Access groups.`,builder:Im,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/groups`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.groups.list({zone_id:r})),{successLabel:`Loaded`})}};function Rm(e){return e.positional(`group-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const zm={command:`update <group-id>`,describe:`Updates a configured Access group.`,builder:Rm,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/groups/${t[`group-id`]==null?`<group-id>`:encodeURIComponent(String(t[`group-id`]))}`,pathParams:{"group-id":String(t[`group-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?d({name:f(t.name,`name`,`text`)}):l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=l(t.body);a(await s(`Updating`,async()=>n.zeroTrust.groups.update({...e,zone_id:r,group_id:t[`group-id`]})),{successLabel:`Updated`});return}t.name===void 0&&(t.name=await h(`name`,`The name of the Access group.`));let c=d({name:f(t.name,`name`,`text`)});a(await s(`Updating`,async()=>n.zeroTrust.groups.update({...c,zone_id:r,group_id:t[`group-id`]})),{successLabel:`Updated`})}},Bm={command:`groups`,describe:`Operations for groups`,builder:e=>e.command(jm).command(Nm).command(Fm).command(Lm).command(zm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Vm(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Hm={command:`create`,describe:`Adds a new identity provider to Access.`,builder:Vm,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust identity-providers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/identity_providers`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.identityProviders.create({body:t,account_id:u})),{successLabel:`Created`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Um(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Wm={command:`delete <identity-provider-id>`,describe:`Deletes an identity provider from Access.`,builder:Um,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust identity-providers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.identityProviders.delete({account_id:l,identity_provider_id:e[`identity-provider-id`]})),{successLabel:`Deleted`})}};function Gm(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Km={command:`get <identity-provider-id>`,describe:`Fetches a configured identity provider.`,builder:Gm,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust identity-providers get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.identityProviders.get({account_id:l,identity_provider_id:e[`identity-provider-id`]})),{successLabel:`Loaded`})}};function qm(e){return e.option(`scim-enabled`,{type:`string`,description:`Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jm={command:`list`,describe:`Lists all configured identity providers.`,builder:qm,handler:async e=>{let r={scim_enabled:e[`scim-enabled`],page:e.page,per_page:e[`per-page`]};if(e.dryRun){o({command:`cf zero-trust identity-providers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/identity_providers`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.identityProviders.list({account_id:u,...r})),{successLabel:`Loaded`})}};function Ym(e){return e.option(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`cf-resource-id`,{type:`string`,description:'The unique Cloudflare-generated Id of the SCIM Group resource; also known as the "Id".\nPass once for a single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to look up multiple groups in one request,\nup to 50 values. Mutually exclusive with `idp_resource_id`, `name`,\n`search_contains`, and `search_starts_with`.'}).option(`idp-resource-id`,{type:`string`,description:'The IdP-generated Id of the SCIM Group resource; also known as the "external Id".\nPass once for a single lookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to look up multiple groups in one request,\nup to 50 values. Mutually exclusive with `cf_resource_id`, `name`,\n`search_contains`, and `search_starts_with`.'}).option(`name`,{type:`string`,description:`The display name of the SCIM Group resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xm={command:`list`,describe:`Lists SCIM Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:Ym,handler:async e=>{let r={cf_resource_id:e[`cf-resource-id`],idp_resource_id:e[`idp-resource-id`],name:e.name,page:e.page,per_page:e[`per-page`]};if(e.dryRun){o({command:`cf zero-trust identity-providers scim groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}/scim/groups`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.identityProviders.scim.groups.list({account_id:u,identity_provider_id:e[`identity-provider-id`],...r})),{successLabel:`Loaded`})}},Zm={command:`groups`,describe:`Operations for identity-providers.scim.groups`,builder:e=>e.command(Xm).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qm(e){return e.option(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`cf-resource-id`,{type:`string`,description:'The unique Cloudflare-generated Id of the SCIM User resource; also known as the "Id".\nPass once for a single lookup (`?cf_resource_id=A`) or repeat the parameter\n(`?cf_resource_id=A&cf_resource_id=B`) to look up multiple users in one request,\nup to 50 values. Mutually exclusive with `idp_resource_id`, `username`, `email`,\n`name`, `search_contains`, and `search_starts_with`.'}).option(`idp-resource-id`,{type:`string`,description:'The IdP-generated Id of the SCIM User resource; also known as the "external Id".\nPass once for a single lookup (`?idp_resource_id=A`) or repeat the parameter\n(`?idp_resource_id=A&idp_resource_id=B`) to look up multiple users in one request,\nup to 50 values. Mutually exclusive with `cf_resource_id`, `username`, `email`,\n`name`, `search_contains`, and `search_starts_with`.'}).option(`username`,{type:`string`,description:`The username of the SCIM User resource.`}).option(`email`,{type:`string`,description:`The email address of the SCIM User resource.`}).option(`name`,{type:`string`,description:`The name of the SCIM User resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $m={command:`list`,describe:`Lists SCIM User resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:Qm,handler:async e=>{let r={cf_resource_id:e[`cf-resource-id`],idp_resource_id:e[`idp-resource-id`],username:e.username,email:e.email,name:e.name,page:e.page,per_page:e[`per-page`]};if(e.dryRun){o({command:`cf zero-trust identity-providers scim users list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}/scim/users`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.identityProviders.scim.users.list({account_id:u,identity_provider_id:e[`identity-provider-id`],...r})),{successLabel:`Loaded`})}},eh={command:`users`,describe:`Operations for identity-providers.scim.users`,builder:e=>e.command($m).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},th={command:`scim`,describe:`Operations for identity-providers.scim`,builder:e=>e.command(Zm).command(eh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function nh(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const rh={command:`update <identity-provider-id>`,describe:`Updates a configured identity provider.`,builder:nh,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust identity-providers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/identity_providers/${e[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(e[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(e[`identity-provider-id`]??``)},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.identityProviders.update({body:t,account_id:u,identity_provider_id:e[`identity-provider-id`]})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},ih={command:`identity-providers`,describe:`Operations for identity-providers`,builder:e=>e.command(Hm).command(Wm).command(Km).command(Jm).command(rh).command(th).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ah(e){return e.option(`comment`,{type:`string`,description:`An optional description of the hostname route.`}).option(`hostname`,{type:`string`,description:`The hostname of the route.`}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const oh={command:`create`,describe:`Create a hostname route.`,builder:ah,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks hostname-routes create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zerotrust/routes/hostname`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({comment:f(e.comment,`comment`,`text`),hostname:f(e.hostname,`hostname`,`text`),tunnel_id:f(e[`tunnel-id`],`tunnel-id`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.networks.hostnameRoutes.create({...t,account_id:u})),{successLabel:`Created`});return}let p=d({comment:f(e.comment,`comment`,`text`),hostname:f(e.hostname,`hostname`,`text`),tunnel_id:f(e[`tunnel-id`],`tunnel-id`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.networks.hostnameRoutes.create({...p,account_id:u})),{successLabel:`Created`})}};function sh(e){return e.positional(`hostname-route-id`,{type:`string`,description:`The hostname route ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ch={command:`delete <hostname-route-id>`,describe:`Delete a hostname route.`,builder:sh,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks hostname-routes delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zerotrust/routes/hostname/${e[`hostname-route-id`]==null?`<hostname-route-id>`:encodeURIComponent(String(e[`hostname-route-id`]))}`,pathParams:{"hostname-route-id":String(e[`hostname-route-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.networks.hostnameRoutes.delete({account_id:l,hostname_route_id:e[`hostname-route-id`]})),{successLabel:`Deleted`})}};function lh(e){return e.positional(`hostname-route-id`,{type:`string`,description:`The hostname route ID.`,demandOption:!0}).option(`comment`,{type:`string`,description:`An optional description of the hostname route.`}).option(`hostname`,{type:`string`,description:`The hostname of the route.`}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const uh={command:`edit <hostname-route-id>`,describe:`Updates a hostname route.`,builder:lh,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks hostname-routes edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zerotrust/routes/hostname/${e[`hostname-route-id`]==null?`<hostname-route-id>`:encodeURIComponent(String(e[`hostname-route-id`]))}`,pathParams:{"hostname-route-id":String(e[`hostname-route-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({comment:f(e.comment,`comment`,`text`),hostname:f(e.hostname,`hostname`,`text`),tunnel_id:f(e[`tunnel-id`],`tunnel-id`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.networks.hostnameRoutes.edit({...t,account_id:u,hostname_route_id:e[`hostname-route-id`]})),{successLabel:`Updated`});return}let p=d({comment:f(e.comment,`comment`,`text`),hostname:f(e.hostname,`hostname`,`text`),tunnel_id:f(e[`tunnel-id`],`tunnel-id`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.networks.hostnameRoutes.edit({...p,account_id:u,hostname_route_id:e[`hostname-route-id`]})),{successLabel:`Updated`})}};function dh(e){return e.positional(`hostname-route-id`,{type:`string`,description:`The hostname route ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fh={command:`get <hostname-route-id>`,describe:`Get a hostname route.`,builder:dh,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks hostname-routes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zerotrust/routes/hostname/${e[`hostname-route-id`]==null?`<hostname-route-id>`:encodeURIComponent(String(e[`hostname-route-id`]))}`,pathParams:{"hostname-route-id":String(e[`hostname-route-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.networks.hostnameRoutes.get({account_id:l,hostname_route_id:e[`hostname-route-id`]})),{successLabel:`Loaded`})}};function ph(e){return e.option(`id`,{type:`string`,description:`The hostname route ID.`}).option(`hostname`,{type:`string`,description:`If set, only list hostname routes that contain a substring of the given value, the filter is case-insensitive.`}).option(`tunnel-id`,{type:`string`,description:`If set, only list hostname routes that point to a specific tunnel.`}).option(`comment`,{type:`string`,description:`If set, only list hostname routes with the given comment.`}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only return deleted hostname routes. If `false`, exclude deleted hostname routes."}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const mh={command:`list`,describe:`Lists and filters hostname routes in an account.`,builder:ph,handler:async e=>{let r={id:e.id,hostname:e.hostname,tunnel_id:e[`tunnel-id`],comment:e.comment,existed_at:e[`existed-at`],is_deleted:e[`is-deleted`],per_page:e[`per-page`],page:e.page};if(e.dryRun){o({command:`cf zero-trust networks hostname-routes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zerotrust/routes/hostname`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.networks.hostnameRoutes.list({account_id:u,...r})),{successLabel:`Loaded`})}},hh={command:`hostname-routes`,describe:`Operations for networks.hostname-routes`,builder:e=>e.command(oh).command(ch).command(uh).command(fh).command(mh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function gh(e){return e.option(`comment`,{type:`string`,description:`Optional remark describing the route.`,default:``}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range connected by the route, in CIDR notation.`}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _h={command:`create`,describe:`Routes a private network through a Cloudflare Tunnel.`,builder:gh,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks routes create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/teamnet/routes`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({comment:f(e.comment,`comment`,`text`),network:f(e.network,`network`,`text`),virtual_network_id:f(e[`virtual-network-id`],`virtual-network-id`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.networks.routes.create({...t,account_id:u})),{successLabel:`Created`});return}e.network===void 0&&(e.network=await h(`network`,`The private IPv4 or IPv6 range connected by the route, in CIDR notation.`));let p=d({comment:f(e.comment,`comment`,`text`),network:f(e.network,`network`,`text`),virtual_network_id:f(e[`virtual-network-id`],`virtual-network-id`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.networks.routes.create({...p,account_id:u})),{successLabel:`Created`})}};function vh(e){return e.positional(`route-id`,{type:`string`,description:`UUID of the route.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const yh={command:`delete <route-id>`,describe:`Deletes a private network route from an account.`,builder:vh,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks routes delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/teamnet/routes/${e[`route-id`]==null?`<route-id>`:encodeURIComponent(String(e[`route-id`]))}`,pathParams:{"route-id":String(e[`route-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.networks.routes.delete({account_id:l,route_id:e[`route-id`]})),{successLabel:`Deleted`})}};function bh(e){return e.positional(`route-id`,{type:`string`,description:`UUID of the route.`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the route.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range connected by the route, in CIDR notation.`}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xh={command:`edit <route-id>`,describe:`Updates an existing private network route in an account. The fields that are meant to be updated should be provided in the body of the request.`,builder:bh,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks routes edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/teamnet/routes/${e[`route-id`]==null?`<route-id>`:encodeURIComponent(String(e[`route-id`]))}`,pathParams:{"route-id":String(e[`route-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({comment:f(e.comment,`comment`,`text`),network:f(e.network,`network`,`text`),virtual_network_id:f(e[`virtual-network-id`],`virtual-network-id`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.networks.routes.edit({...t,account_id:u,route_id:e[`route-id`]})),{successLabel:`Updated`});return}let p=d({comment:f(e.comment,`comment`,`text`),network:f(e.network,`network`,`text`),virtual_network_id:f(e[`virtual-network-id`],`virtual-network-id`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.networks.routes.edit({...p,account_id:u,route_id:e[`route-id`]})),{successLabel:`Updated`})}};function Sh(e){return e.positional(`route-id`,{type:`string`,description:`UUID of the route.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ch={command:`get <route-id>`,describe:`Get a private network route in an account.`,builder:Sh,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks routes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/teamnet/routes/${e[`route-id`]==null?`<route-id>`:encodeURIComponent(String(e[`route-id`]))}`,pathParams:{"route-id":String(e[`route-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.networks.routes.get({account_id:l,route_id:e[`route-id`]})),{successLabel:`Loaded`})}};function wh(e){return e.positional(`ip`,{type:`string`,description:`Ip`,demandOption:!0}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`default-virtual-network-fallback`,{type:`boolean`,description:`When the virtual_network_id parameter is not provided the request filter will default search routes that are in the default virtual network for the account. If this parameter is set to false, the search will include routes that do not have a virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Th={command:`get <ip>`,describe:`Fetches routes that contain the given IP address.`,builder:wh,handler:async e=>{let r={virtual_network_id:e[`virtual-network-id`],default_virtual_network_fallback:e[`default-virtual-network-fallback`]};if(e.dryRun){o({command:`cf zero-trust networks routes ips get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/teamnet/routes/ip/${e.ip==null?`<ip>`:encodeURIComponent(String(e.ip))}`,pathParams:{ip:String(e.ip??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.networks.routes.ips.get({account_id:u,ip:e.ip,...r})),{successLabel:`Loaded`})}},Eh={command:`ips`,describe:`Operations for networks.routes.ips`,builder:e=>e.command(Th).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Dh(e){return e.option(`comment`,{type:`string`,description:`Optional remark describing the route.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted routes. If `false`, exclude deleted routes. If empty, all routes will be included."}).option(`network-subset`,{type:`string`,description:`If set, only list routes that are contained within this IP range.`}).option(`network-superset`,{type:`string`,description:`If set, only list routes that contain this IP range.`}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`route-id`,{type:`string`,description:`UUID of the route.`}).option(`tun-types`,{type:`string`,description:`The types of tunnels to filter by, separated by commas.`}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Oh={command:`list`,describe:`Lists and filters private network routes in an account.`,builder:_(Dh),handler:async e=>{let r={comment:e.comment,is_deleted:e[`is-deleted`],network_subset:e[`network-subset`],network_superset:e[`network-superset`],existed_at:e[`existed-at`],tunnel_id:e[`tunnel-id`],route_id:e[`route-id`],tun_types:e[`tun-types`],virtual_network_id:e[`virtual-network-id`],per_page:e[`per-page`],page:e.page};if(e.dryRun){o({command:`cf zero-trust networks routes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/teamnet/routes`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.networks.routes.list({account_id:u,...r})),{successLabel:`Loaded`})}};function kh(e){return e.positional(`ip-network-encoded`,{type:`string`,description:`IP/CIDR range in URL-encoded format`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the route.`,default:``}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ah={command:`create <ip-network-encoded>`,describe:"Routes a private network through a Cloudflare Tunnel. The CIDR in `ip_network_encoded` must be written in URL-encoded format.",builder:kh,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks routes networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/teamnet/routes/network/${e[`ip-network-encoded`]==null?`<ip-network-encoded>`:encodeURIComponent(String(e[`ip-network-encoded`]))}`,pathParams:{"ip-network-encoded":String(e[`ip-network-encoded`]??``)},bodyKind:`json`,body:e.body===void 0?d({comment:f(e.comment,`comment`,`text`),virtual_network_id:f(e[`virtual-network-id`],`virtual-network-id`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.networks.routes.networks.create({...t,account_id:u,ip_network_encoded:e[`ip-network-encoded`]})),{successLabel:`Created`});return}let p=d({comment:f(e.comment,`comment`,`text`),virtual_network_id:f(e[`virtual-network-id`],`virtual-network-id`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.networks.routes.networks.create({...p,account_id:u,ip_network_encoded:e[`ip-network-encoded`]})),{successLabel:`Created`})}};function jh(e){return e.positional(`ip-network-encoded`,{type:`string`,description:`IP/CIDR range in URL-encoded format`,demandOption:!0}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`tun-type`,{type:`string`,description:`The type of tunnel.`,choices:[`cfd_tunnel`,`warp_connector`,`warp`,`magic`,`ip_sec`,`gre`,`cni`]}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Mh={command:`delete <ip-network-encoded>`,describe:"Deletes a private network route from an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format. If no virtual_network_id is provided it will delete the route from the default vnet. If no tun_type is provided it will fetch the type from the tunnel_id or if that is missing it will assume Cloudflare Tunnel as default. If tunnel_id is provided it will delete the route from that tunnel, otherwise it will delete the route based on the vnet and tun_type.",builder:_(jh),handler:async e=>{let r={virtual_network_id:e[`virtual-network-id`],tun_type:e[`tun-type`],tunnel_id:e[`tunnel-id`]};if(e.dryRun){o({command:`cf zero-trust networks routes networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/teamnet/routes/network/${e[`ip-network-encoded`]==null?`<ip-network-encoded>`:encodeURIComponent(String(e[`ip-network-encoded`]))}`,pathParams:{"ip-network-encoded":String(e[`ip-network-encoded`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();if(e.accountId=u,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>l.zeroTrust.networks.routes.networks.delete({account_id:u,ip_network_encoded:e[`ip-network-encoded`],...r})),{successLabel:`Deleted`})}};function Nh(e){return e.positional(`ip-network-encoded`,{type:`string`,description:`IP/CIDR range in URL-encoded format`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ph={command:`edit <ip-network-encoded>`,describe:"Updates an existing private network route in an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format.",builder:Nh,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks routes networks edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/teamnet/routes/network/${e[`ip-network-encoded`]==null?`<ip-network-encoded>`:encodeURIComponent(String(e[`ip-network-encoded`]))}`,pathParams:{"ip-network-encoded":String(e[`ip-network-encoded`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Updating`,async()=>r.zeroTrust.networks.routes.networks.edit({account_id:l,ip_network_encoded:e[`ip-network-encoded`]})),{successLabel:`Updated`})}},Fh={command:`networks`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(Ah).command(Mh).command(Ph).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ih={command:`routes`,describe:`Operations for networks.routes`,builder:e=>e.command(_h).command(yh).command(xh).command(Ch).command(Oh).command(Eh).command(Fh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Lh(e){return e.positional(`address-family`,{type:`string`,description:"IP address family, either `v4` (IPv4) or `v6` (IPv6)",demandOption:!0}).option(`comment`,{type:`string`,description:`An optional description of the subnet.`}).option(`name`,{type:`string`,description:`A user-friendly name for the subnet.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Rh={command:`update <address-family>`,describe:`Updates the Cloudflare Source subnet of the given address family`,builder:_(Lh),handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks subnets cloudflare-source update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zerotrust/subnets/cloudflare_source/${e[`address-family`]==null?`<address-family>`:encodeURIComponent(String(e[`address-family`]))}`,pathParams:{"address-family":String(e[`address-family`]??``)},bodyKind:`json`,body:e.body===void 0?d({comment:f(e.comment,`comment`,`text`),name:f(e.name,`name`,`text`),network:f(e.network,`network`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.networks.subnets.cloudflareSource.update({...t,account_id:u,address_family:e[`address-family`]})),{successLabel:`Updated`});return}let p=d({comment:f(e.comment,`comment`,`text`),name:f(e.name,`name`,`text`),network:f(e.network,`network`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.networks.subnets.cloudflareSource.update({...p,account_id:u,address_family:e[`address-family`]})),{successLabel:`Updated`})}},zh={command:`cloudflare-source`,describe:`Operations for networks.subnets.cloudflare-source`,builder:e=>e.command(Rh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bh(e){return e.positional(`address-family`,{type:`string`,description:"IP address family, either `v4` (IPv4) or `v6` (IPv6)",demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vh={command:`get <address-family>`,describe:`Returns the account's default Initial Resolved IP Subnet for the given address family.`,builder:_(Bh),handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks subnets initial-resolved-ip get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zerotrust/subnets/initial_resolved_ip/${e[`address-family`]==null?`<address-family>`:encodeURIComponent(String(e[`address-family`]))}`,pathParams:{"address-family":String(e[`address-family`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.networks.subnets.initialResolvedIp.get({account_id:l,address_family:e[`address-family`]})),{successLabel:`Loaded`})}};function Hh(e){return e.positional(`address-family`,{type:`string`,description:"IP address family, either `v4` (IPv4) or `v6` (IPv6)",demandOption:!0}).option(`comment`,{type:`string`,description:`An optional description of the subnet.`}).option(`name`,{type:`string`,description:`A user-friendly name for the subnet.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Uh={command:`update <address-family>`,describe:`Updates the CIDR for the account's default Initial Resolved IP Subnet of the given address family. The new CIDR must not conflict with existing private routes in the account.`,builder:_(Hh),handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks subnets initial-resolved-ip update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zerotrust/subnets/initial_resolved_ip/${e[`address-family`]==null?`<address-family>`:encodeURIComponent(String(e[`address-family`]))}`,pathParams:{"address-family":String(e[`address-family`]??``)},bodyKind:`json`,body:e.body===void 0?d({comment:f(e.comment,`comment`,`text`),name:f(e.name,`name`,`text`),network:f(e.network,`network`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.networks.subnets.initialResolvedIp.update({...t,account_id:u,address_family:e[`address-family`]})),{successLabel:`Updated`});return}let p=d({comment:f(e.comment,`comment`,`text`),name:f(e.name,`name`,`text`),network:f(e.network,`network`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.networks.subnets.initialResolvedIp.update({...p,account_id:u,address_family:e[`address-family`]})),{successLabel:`Updated`})}},Wh={command:`initial-resolved-ip`,describe:`Operations for networks.subnets.initial-resolved-ip`,builder:e=>e.command(Vh).command(Uh).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Gh(e){return e.option(`name`,{type:`string`,description:`If set, only list subnets with the given name`}).option(`comment`,{type:`string`,description:`If set, only list subnets with the given comment.`}).option(`network`,{type:`string`,description:`If set, only list the subnet whose network exactly matches the given CIDR.`}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`address-family`,{type:`string`,description:"If set, only include subnets in the given address family - `v4` or `v6`",choices:[`v4`,`v6`]}).option(`is-default-network`,{type:`boolean`,description:"If `true`, only include default subnets. If `false`, exclude default subnets subnets. If not set, all subnets will be included."}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted subnets. If `false`, exclude deleted subnets. If not set, all subnets will be included."}).option(`sort-order`,{type:`string`,description:"Sort order of the results. `asc` means oldest to newest, `desc` means newest to oldest. If not set, they will not be in any particular order.",choices:[`asc`,`desc`]}).option(`subnet-types`,{type:`string`,description:`If set, the types of subnets to include, separated by comma.`,choices:[`cloudflare_source`,`initial_resolved_ip`,`warp`]}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kh={command:`list`,describe:`Lists and filters subnets in an account.`,builder:_(Gh),handler:async e=>{let r={name:e.name,comment:e.comment,network:e.network,existed_at:e[`existed-at`],address_family:e[`address-family`],is_default_network:e[`is-default-network`],is_deleted:e[`is-deleted`],sort_order:e[`sort-order`],subnet_types:e[`subnet-types`],per_page:e[`per-page`],page:e.page};if(e.dryRun){o({command:`cf zero-trust networks subnets list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zerotrust/subnets`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.networks.subnets.list({account_id:u,...r})),{successLabel:`Loaded`})}};function qh(e){return e.option(`comment`,{type:`string`,description:`An optional description of the subnet.`,default:``}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this is the default subnet for the account. There can only be one default subnet per account.",default:!1}).option(`name`,{type:`string`,description:`A user-friendly name for the subnet.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Jh={command:`create`,describe:"Create a WARP IP assignment subnet. Currently, only IPv4 subnets can be created. **Network constraints:** - The network must be within one of the following private IP ranges: - `10.0.0.0/8` (RFC 1918) - `172.16.0.0/12` (RFC 1918) - `192.168.0.0/16` (RFC 1918) - `100.64.0.0/10` (RFC 6598 - CGNAT) - The subnet must have a prefix length of `/24` or larger (e.g., `/16`, `/20`, `/24` are valid; `/25`, `/28` are not)",builder:qh,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks subnets warp create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zerotrust/subnets/warp`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({comment:f(e.comment,`comment`,`text`),is_default_network:e[`is-default-network`],name:f(e.name,`name`,`text`),network:f(e.network,`network`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.networks.subnets.warp.create({...t,account_id:u})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await h(`name`,`A user-friendly name for the subnet.`)),e.network===void 0&&(e.network=await h(`network`,`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`));let p=d({comment:f(e.comment,`comment`,`text`),is_default_network:e[`is-default-network`],name:f(e.name,`name`,`text`),network:f(e.network,`network`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.networks.subnets.warp.create({...p,account_id:u})),{successLabel:`Created`})}};function Yh(e){return e.positional(`subnet-id`,{type:`string`,description:`The UUID of the subnet.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Xh={command:`delete <subnet-id>`,describe:`Delete a WARP IP assignment subnet. This operation is idempotent - deleting an already-deleted or non-existent subnet will return success with a null result.`,builder:Yh,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks subnets warp delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zerotrust/subnets/warp/${e[`subnet-id`]==null?`<subnet-id>`:encodeURIComponent(String(e[`subnet-id`]))}`,pathParams:{"subnet-id":String(e[`subnet-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.networks.subnets.warp.delete({account_id:l,subnet_id:e[`subnet-id`]})),{successLabel:`Deleted`})}};function Zh(e){return e.positional(`subnet-id`,{type:`string`,description:`The UUID of the subnet.`,demandOption:!0}).option(`comment`,{type:`string`,description:`An optional description of the subnet.`}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this is the default subnet for the account. There can only be one default subnet per account."}).option(`name`,{type:`string`,description:`A user-friendly name for the subnet.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Qh={command:`edit <subnet-id>`,describe:"Updates a WARP IP assignment subnet. **Update constraints:** - The `network` field cannot be modified for WARP subnets. Only `name`, `comment`, and `is_default_network` can be updated. - IPv6 subnets cannot be updated",builder:Zh,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks subnets warp edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zerotrust/subnets/warp/${e[`subnet-id`]==null?`<subnet-id>`:encodeURIComponent(String(e[`subnet-id`]))}`,pathParams:{"subnet-id":String(e[`subnet-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({comment:f(e.comment,`comment`,`text`),is_default_network:e[`is-default-network`],name:f(e.name,`name`,`text`),network:f(e.network,`network`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.networks.subnets.warp.edit({...t,account_id:u,subnet_id:e[`subnet-id`]})),{successLabel:`Updated`});return}let p=d({comment:f(e.comment,`comment`,`text`),is_default_network:e[`is-default-network`],name:f(e.name,`name`,`text`),network:f(e.network,`network`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.networks.subnets.warp.edit({...p,account_id:u,subnet_id:e[`subnet-id`]})),{successLabel:`Updated`})}};function $h(e){return e.positional(`subnet-id`,{type:`string`,description:`The UUID of the subnet.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const eg={command:`get <subnet-id>`,describe:`Get a WARP IP assignment subnet.`,builder:$h,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks subnets warp get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zerotrust/subnets/warp/${e[`subnet-id`]==null?`<subnet-id>`:encodeURIComponent(String(e[`subnet-id`]))}`,pathParams:{"subnet-id":String(e[`subnet-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.networks.subnets.warp.get({account_id:l,subnet_id:e[`subnet-id`]})),{successLabel:`Loaded`})}},tg={command:`warp`,describe:`Operations for networks.subnets.warp`,builder:e=>e.command(Jh).command(Xh).command(Qh).command(eg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ng={command:`subnets`,describe:`Operations for networks.subnets`,builder:e=>e.command(Kh).command(zh).command(Wh).command(tg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function rg(e){return e.option(`comment`,{type:`string`,description:`Optional remark describing the virtual network.`,default:``}).option(`is-default`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account."}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account.",default:!1}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ig={command:`create`,describe:`Adds a new virtual network to an account.`,builder:rg,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks virtual-networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/teamnet/virtual_networks`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({comment:f(e.comment,`comment`,`text`),is_default:e[`is-default`],is_default_network:e[`is-default-network`],name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.networks.virtualNetworks.create({...t,account_id:u})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await h(`name`,`A user-friendly name for the virtual network.`));let p=d({comment:f(e.comment,`comment`,`text`),is_default:e[`is-default`],is_default_network:e[`is-default-network`],name:f(e.name,`name`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.networks.virtualNetworks.create({...p,account_id:u})),{successLabel:`Created`})}};function ag(e){return e.positional(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const og={command:`delete <virtual-network-id>`,describe:`Deletes an existing virtual network.`,builder:ag,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks virtual-networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/teamnet/virtual_networks/${e[`virtual-network-id`]==null?`<virtual-network-id>`:encodeURIComponent(String(e[`virtual-network-id`]))}`,pathParams:{"virtual-network-id":String(e[`virtual-network-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.networks.virtualNetworks.delete({account_id:l,virtual_network_id:e[`virtual-network-id`]})),{successLabel:`Deleted`})}};function sg(e){return e.positional(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the virtual network.`}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account."}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const cg={command:`edit <virtual-network-id>`,describe:`Updates an existing virtual network.`,builder:sg,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks virtual-networks edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/teamnet/virtual_networks/${e[`virtual-network-id`]==null?`<virtual-network-id>`:encodeURIComponent(String(e[`virtual-network-id`]))}`,pathParams:{"virtual-network-id":String(e[`virtual-network-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({comment:f(e.comment,`comment`,`text`),is_default_network:e[`is-default-network`],name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.networks.virtualNetworks.edit({...t,account_id:u,virtual_network_id:e[`virtual-network-id`]})),{successLabel:`Updated`});return}let p=d({comment:f(e.comment,`comment`,`text`),is_default_network:e[`is-default-network`],name:f(e.name,`name`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.networks.virtualNetworks.edit({...p,account_id:u,virtual_network_id:e[`virtual-network-id`]})),{successLabel:`Updated`})}};function lg(e){return e.positional(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the virtual network.`,default:``}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account."}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ug={command:`get <virtual-network-id>`,describe:`Get a virtual network.`,builder:lg,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust networks virtual-networks get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/teamnet/virtual_networks/${e[`virtual-network-id`]==null?`<virtual-network-id>`:encodeURIComponent(String(e[`virtual-network-id`]))}`,pathParams:{"virtual-network-id":String(e[`virtual-network-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.networks.virtualNetworks.get({account_id:l,virtual_network_id:e[`virtual-network-id`]})),{successLabel:`Loaded`})}};function dg(e){return e.option(`id`,{type:`string`,description:`UUID of the virtual network.`}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`is-default`,{type:`boolean`,description:"If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included."}).option(`is-default-network`,{type:`boolean`,description:"If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included."}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted virtual networks. If `false`, exclude deleted virtual networks. If empty, all virtual networks will be included."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const fg={command:`list`,describe:`Lists and filters virtual networks in an account.`,builder:dg,handler:async e=>{let r={id:e.id,name:e.name,is_default:e[`is-default`],is_default_network:e[`is-default-network`],is_deleted:e[`is-deleted`]};if(e.dryRun){o({command:`cf zero-trust networks virtual-networks list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/teamnet/virtual_networks`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.networks.virtualNetworks.list({account_id:u,...r})),{successLabel:`Loaded`})}},pg={command:`virtual-networks`,describe:`Operations for networks.virtual-networks`,builder:e=>e.command(ig).command(og).command(cg).command(ug).command(fg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},mg={command:`networks`,describe:`Operations for networks`,builder:e=>e.command(hh).command(Ih).command(ng).command(pg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function hg(e){return e.option(`allow-authenticate-via-warp`,{type:`boolean`,description:`When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.`,default:!1}).option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`auto-redirect-to-identity`,{type:`boolean`,description:"When set to `true`, users skip the identity provider selection step during login.",default:!1}).option(`deny-unmatched-requests`,{type:`boolean`,description:"Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names` array."}).option(`deny-unmatched-requests-exempted-zone-names`,{type:`string`,array:!0,description:"Contains zone names to exempt from the `deny_unmatched_requests` feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request."}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`,default:!1}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:"Lists the MFA methods that users can authenticate with. The `piv_key` and `ssh_fido2_key` values are supported only for infrastructure applications."}).option(`mfa-config-amr-matching-session-duration`,{type:`string`,description:`Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).`}).option(`mfa-config-required-aaguids`,{type:`string`,description:`Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`mfa-piv-key-requirements-pin-policy`,{type:`string`,description:"Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN required), `once` (PIN required once per session), `always` (PIN required for each use).",choices:[`never`,`once`,`always`]}).option(`mfa-piv-key-requirements-require-fips-device`,{type:`boolean`,description:`Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.`}).option(`mfa-piv-key-requirements-ssh-key-size`,{type:`string`,array:!0,description:`Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.`}).option(`mfa-piv-key-requirements-ssh-key-type`,{type:`string`,array:!0,description:"Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and `rsa`."}).option(`mfa-piv-key-requirements-touch-policy`,{type:`string`,description:"Defines when physical touch is required to use the SSH key. Valid values: `never` (no touch required), `always` (touch required for each use), `cached` (touch cached for 15 seconds).",choices:[`never`,`always`,`cached`]}).option(`mfa-required-for-all-apps`,{type:`boolean`,description:`Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: 'allowed_authenticators' cannot contain only the infrastructure SSH authenticators ('piv_key' and 'ssh_fido2_key') if the organization has any non-infrastructure applications.`,default:!1}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`warp-auth-non-browser-401`,{type:`boolean`,description:`When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page.`,default:!1}).option(`warp-auth-session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const gg={command:`create`,describe:`Sets up a Zero Trust organization for your account.`,builder:hg,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust organizations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/organizations`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({allow_authenticate_via_warp:e[`allow-authenticate-via-warp`],auth_domain:f(e[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:e[`auto-redirect-to-identity`],deny_unmatched_requests:e[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:e[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:e[`is-ui-read-only`],login_design:{background_color:f(e[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(e[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(e[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(e[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(e[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:e[`mfa-config-allowed-authenticators`],amr_matching_session_duration:f(e[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:f(e[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:f(e[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:f(e[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:e[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:e[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:e[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:f(e[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:e[`mfa-required-for-all-apps`],name:f(e.name,`name`,`text`),session_duration:f(e[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:f(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_non_browser_401:e[`warp-auth-non-browser-401`],warp_auth_session_duration:f(e[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.organizations.create({...t,account_id:u})),{successLabel:`Created`});return}e[`auth-domain`]===void 0&&(e[`auth-domain`]=await h(`auth-domain`,`The unique subdomain assigned to your Zero Trust organization.`)),e.name===void 0&&(e.name=await h(`name`,`The name of your Zero Trust organization.`));let p=d({allow_authenticate_via_warp:e[`allow-authenticate-via-warp`],auth_domain:f(e[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:e[`auto-redirect-to-identity`],deny_unmatched_requests:e[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:e[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:e[`is-ui-read-only`],login_design:{background_color:f(e[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(e[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(e[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(e[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(e[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:e[`mfa-config-allowed-authenticators`],amr_matching_session_duration:f(e[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:f(e[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:f(e[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:f(e[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:e[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:e[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:e[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:f(e[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:e[`mfa-required-for-all-apps`],name:f(e.name,`name`,`text`),session_duration:f(e[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:f(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_non_browser_401:e[`warp-auth-non-browser-401`],warp_auth_session_duration:f(e[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.organizations.create({...p,account_id:u})),{successLabel:`Created`})}};function _g(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const vg={command:`get`,describe:`Returns the DoH settings for your Zero Trust organization.`,builder:_g,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust organizations doh get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/organizations/doh`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.organizations.doh.get({account_id:l})),{successLabel:`Loaded`})}};function yg(e){return e.option(`doh-jwt-duration`,{type:`string`,description:"The duration the DoH JWT is valid for. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.  Note that the maximum duration for this setting is the same as the key rotation period on the account. Default expiration is 24h"}).option(`service-token-id`,{type:`string`,description:`The uuid of the service token you want to use for DoH authentication`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const bg={command:`update`,describe:`Updates the DoH settings for your Zero Trust organization.`,builder:yg,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust organizations doh update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/organizations/doh`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({doh_jwt_duration:f(e[`doh-jwt-duration`],`doh-jwt-duration`,`text`),service_token_id:f(e[`service-token-id`],`service-token-id`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.organizations.doh.update({...t,account_id:u})),{successLabel:`Updated`});return}let p=d({doh_jwt_duration:f(e[`doh-jwt-duration`],`doh-jwt-duration`,`text`),service_token_id:f(e[`service-token-id`],`service-token-id`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.organizations.doh.update({...p,account_id:u})),{successLabel:`Updated`})}},xg={command:`doh`,describe:`Operations for organizations.doh`,builder:e=>e.command(vg).command(bg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Sg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Cg={command:`list`,describe:`Returns the configuration for your Zero Trust organization.`,builder:Sg,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust organizations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/organizations`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.organizations.list({account_id:l})),{successLabel:`Loaded`})}};function wg(e){return e.option(`devices`,{type:`boolean`,description:"When set to `true`, all devices associated with the user will be revoked."}).option(`email`,{type:`string`,description:`The email of the user to revoke.`}).option(`user-uid`,{type:`string`,description:`The uuid of the user to revoke.`}).option(`warp-session-reauth`,{type:`boolean`,description:"When set to `true`, the user will be required to re-authenticate to WARP for all Gateway policies that enforce a WARP client session duration. When `false`, the user’s WARP session will remain active"}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Tg={command:`revoke-users`,describe:`Revokes a user's access across all applications.`,builder:wg,handler:async e=>{let r={devices:e.devices};if(e.dryRun){o({command:`cf zero-trust organizations revoke-users`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/organizations/revoke_user`,pathParams:{},query:r,bodyKind:`json`,body:e.body===void 0?d({email:f(e.email,`email`,`text`),user_uid:f(e[`user-uid`],`user-uid`,`text`),warp_session_reauth:e[`warp-session-reauth`]}):l(e.body)});return}let u=await i(e),p=e.local?c:await n();if(e.accountId=p,!await g({force:!!e.force,message:`This operation revokes all access tokens for a user destructively.`})){process.stderr.write(`Aborted.
+`);return}if(e.body){let t=l(e.body);new URLSearchParams(Object.entries(r).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString(),a(await s(`Deleting`,async()=>u.zeroTrust.organizations.revokeUsers({...t,account_id:p,...r})),{successLabel:`Deleted`});return}e.email===void 0&&(e.email=await h(`email`,`The email of the user to revoke.`));let m=d({email:f(e.email,`email`,`text`),user_uid:f(e[`user-uid`],`user-uid`,`text`),warp_session_reauth:e[`warp-session-reauth`]});new URLSearchParams(Object.entries(r).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString(),a(await s(`Deleting`,async()=>u.zeroTrust.organizations.revokeUsers({...m,account_id:p,...r})),{successLabel:`Deleted`})}};function Eg(e){return e.option(`allow-authenticate-via-warp`,{type:`boolean`,description:`When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.`}).option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`auto-redirect-to-identity`,{type:`boolean`,description:"When set to `true`, users skip the identity provider selection step during login."}).option(`custom-pages-forbidden`,{type:`string`,description:`The uid of the custom page to use when a user is denied access after failing a non-identity rule.`}).option(`custom-pages-identity-denied`,{type:`string`,description:`The uid of the custom page to use when a user is denied access.`}).option(`deny-unmatched-requests`,{type:`boolean`,description:"Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names` array."}).option(`deny-unmatched-requests-exempted-zone-names`,{type:`string`,array:!0,description:"Contains zone names to exempt from the `deny_unmatched_requests` feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request."}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:"Lists the MFA methods that users can authenticate with. The `piv_key` and `ssh_fido2_key` values are supported only for infrastructure applications."}).option(`mfa-config-amr-matching-session-duration`,{type:`string`,description:`Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).`}).option(`mfa-config-required-aaguids`,{type:`string`,description:`Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`mfa-piv-key-requirements-pin-policy`,{type:`string`,description:"Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN required), `once` (PIN required once per session), `always` (PIN required for each use).",choices:[`never`,`once`,`always`]}).option(`mfa-piv-key-requirements-require-fips-device`,{type:`boolean`,description:`Requires the PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.`}).option(`mfa-piv-key-requirements-ssh-key-size`,{type:`string`,array:!0,description:`Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.`}).option(`mfa-piv-key-requirements-ssh-key-type`,{type:`string`,array:!0,description:"Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and `rsa`."}).option(`mfa-piv-key-requirements-touch-policy`,{type:`string`,description:"Defines when physical touch is required to use the SSH key. Valid values: `never` (no touch required), `always` (touch required for each use), `cached` (touch cached for 15 seconds).",choices:[`never`,`always`,`cached`]}).option(`mfa-required-for-all-apps`,{type:`boolean`,description:`Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured. Note: 'allowed_authenticators' cannot contain only the infrastructure SSH authenticators ('piv_key' and 'ssh_fido2_key') if the organization has any non-infrastructure applications.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`warp-auth-non-browser-401`,{type:`boolean`,description:`When enabled, unsuccessful WARP authentication requests with a non-HTML Accept header return a 401 response instead of redirecting to the login page.`}).option(`warp-auth-session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Dg={command:`update`,describe:`Updates the configuration for your Zero Trust organization.`,builder:Eg,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust organizations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/organizations`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({allow_authenticate_via_warp:e[`allow-authenticate-via-warp`],auth_domain:f(e[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:e[`auto-redirect-to-identity`],custom_pages:{forbidden:f(e[`custom-pages-forbidden`],`custom-pages-forbidden`,`text`),identity_denied:f(e[`custom-pages-identity-denied`],`custom-pages-identity-denied`,`text`)},deny_unmatched_requests:e[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:e[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:e[`is-ui-read-only`],login_design:{background_color:f(e[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(e[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(e[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(e[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(e[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:e[`mfa-config-allowed-authenticators`],amr_matching_session_duration:f(e[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:f(e[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:f(e[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:f(e[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:e[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:e[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:e[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:f(e[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:e[`mfa-required-for-all-apps`],name:f(e.name,`name`,`text`),session_duration:f(e[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:f(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_non_browser_401:e[`warp-auth-non-browser-401`],warp_auth_session_duration:f(e[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.organizations.update({...t,account_id:u})),{successLabel:`Updated`});return}let p=d({allow_authenticate_via_warp:e[`allow-authenticate-via-warp`],auth_domain:f(e[`auth-domain`],`auth-domain`,`text`),auto_redirect_to_identity:e[`auto-redirect-to-identity`],custom_pages:{forbidden:f(e[`custom-pages-forbidden`],`custom-pages-forbidden`,`text`),identity_denied:f(e[`custom-pages-identity-denied`],`custom-pages-identity-denied`,`text`)},deny_unmatched_requests:e[`deny-unmatched-requests`],deny_unmatched_requests_exempted_zone_names:e[`deny-unmatched-requests-exempted-zone-names`],is_ui_read_only:e[`is-ui-read-only`],login_design:{background_color:f(e[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(e[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(e[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(e[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(e[`login-design-text-color`],`login-design-text-color`,`text`)},mfa_config:{allowed_authenticators:e[`mfa-config-allowed-authenticators`],amr_matching_session_duration:f(e[`mfa-config-amr-matching-session-duration`],`mfa-config-amr-matching-session-duration`,`text`),required_aaguids:f(e[`mfa-config-required-aaguids`],`mfa-config-required-aaguids`,`text`),session_duration:f(e[`mfa-config-session-duration`],`mfa-config-session-duration`,`text`)},mfa_piv_key_requirements:{pin_policy:f(e[`mfa-piv-key-requirements-pin-policy`],`mfa-piv-key-requirements-pin-policy`,`text`),require_fips_device:e[`mfa-piv-key-requirements-require-fips-device`],ssh_key_size:e[`mfa-piv-key-requirements-ssh-key-size`],ssh_key_type:e[`mfa-piv-key-requirements-ssh-key-type`],touch_policy:f(e[`mfa-piv-key-requirements-touch-policy`],`mfa-piv-key-requirements-touch-policy`,`text`)},mfa_required_for_all_apps:e[`mfa-required-for-all-apps`],name:f(e.name,`name`,`text`),session_duration:f(e[`session-duration`],`session-duration`,`text`),ui_read_only_toggle_reason:f(e[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(e[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`),warp_auth_non_browser_401:e[`warp-auth-non-browser-401`],warp_auth_session_duration:f(e[`warp-auth-session-duration`],`warp-auth-session-duration`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.organizations.update({...p,account_id:u})),{successLabel:`Updated`})}},Og={command:`organizations`,describe:`Operations for organizations`,builder:e=>e.command(gg).command(Cg).command(Tg).command(Dg).command(xg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function kg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ag={command:`list`,describe:`Lists all DLP custom profiles in an account.`,builder:kg,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust profiles custom list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/profiles/custom`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.profiles.custom.list({account_id:l})),{successLabel:`Loaded`})}},jg={command:`custom`,describe:`Profiles operations`,builder:e=>e.command(Ag).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Mg(e){return e.option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Predefined profiles can not be created. This endpoint will only update an existing predefined profiles settings.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const Ng={command:`create`,describe:`Creates a DLP predefined profile. Only supports enabling/disabling entries.`,builder:Mg,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust profiles predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/profiles/predefined`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:f(e[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:e[`context-awareness-enabled`],skip:{files:e[`context-awareness-skip-files`]}},ocr_enabled:e[`ocr-enabled`],profile_id:f(e[`profile-id`],`profile-id`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.profiles.predefined.create({...t,account_id:u})),{successLabel:`Created`});return}e[`profile-id`]===void 0&&(e[`profile-id`]=await h(`profile-id`,`The profile_id field`));let p=d({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:f(e[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:e[`context-awareness-enabled`],skip:{files:e[`context-awareness-skip-files`]}},ocr_enabled:e[`ocr-enabled`],profile_id:f(e[`profile-id`],`profile-id`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.profiles.predefined.create({...p,account_id:u})),{successLabel:`Created`})}};function Pg(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Fg={command:`get <profile-id>`,describe:`Fetches a predefined DLP profile by id.`,builder:Pg,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust profiles predefined get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/profiles/predefined/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.profiles.predefined.get({account_id:l,profile_id:e[`profile-id`]})),{successLabel:`Loaded`})}};function Ig(e){return e.positional(`profile-id`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the predefined profile.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0})}const Lg={command:`update <profile-id>`,describe:`Updates a DLP predefined profile. Only supports enabling/disabling entries.`,builder:Ig,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust profiles predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/profiles/predefined/${e[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(e[`profile-id`]))}`,pathParams:{"profile-id":String(e[`profile-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:f(e[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:e[`context-awareness-enabled`],skip:{files:e[`context-awareness-skip-files`]}},ocr_enabled:e[`ocr-enabled`]}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.profiles.predefined.update({...t,account_id:u,profile_id:e[`profile-id`]})),{successLabel:`Updated`});return}let p=d({ai_context_enabled:e[`ai-context-enabled`],allowed_match_count:e[`allowed-match-count`],confidence_threshold:f(e[`confidence-threshold`],`confidence-threshold`,`text`),context_awareness:{enabled:e[`context-awareness-enabled`],skip:{files:e[`context-awareness-skip-files`]}},ocr_enabled:e[`ocr-enabled`]});a(await s(`Updating`,async()=>r.zeroTrust.profiles.predefined.update({...p,account_id:u,profile_id:e[`profile-id`]})),{successLabel:`Updated`})}},Rg={command:`predefined`,describe:`Profiles operations`,builder:e=>e.command(Ng).command(Fg).command(Lg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},zg={command:`profiles`,describe:`Operations for profiles`,builder:e=>e.command(jg).command(Rg).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Vg={command:`get`,describe:`Retrieves configured risk score behaviors that define how user actions affect their overall risk score.`,builder:Bg,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust risk-scoring behaviours get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zt_risk_scoring/behaviors`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.riskScoring.behaviours.get({account_id:l})),{successLabel:`Loaded`})}};function Hg(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Behaviors.`})}const Ug={command:`update`,describe:`Updates risk score behavior configurations, defining weights and thresholds for risk calculation.`,builder:Hg,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust risk-scoring behaviours update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zt_risk_scoring/behaviors`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.riskScoring.behaviours.update({body:t,account_id:u})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Wg={command:`behaviours`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(Vg).command(Ug).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Gg(e){return e.positional(`user-id`,{type:`string`,description:`User ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kg={command:`get <user-id>`,describe:`Retrieves the detailed risk score breakdown for a specific user, including contributing factors.`,builder:Gg,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust risk-scoring get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zt_risk_scoring/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.riskScoring.get({account_id:l,user_id:e[`user-id`]})),{successLabel:`Loaded`})}};function qg(e){return e.option(`integration-type`,{type:`string`,description:`The integration_type field`,choices:[`Okta`]}).option(`reference-id`,{type:`string`,description:`A reference id that can be supplied by the client. Currently this should be set to the Access-Okta IDP ID (a UUIDv4).
+https://developers.cloudflare.com/api/operations/access-identity-providers-get-an-access-identity-provider`}).option(`tenant-url`,{type:`string`,description:`The base url of the tenant, e.g. "https://tenant.okta.com".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Jg={command:`create`,describe:`Creates a new Zero Trust risk score integration, connecting external risk signals to Cloudflare's risk scoring system.`,builder:qg,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust risk-scoring integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zt_risk_scoring/integrations`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({integration_type:f(e[`integration-type`],`integration-type`,`text`),reference_id:f(e[`reference-id`],`reference-id`,`text`),tenant_url:f(e[`tenant-url`],`tenant-url`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.riskScoring.integrations.create({...t,account_id:u})),{successLabel:`Created`});return}e[`integration-type`]===void 0&&(e[`integration-type`]=await m(`integration-type`,`The integration_type field`,[`Okta`])),e[`tenant-url`]===void 0&&(e[`tenant-url`]=await h(`tenant-url`,`The base url of the tenant, e.g. "https://tenant.okta.com".`));let p=d({integration_type:f(e[`integration-type`],`integration-type`,`text`),reference_id:f(e[`reference-id`],`reference-id`,`text`),tenant_url:f(e[`tenant-url`],`tenant-url`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.riskScoring.integrations.create({...p,account_id:u})),{successLabel:`Created`})}};function Yg(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Xg={command:`delete <integration-id>`,describe:`Removes a Zero Trust risk score integration, disconnecting the external risk signal source.`,builder:Yg,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust risk-scoring integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zt_risk_scoring/integrations/${e[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(e[`integration-id`]))}`,pathParams:{"integration-id":String(e[`integration-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.riskScoring.integrations.delete({account_id:l,integration_id:e[`integration-id`]})),{successLabel:`Deleted`})}};function Zg(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Qg={command:`get <integration-id>`,describe:`Gets a Zero Trust risk score integration by ID.`,builder:Zg,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust risk-scoring integrations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zt_risk_scoring/integrations/${e[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(e[`integration-id`]))}`,pathParams:{"integration-id":String(e[`integration-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.riskScoring.integrations.get({account_id:l,integration_id:e[`integration-id`]})),{successLabel:`Loaded`})}};function $g(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const e_={command:`list`,describe:`Lists all configured Zero Trust risk score integrations for the account.`,builder:$g,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust risk-scoring integrations list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zt_risk_scoring/integrations`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.riskScoring.integrations.list({account_id:l})),{successLabel:`Loaded`})}};function t_(e){return e.positional(`reference-id`,{type:`string`,description:`Reference ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const n_={command:`get <reference-id>`,describe:`Retrieves a Zero Trust risk score integration using its external reference ID.`,builder:t_,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust risk-scoring integrations references get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zt_risk_scoring/integrations/reference_id/${e[`reference-id`]==null?`<reference-id>`:encodeURIComponent(String(e[`reference-id`]))}`,pathParams:{"reference-id":String(e[`reference-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.riskScoring.integrations.references.get({account_id:l,reference_id:e[`reference-id`]})),{successLabel:`Loaded`})}},r_={command:`references`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(n_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function i_(e){return e.positional(`integration-id`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`active`,{type:`boolean`,description:`Whether this integration is enabled. If disabled, no risk changes will be exported to the third-party.`}).option(`reference-id`,{type:`string`,description:`A reference id that can be supplied by the client. Currently this should be set to the Access-Okta IDP ID (a UUIDv4).
+https://developers.cloudflare.com/api/operations/access-identity-providers-get-an-access-identity-provider`}).option(`tenant-url`,{type:`string`,description:`The base url of the tenant, e.g. "https://tenant.okta.com".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const a_={command:`update <integration-id>`,describe:`Overwrite the reference_id, tenant_url, and active values with the ones provided.`,builder:i_,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust risk-scoring integrations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zt_risk_scoring/integrations/${e[`integration-id`]==null?`<integration-id>`:encodeURIComponent(String(e[`integration-id`]))}`,pathParams:{"integration-id":String(e[`integration-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({active:e.active,reference_id:f(e[`reference-id`],`reference-id`,`text`),tenant_url:f(e[`tenant-url`],`tenant-url`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.riskScoring.integrations.update({...t,account_id:u,integration_id:e[`integration-id`]})),{successLabel:`Updated`});return}if(e.active===void 0)throw Error(`--active is required (or pass --body with this field set).`);e[`tenant-url`]===void 0&&(e[`tenant-url`]=await h(`tenant-url`,`The base url of the tenant, e.g. "https://tenant.okta.com".`));let p=d({active:e.active,reference_id:f(e[`reference-id`],`reference-id`,`text`),tenant_url:f(e[`tenant-url`],`tenant-url`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.riskScoring.integrations.update({...p,account_id:u,integration_id:e[`integration-id`]})),{successLabel:`Updated`})}},o_={command:`integrations`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(Jg).command(Xg).command(Qg).command(e_).command(a_).command(r_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function s_(e){return e.positional(`user-id`,{type:`string`,description:`User ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const c_={command:`reset <user-id>`,describe:`Resets risk scores for specified users, clearing their accumulated risk history.`,builder:s_,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust risk-scoring reset`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zt_risk_scoring/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}/reset`,pathParams:{"user-id":String(e[`user-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force,message:`This operation wipes risk-scoring history.`})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.riskScoring.reset({account_id:l,user_id:e[`user-id`]})),{successLabel:`Deleted`})}};function l_(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const u_={command:`get`,describe:`Gets an aggregate summary of risk scores across the account, including distribution and trends.`,builder:l_,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust risk-scoring summary get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/zt_risk_scoring/summary`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.riskScoring.summary.get({account_id:l})),{successLabel:`Loaded`})}},d_={command:`summary`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(u_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},f_={command:`risk-scoring`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(Kg).command(c_).command(Wg).command(o_).command(d_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function p_(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const m_={command:`edit`,describe:"Removes a user from a Zero Trust seat when both `access_seat` and `gateway_seat` are set to false.",builder:p_,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust seats edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/seats`,pathParams:{},bodyKind:`json`,body:e.body===void 0?void 0:l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.seats.edit({body:t,account_id:u})),{successLabel:`Updated`});return}if(e.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},h_={command:`seats`,describe:`Operations for seats`,builder:e=>e.command(m_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function g_(e){return e.option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.",default:1}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).",default:`8760h`}).option(`enabled`,{type:`boolean`,description:"Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous `client_secret` stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const __={command:`create`,describe:`Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to create a new service token.`,builder:g_,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust service-tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/service_tokens`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?d({client_secret_version:t[`client-secret-version`],duration:f(t.duration,`duration`,`text`),enabled:t.enabled,name:f(t.name,`name`,`text`),previous_client_secret_expires_at:f(t[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=l(t.body);a(await s(`Creating`,async()=>n.zeroTrust.serviceTokens.create({...e,zone_id:r})),{successLabel:`Created`});return}t.name===void 0&&(t.name=await h(`name`,`The name of the service token.`));let c=d({client_secret_version:t[`client-secret-version`],duration:f(t.duration,`duration`,`text`),enabled:t.enabled,name:f(t.name,`name`,`text`),previous_client_secret_expires_at:f(t[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});a(await s(`Creating`,async()=>n.zeroTrust.serviceTokens.create({...c,zone_id:r})),{successLabel:`Created`})}};function v_(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const y_={command:`delete <service-token-id>`,describe:`Deletes a service token.`,builder:v_,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust service-tokens delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/service_tokens/${t[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(t[`service-token-id`]))}`,pathParams:{"service-token-id":String(t[`service-token-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,!await g({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>n.zeroTrust.serviceTokens.delete({zone_id:r,service_token_id:t[`service-token-id`]})),{successLabel:`Deleted`})}};function b_(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const x_={command:`get <service-token-id>`,describe:`Fetches a single service token.`,builder:b_,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust service-tokens get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/service_tokens/${t[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(t[`service-token-id`]))}`,pathParams:{"service-token-id":String(t[`service-token-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.serviceTokens.get({zone_id:r,service_token_id:t[`service-token-id`]})),{successLabel:`Loaded`})}};function S_(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const C_={command:`list`,describe:`Lists all service tokens.`,builder:S_,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust service-tokens list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/service_tokens`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.serviceTokens.list({zone_id:r})),{successLabel:`Loaded`})}};function w_(e){return e.positional(`service-token-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`."}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`, or the special value `forever` for non-expiring tokens. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h)."}).option(`enabled`,{type:`boolean`,description:"Whether the service token is enabled. A disabled service token cannot be used to authenticate; both its current and previous `client_secret` stop being accepted, but the token itself is preserved and can be re-enabled at any time. Defaults to enabled when omitted on create."}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const T_={command:`update <service-token-id>`,describe:`Updates a configured service token.`,builder:w_,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust service-tokens update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/service_tokens/${t[`service-token-id`]==null?`<service-token-id>`:encodeURIComponent(String(t[`service-token-id`]))}`,pathParams:{"service-token-id":String(t[`service-token-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?d({client_secret_version:t[`client-secret-version`],duration:f(t.duration,`duration`,`text`),enabled:t.enabled,name:f(t.name,`name`,`text`),previous_client_secret_expires_at:f(t[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)}):l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=l(t.body);a(await s(`Updating`,async()=>n.zeroTrust.serviceTokens.update({...e,zone_id:r,service_token_id:t[`service-token-id`]})),{successLabel:`Updated`});return}let c=d({client_secret_version:t[`client-secret-version`],duration:f(t.duration,`duration`,`text`),enabled:t.enabled,name:f(t.name,`name`,`text`),previous_client_secret_expires_at:f(t[`previous-client-secret-expires-at`],`previous-client-secret-expires-at`,`text`)});a(await s(`Updating`,async()=>n.zeroTrust.serviceTokens.update({...c,zone_id:r,service_token_id:t[`service-token-id`]})),{successLabel:`Updated`})}},E_={command:`service-tokens`,describe:`Operations for service-tokens`,builder:e=>e.command(__).command(y_).command(x_).command(C_).command(T_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function D_(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const O_={command:`delete`,describe:`Deletes account-level DLP settings and returns the initial values.`,builder:D_,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust settings delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.settings.delete({account_id:l})),{successLabel:`Deleted`})}};function k_(e){return e.option(`ai-context-analysis`,{type:`boolean`,description:`Whether AI context analysis is enabled at the account level.`}).option(`ocr`,{type:`boolean`,description:`Whether OCR is enabled at the account level.`}).option(`payload-logging-public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
+
+- Set to a non-empty base64 string to enable payload logging with the given key.
+- Set to an empty string to disable payload logging.
+- Omit or set to null to leave unchanged (PATCH) or reset to disabled (PUT).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`DLP settings fields to update.`})}const A_={command:`edit`,describe:`Missing fields keep their existing values.`,builder:k_,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({ai_context_analysis:e[`ai-context-analysis`],ocr:e.ocr,payload_logging:{public_key:f(e[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.settings.edit({body:t,account_id:u})),{successLabel:`Updated`});return}let p=d({ai_context_analysis:e[`ai-context-analysis`],ocr:e.ocr,payload_logging:{public_key:f(e[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}});a(await s(`Updating`,async()=>r.zeroTrust.settings.edit({body:p,account_id:u})),{successLabel:`Updated`})}};function j_(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const M_={command:`get`,describe:`Gets the account-level DLP settings.`,builder:j_,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.settings.get({account_id:l})),{successLabel:`Loaded`})}};function N_(e){return e.option(`ai-context-analysis`,{type:`boolean`,description:`Whether AI context analysis is enabled at the account level.`}).option(`ocr`,{type:`boolean`,description:`Whether OCR is enabled at the account level.`}).option(`payload-logging-public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.
+
+- Set to a non-empty base64 string to enable payload logging with the given key.
+- Set to an empty string to disable payload logging.
+- Omit or set to null to leave unchanged (PATCH) or reset to disabled (PUT).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`New DLP settings.`})}const P_={command:`update`,describe:`Missing fields are reset to initial (unconfigured) values.`,builder:N_,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({ai_context_analysis:e[`ai-context-analysis`],ocr:e.ocr,payload_logging:{public_key:f(e[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.settings.update({body:t,account_id:u})),{successLabel:`Updated`});return}let p=d({ai_context_analysis:e[`ai-context-analysis`],ocr:e.ocr,payload_logging:{public_key:f(e[`payload-logging-public-key`],`payload-logging-public-key`,`text`)}});a(await s(`Updating`,async()=>r.zeroTrust.settings.update({body:p,account_id:u})),{successLabel:`Updated`})}},F_={command:`settings`,describe:`Settings operations`,builder:e=>e.command(O_).command(A_).command(M_).command(P_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function I_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const L_={command:`get <tunnel-id>`,describe:`Gets the configuration for a remotely-managed tunnel`,builder:I_,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels cloudflared configurations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/configurations`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.tunnels.cloudflared.configurations.get({account_id:l,tunnel_id:e[`tunnel-id`]})),{successLabel:`Loaded`})}};function R_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`config-origin-request-access-aud-tag`,{type:`string`,array:!0,description:`Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.`}).option(`config-origin-request-access-required`,{type:`boolean`,description:`Deny traffic that has not fulfilled Access authorization.`}).option(`config-origin-request-access-team-name`,{type:`string`,description:`The config.originRequest.access.teamName field`}).option(`config-origin-request-ca-pool`,{type:`string`,description:`Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.`}).option(`config-origin-request-connect-timeout`,{type:`number`,description:`Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.`}).option(`config-origin-request-disable-chunked-encoding`,{type:`boolean`,description:`Disables chunked transfer encoding. Useful if you are running a WSGI server.`}).option(`config-origin-request-http2origin`,{type:`boolean`,description:`Attempt to connect to origin using HTTP2. Origin must be configured as https.`}).option(`config-origin-request-http-host-header`,{type:`string`,description:`Sets the HTTP Host header on requests sent to the local service.`}).option(`config-origin-request-keep-alive-connections`,{type:`number`,description:`Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.`}).option(`config-origin-request-keep-alive-timeout`,{type:`number`,description:`Timeout after which an idle keepalive connection can be discarded.`}).option(`config-origin-request-match-snito-host`,{type:`boolean`,description:`Auto configure the Hostname on the origin server certificate.`}).option(`config-origin-request-no-happy-eyeballs`,{type:`boolean`,description:`Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.`}).option(`config-origin-request-no-tlsverify`,{type:`boolean`,description:`Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.`}).option(`config-origin-request-origin-server-name`,{type:`string`,description:`Hostname that cloudflared should expect from your origin server certificate.`}).option(`config-origin-request-proxy-type`,{type:`string`,description:`cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and "socks" for a SOCKS5 proxy.
+`}).option(`config-origin-request-tcp-keep-alive`,{type:`number`,description:`The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.`}).option(`config-origin-request-tls-timeout`,{type:`number`,description:`Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`config-origin-request-access-aud-tag`,`config-origin-request-access-required`,`config-origin-request-access-team-name`,`config-origin-request-ca-pool`,`config-origin-request-connect-timeout`,`config-origin-request-disable-chunked-encoding`,`config-origin-request-http2origin`,`config-origin-request-http-host-header`,`config-origin-request-keep-alive-connections`,`config-origin-request-keep-alive-timeout`,`config-origin-request-match-snito-host`,`config-origin-request-no-happy-eyeballs`,`config-origin-request-no-tlsverify`,`config-origin-request-origin-server-name`,`config-origin-request-proxy-type`,`config-origin-request-tcp-keep-alive`,`config-origin-request-tls-timeout`].some(t=>e[t]!==void 0)){let t=[`config-origin-request-access-aud-tag`,`config-origin-request-access-team-name`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --config-* flag is set`)}return!0})}const z_={command:`update <tunnel-id>`,describe:`Adds or updates the configuration for a remotely-managed tunnel.`,builder:R_,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels cloudflared configurations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/configurations`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({config:{originRequest:{access:{audTag:e[`config-origin-request-access-aud-tag`],required:e[`config-origin-request-access-required`],teamName:f(e[`config-origin-request-access-team-name`],`config-origin-request-access-team-name`,`text`)},caPool:f(e[`config-origin-request-ca-pool`],`config-origin-request-ca-pool`,`text`),connectTimeout:e[`config-origin-request-connect-timeout`],disableChunkedEncoding:e[`config-origin-request-disable-chunked-encoding`],http2Origin:e[`config-origin-request-http2origin`],httpHostHeader:f(e[`config-origin-request-http-host-header`],`config-origin-request-http-host-header`,`text`),keepAliveConnections:e[`config-origin-request-keep-alive-connections`],keepAliveTimeout:e[`config-origin-request-keep-alive-timeout`],matchSNItoHost:e[`config-origin-request-match-snito-host`],noHappyEyeballs:e[`config-origin-request-no-happy-eyeballs`],noTLSVerify:e[`config-origin-request-no-tlsverify`],originServerName:f(e[`config-origin-request-origin-server-name`],`config-origin-request-origin-server-name`,`text`),proxyType:f(e[`config-origin-request-proxy-type`],`config-origin-request-proxy-type`,`text`),tcpKeepAlive:e[`config-origin-request-tcp-keep-alive`],tlsTimeout:e[`config-origin-request-tls-timeout`]}}}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.tunnels.cloudflared.configurations.update({...t,account_id:u,tunnel_id:e[`tunnel-id`]})),{successLabel:`Updated`});return}let p=d({config:{originRequest:{access:{audTag:e[`config-origin-request-access-aud-tag`],required:e[`config-origin-request-access-required`],teamName:f(e[`config-origin-request-access-team-name`],`config-origin-request-access-team-name`,`text`)},caPool:f(e[`config-origin-request-ca-pool`],`config-origin-request-ca-pool`,`text`),connectTimeout:e[`config-origin-request-connect-timeout`],disableChunkedEncoding:e[`config-origin-request-disable-chunked-encoding`],http2Origin:e[`config-origin-request-http2origin`],httpHostHeader:f(e[`config-origin-request-http-host-header`],`config-origin-request-http-host-header`,`text`),keepAliveConnections:e[`config-origin-request-keep-alive-connections`],keepAliveTimeout:e[`config-origin-request-keep-alive-timeout`],matchSNItoHost:e[`config-origin-request-match-snito-host`],noHappyEyeballs:e[`config-origin-request-no-happy-eyeballs`],noTLSVerify:e[`config-origin-request-no-tlsverify`],originServerName:f(e[`config-origin-request-origin-server-name`],`config-origin-request-origin-server-name`,`text`),proxyType:f(e[`config-origin-request-proxy-type`],`config-origin-request-proxy-type`,`text`),tcpKeepAlive:e[`config-origin-request-tcp-keep-alive`],tlsTimeout:e[`config-origin-request-tls-timeout`]}}});a(await s(`Updating`,async()=>r.zeroTrust.tunnels.cloudflared.configurations.update({...p,account_id:u,tunnel_id:e[`tunnel-id`]})),{successLabel:`Updated`})}},B_={command:`configurations`,describe:`Operations for tunnels.cloudflared.configurations`,builder:e=>e.command(L_).command(z_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function V_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`client-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const H_={command:`delete <tunnel-id>`,describe:`Removes a connection (aka Cloudflare Tunnel Connector) from a Cloudflare Tunnel independently of its current state. If no connector id (client_id) is provided all connectors will be removed. We recommend running this command after rotating tokens.`,builder:V_,handler:async e=>{let r={client_id:e[`client-id`]};if(e.dryRun){o({command:`cf zero-trust tunnels cloudflared connections delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/connections`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();if(e.accountId=u,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>l.zeroTrust.tunnels.cloudflared.connections.delete({account_id:u,tunnel_id:e[`tunnel-id`],...r})),{successLabel:`Deleted`})}};function U_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const W_={command:`get <tunnel-id>`,describe:`Fetches connection details for a Cloudflare Tunnel.`,builder:U_,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels cloudflared connections get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/connections`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.tunnels.cloudflared.connections.get({account_id:l,tunnel_id:e[`tunnel-id`]})),{successLabel:`Loaded`})}},G_={command:`connections`,describe:`Operations for tunnels.cloudflared.connections`,builder:e=>e.command(H_).command(W_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function K_(e){return e.positional(`connector-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`,demandOption:!0}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const q_={command:`get <connector-id>`,describe:`Fetches connector and connection details for a Cloudflare Tunnel.`,builder:K_,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels cloudflared connectors get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/connectors/${e[`connector-id`]==null?`<connector-id>`:encodeURIComponent(String(e[`connector-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``),"connector-id":String(e[`connector-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.tunnels.cloudflared.connectors.get({account_id:l,tunnel_id:e[`tunnel-id`],connector_id:e[`connector-id`]})),{successLabel:`Loaded`})}},J_={command:`connectors`,describe:`Operations for tunnels.cloudflared.connectors`,builder:e=>e.command(q_).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Y_(e){return e.option(`config-src`,{type:`string`,description:"Indicates if this is a locally or remotely configured tunnel. If `local`, manage the tunnel using a YAML file on the origin machine. If `cloudflare`, manage the tunnel on the Zero Trust dashboard.",choices:[`local`,`cloudflare`],default:`local`}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`tunnel-secret`,{type:`string`,description:`Sets the password required to run a locally-managed tunnel. Must be at least 32 bytes and encoded as a base64 string.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const X_={command:`create`,describe:`Creates a new Cloudflare Tunnel in an account.`,builder:Y_,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels cloudflared create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/cfd_tunnel`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({config_src:f(e[`config-src`],`config-src`,`text`),name:f(e.name,`name`,`text`),tunnel_secret:f(e[`tunnel-secret`],`tunnel-secret`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.tunnels.cloudflared.create({...t,account_id:u})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await h(`name`,`A user-friendly name for a tunnel.`));let p=d({config_src:f(e[`config-src`],`config-src`,`text`),name:f(e.name,`name`,`text`),tunnel_secret:f(e[`tunnel-secret`],`tunnel-secret`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.tunnels.cloudflared.create({...p,account_id:u})),{successLabel:`Created`})}};function Z_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Q_={command:`delete <tunnel-id>`,describe:`Deletes a Cloudflare Tunnel from an account.`,builder:Z_,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels cloudflared delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.tunnels.cloudflared.delete({account_id:l,tunnel_id:e[`tunnel-id`]})),{successLabel:`Deleted`})}};function $_(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`tunnel-secret`,{type:`string`,description:`Sets the password required to run a locally-managed tunnel. Must be at least 32 bytes and encoded as a base64 string.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ev={command:`edit <tunnel-id>`,describe:`Updates an existing Cloudflare Tunnel.`,builder:$_,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels cloudflared edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({name:f(e.name,`name`,`text`),tunnel_secret:f(e[`tunnel-secret`],`tunnel-secret`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.tunnels.cloudflared.edit({...t,account_id:u,tunnel_id:e[`tunnel-id`]})),{successLabel:`Updated`});return}let p=d({name:f(e.name,`name`,`text`),tunnel_secret:f(e[`tunnel-secret`],`tunnel-secret`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.tunnels.cloudflared.edit({...p,account_id:u,tunnel_id:e[`tunnel-id`]})),{successLabel:`Updated`})}};function tv(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const nv={command:`get <tunnel-id>`,describe:`Fetches a single Cloudflare Tunnel.`,builder:tv,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels cloudflared get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.tunnels.cloudflared.get({account_id:l,tunnel_id:e[`tunnel-id`]})),{successLabel:`Loaded`})}};function rv(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included."}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`uuid`,{type:`string`,description:`UUID of the tunnel.`}).option(`was-active-at`,{type:`string`,description:`Was active at`}).option(`was-inactive-at`,{type:`string`,description:`Was inactive at`}).option(`include-prefix`,{type:`string`,description:`Include prefix`}).option(`exclude-prefix`,{type:`string`,description:`Exclude prefix`}).option(`status`,{type:`string`,description:"The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).",choices:[`inactive`,`degraded`,`healthy`,`down`]}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const iv={command:`list`,describe:`Lists and filters Cloudflare Tunnels in an account.`,builder:_(rv),handler:async e=>{let r={name:e.name,is_deleted:e[`is-deleted`],existed_at:e[`existed-at`],uuid:e.uuid,was_active_at:e[`was-active-at`],was_inactive_at:e[`was-inactive-at`],include_prefix:e[`include-prefix`],exclude_prefix:e[`exclude-prefix`],status:e.status,per_page:e[`per-page`],page:e.page};if(e.dryRun){o({command:`cf zero-trust tunnels cloudflared list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/cfd_tunnel`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.tunnels.cloudflared.list({account_id:u,...r})),{successLabel:`Loaded`})}};function av(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`resources`,{type:`string`,array:!0,description:`The resources field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ov={command:`create <tunnel-id>`,describe:`Gets a management token used to access the management resources (i.e. Streaming Logs) of a tunnel.`,builder:av,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels cloudflared management create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/management`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({resources:e.resources}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.tunnels.cloudflared.management.create({...t,account_id:u,tunnel_id:e[`tunnel-id`]})),{successLabel:`Created`});return}if(e.resources===void 0)throw Error(`--resources is required (or pass --body with this field set).`);let f=d({resources:e.resources});a(await s(`Creating`,async()=>r.zeroTrust.tunnels.cloudflared.management.create({...f,account_id:u,tunnel_id:e[`tunnel-id`]})),{successLabel:`Created`})}},sv={command:`management`,describe:`Operations for tunnels.cloudflared.management`,builder:e=>e.command(ov).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function cv(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lv={command:`get <tunnel-id>`,describe:`Gets the token used to associate cloudflared with a specific tunnel.`,builder:cv,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels cloudflared token get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/cfd_tunnel/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/token`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.tunnels.cloudflared.token.get({account_id:l,tunnel_id:e[`tunnel-id`]})),{successLabel:`Loaded`})}},uv={command:`token`,describe:`Operations for tunnels.cloudflared.token`,builder:e=>e.command(lv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},dv={command:`cloudflared`,describe:`Operations for tunnels.cloudflared`,builder:e=>e.command(X_).command(Q_).command(ev).command(nv).command(iv).command(B_).command(G_).command(J_).command(sv).command(uv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function fv(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for the tunnel.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included."}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`uuid`,{type:`string`,description:`UUID of the tunnel.`}).option(`was-active-at`,{type:`string`,description:`Was active at`}).option(`was-inactive-at`,{type:`string`,description:`Was inactive at`}).option(`include-prefix`,{type:`string`,description:`Include prefix`}).option(`exclude-prefix`,{type:`string`,description:`Exclude prefix`}).option(`tun-types`,{type:`string`,description:`The types of tunnels to filter by, separated by commas.`}).option(`status`,{type:`string`,description:"The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).",choices:[`inactive`,`degraded`,`healthy`,`down`]}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const pv={command:`list`,describe:`Lists and filters all types of Tunnels in an account.`,builder:_(fv),handler:async e=>{let r={name:e.name,is_deleted:e[`is-deleted`],existed_at:e[`existed-at`],uuid:e.uuid,was_active_at:e[`was-active-at`],was_inactive_at:e[`was-inactive-at`],include_prefix:e[`include-prefix`],exclude_prefix:e[`exclude-prefix`],tun_types:e[`tun-types`],status:e.status,per_page:e[`per-page`],page:e.page};if(e.dryRun){o({command:`cf zero-trust tunnels list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/tunnels`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.tunnels.list({account_id:u,...r})),{successLabel:`Loaded`})}};function mv(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const hv={command:`get <tunnel-id>`,describe:`Fetches connection details for a WARP Connector Tunnel.`,builder:mv,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels warp-connector connections get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/connections`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.tunnels.warpConnector.connections.get({account_id:l,tunnel_id:e[`tunnel-id`]})),{successLabel:`Loaded`})}},gv={command:`connections`,describe:`Operations for tunnels.warp-connector.connections`,builder:e=>e.command(hv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function _v(e){return e.positional(`connector-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`,demandOption:!0}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const vv={command:`get <connector-id>`,describe:`Fetches connector and connection details for a WARP Connector Tunnel.`,builder:_v,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels warp-connector connectors get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/connectors/${e[`connector-id`]==null?`<connector-id>`:encodeURIComponent(String(e[`connector-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``),"connector-id":String(e[`connector-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.tunnels.warpConnector.connectors.get({account_id:l,tunnel_id:e[`tunnel-id`],connector_id:e[`connector-id`]})),{successLabel:`Loaded`})}},yv={command:`connectors`,describe:`Operations for tunnels.warp-connector.connectors`,builder:e=>e.command(vv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bv(e){return e.option(`ha`,{type:`boolean`,description:`Indicates that the tunnel will be created to be highly available. If omitted, defaults to false.`,default:!1}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const xv={command:`create`,describe:`Creates a new Warp Connector Tunnel in an account.`,builder:bv,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels warp-connector create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/warp_connector`,pathParams:{},bodyKind:`json`,body:e.body===void 0?d({ha:e.ha,name:f(e.name,`name`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Creating`,async()=>r.zeroTrust.tunnels.warpConnector.create({...t,account_id:u})),{successLabel:`Created`});return}e.name===void 0&&(e.name=await h(`name`,`A user-friendly name for a tunnel.`));let p=d({ha:e.ha,name:f(e.name,`name`,`text`)});a(await s(`Creating`,async()=>r.zeroTrust.tunnels.warpConnector.create({...p,account_id:u})),{successLabel:`Created`})}};function Sv(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Cv={command:`delete <tunnel-id>`,describe:`Deletes a Warp Connector Tunnel from an account.`,builder:Sv,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels warp-connector delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.tunnels.warpConnector.delete({account_id:l,tunnel_id:e[`tunnel-id`]})),{successLabel:`Deleted`})}};function wv(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`tunnel-secret`,{type:`string`,description:`Sets the password required to run a locally-managed tunnel. Must be at least 32 bytes and encoded as a base64 string.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Tv={command:`edit <tunnel-id>`,describe:`Updates an existing Warp Connector Tunnel.`,builder:wv,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels warp-connector edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({name:f(e.name,`name`,`text`),tunnel_secret:f(e[`tunnel-secret`],`tunnel-secret`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.tunnels.warpConnector.edit({...t,account_id:u,tunnel_id:e[`tunnel-id`]})),{successLabel:`Updated`});return}let p=d({name:f(e.name,`name`,`text`),tunnel_secret:f(e[`tunnel-secret`],`tunnel-secret`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.tunnels.warpConnector.edit({...p,account_id:u,tunnel_id:e[`tunnel-id`]})),{successLabel:`Updated`})}};function Ev(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`client-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Dv={command:`update <tunnel-id>`,describe:`Triggers a manual failover for a specific WARP Connector Tunnel, setting the specified client as the active connector. The tunnel must be configured for high availability (HA) and the client must be linked to the tunnel.`,builder:Ev,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels warp-connector failover update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/failover`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`json`,body:e.body===void 0?d({client_id:f(e[`client-id`],`client-id`,`text`)}):l(e.body)});return}let r=await i(e),u=e.local?c:await n();if(e.accountId=u,e.body){let t=l(e.body);a(await s(`Updating`,async()=>r.zeroTrust.tunnels.warpConnector.failover.update({...t,account_id:u,tunnel_id:e[`tunnel-id`]})),{successLabel:`Updated`});return}e[`client-id`]===void 0&&(e[`client-id`]=await h(`client-id`,`UUID of the Cloudflare Tunnel connector.`));let p=d({client_id:f(e[`client-id`],`client-id`,`text`)});a(await s(`Updating`,async()=>r.zeroTrust.tunnels.warpConnector.failover.update({...p,account_id:u,tunnel_id:e[`tunnel-id`]})),{successLabel:`Updated`})}},Ov={command:`failover`,describe:`Operations for tunnels.warp-connector.failover`,builder:e=>e.command(Dv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function kv(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Av={command:`get <tunnel-id>`,describe:`Fetches a single Warp Connector Tunnel.`,builder:kv,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels warp-connector get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.tunnels.warpConnector.get({account_id:l,tunnel_id:e[`tunnel-id`]})),{successLabel:`Loaded`})}};function jv(e){return e.option(`name`,{type:`string`,description:`A user-friendly name for the tunnel.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included."}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`uuid`,{type:`string`,description:`UUID of the tunnel.`}).option(`was-active-at`,{type:`string`,description:`Was active at`}).option(`was-inactive-at`,{type:`string`,description:`Was inactive at`}).option(`include-prefix`,{type:`string`,description:`Include prefix`}).option(`exclude-prefix`,{type:`string`,description:`Exclude prefix`}).option(`status`,{type:`string`,description:"The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).",choices:[`inactive`,`degraded`,`healthy`,`down`]}).option(`per-page`,{type:`number`,description:`Number of results to display.`}).option(`page`,{type:`number`,description:`Page number of paginated results.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Mv={command:`list`,describe:`Lists and filters Warp Connector Tunnels in an account.`,builder:_(jv),handler:async e=>{let r={name:e.name,is_deleted:e[`is-deleted`],existed_at:e[`existed-at`],uuid:e.uuid,was_active_at:e[`was-active-at`],was_inactive_at:e[`was-inactive-at`],include_prefix:e[`include-prefix`],exclude_prefix:e[`exclude-prefix`],status:e.status,per_page:e[`per-page`],page:e.page};if(e.dryRun){o({command:`cf zero-trust tunnels warp-connector list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/warp_connector`,pathParams:{},query:r,bodyKind:`none`});return}let l=await i(e),u=e.local?c:await n();e.accountId=u,a(await s(`Loading`,async()=>l.zeroTrust.tunnels.warpConnector.list({account_id:u,...r})),{successLabel:`Loaded`})}};function Nv(e){return e.positional(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pv={command:`get <tunnel-id>`,describe:`Gets the token used to associate warp device with a specific Warp Connector tunnel.`,builder:Nv,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust tunnels warp-connector token get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/warp_connector/${e[`tunnel-id`]==null?`<tunnel-id>`:encodeURIComponent(String(e[`tunnel-id`]))}/token`,pathParams:{"tunnel-id":String(e[`tunnel-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();e.accountId=l,a(await s(`Loading`,async()=>r.zeroTrust.tunnels.warpConnector.token.get({account_id:l,tunnel_id:e[`tunnel-id`]})),{successLabel:`Loaded`})}},Fv={command:`token`,describe:`Operations for tunnels.warp-connector.token`,builder:e=>e.command(Pv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Iv={command:`warp-connector`,describe:`Operations for tunnels.warp-connector`,builder:e=>e.command(xv).command(Cv).command(Tv).command(Av).command(Mv).command(gv).command(yv).command(Ov).command(Fv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Lv={command:`tunnels`,describe:`Operations for tunnels`,builder:e=>e.command(pv).command(dv).command(Iv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Rv(e){return e.positional(`authenticator-id`,{type:`string`,description:`The unique identifier for the MFA device.`,demandOption:!0}).option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const zv={command:`delete <authenticator-id>`,describe:`Deletes a specific MFA device, including a PIV key or FIDO2 key enrollment, for a user. This action is only available if MFA is turned on for the organization. Successful deletion revokes the enrollment and returns a null result.`,builder:Rv,handler:async e=>{if(e.dryRun){o({command:`cf zero-trust users mfa authenticators delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await t()??`<account-id>`}/access/users/${e[`user-id`]==null?`<user-id>`:encodeURIComponent(String(e[`user-id`]))}/mfa_authenticators/${e[`authenticator-id`]==null?`<authenticator-id>`:encodeURIComponent(String(e[`authenticator-id`]))}`,pathParams:{"user-id":String(e[`user-id`]??``),"authenticator-id":String(e[`authenticator-id`]??``)},bodyKind:`none`});return}let r=await i(e),l=e.local?c:await n();if(e.accountId=l,!await g({force:!!e.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r.zeroTrust.users.mfa.authenticators.delete({account_id:l,user_id:e[`user-id`],authenticator_id:e[`authenticator-id`]})),{successLabel:`Deleted`})}},Bv={command:`authenticators`,describe:`Operations for users.mfa.authenticators`,builder:e=>e.command(zv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Vv={command:`mfa`,describe:`Operations for users.mfa`,builder:e=>e.command(Bv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Hv={command:`users`,describe:`Operations for users`,builder:e=>e.command(Vv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Uv(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Wv={command:`create`,describe:`Adds a new identity provider to Access.`,builder:Uv,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust zone-identity-providers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/identity_providers`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?void 0:l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=l(t.body);a(await s(`Creating`,async()=>n.zeroTrust.zoneIdentityProviders.create({body:e,zone_id:r})),{successLabel:`Created`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Gv(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Kv={command:`delete <identity-provider-id>`,describe:`Deletes an identity provider from Access.`,builder:Gv,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust zone-identity-providers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/identity_providers/${t[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(t[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(t[`identity-provider-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,!await g({force:!!t.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>n.zeroTrust.zoneIdentityProviders.delete({zone_id:r,identity_provider_id:t[`identity-provider-id`]})),{successLabel:`Deleted`})}};function qv(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jv={command:`get <identity-provider-id>`,describe:`Fetches a configured identity provider.`,builder:qv,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust zone-identity-providers get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/identity_providers/${t[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(t[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(t[`identity-provider-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.zoneIdentityProviders.get({zone_id:r,identity_provider_id:t[`identity-provider-id`]})),{successLabel:`Loaded`})}};function Yv(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xv={command:`list`,describe:`Lists all configured identity providers.`,builder:Yv,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust zone-identity-providers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/identity_providers`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.zoneIdentityProviders.list({zone_id:r})),{successLabel:`Loaded`})}};function Zv(e){return e.positional(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Qv={command:`update <identity-provider-id>`,describe:`Updates a configured identity provider.`,builder:Zv,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust zone-identity-providers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/identity_providers/${t[`identity-provider-id`]==null?`<identity-provider-id>`:encodeURIComponent(String(t[`identity-provider-id`]))}`,pathParams:{"identity-provider-id":String(t[`identity-provider-id`]??``),"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?void 0:l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=l(t.body);a(await s(`Updating`,async()=>n.zeroTrust.zoneIdentityProviders.update({body:e,zone_id:r,identity_provider_id:t[`identity-provider-id`]})),{successLabel:`Updated`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},$v={command:`zone-identity-providers`,describe:`Operations for zone-identity-providers`,builder:e=>e.command(Wv).command(Kv).command(Jv).command(Xv).command(Qv).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ey(e){return e.option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ty={command:`create`,describe:`Sets up a Zero Trust organization for your account.`,builder:ey,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust zone-organizations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/organizations`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?d({auth_domain:f(t[`auth-domain`],`auth-domain`,`text`),is_ui_read_only:t[`is-ui-read-only`],login_design:{background_color:f(t[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(t[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(t[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(t[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(t[`login-design-text-color`],`login-design-text-color`,`text`)},name:f(t.name,`name`,`text`),ui_read_only_toggle_reason:f(t[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(t[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)}):l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=l(t.body);a(await s(`Creating`,async()=>n.zeroTrust.zoneOrganizations.create({...e,zone_id:r})),{successLabel:`Created`});return}t[`auth-domain`]===void 0&&(t[`auth-domain`]=await h(`auth-domain`,`The unique subdomain assigned to your Zero Trust organization.`)),t.name===void 0&&(t.name=await h(`name`,`The name of your Zero Trust organization.`));let c=d({auth_domain:f(t[`auth-domain`],`auth-domain`,`text`),is_ui_read_only:t[`is-ui-read-only`],login_design:{background_color:f(t[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(t[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(t[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(t[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(t[`login-design-text-color`],`login-design-text-color`,`text`)},name:f(t.name,`name`,`text`),ui_read_only_toggle_reason:f(t[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(t[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)});a(await s(`Creating`,async()=>n.zeroTrust.zoneOrganizations.create({...c,zone_id:r})),{successLabel:`Created`})}};function ny(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ry={command:`get`,describe:`Returns the configuration for your Zero Trust organization.`,builder:ny,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust zone-organizations get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/organizations`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`none`});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});t.zoneId=r,a(await s(`Loading`,async()=>n.zeroTrust.zoneOrganizations.get({zone_id:r})),{successLabel:`Loaded`})}};function iy(e){return e.option(`email`,{type:`string`,description:`The email of the user to revoke.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ay={command:`revoke-user-create`,describe:`Revokes a user's access across all applications.`,builder:iy,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust zone-organizations revoke-user-create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/organizations/revoke_user`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?d({email:f(t.email,`email`,`text`)}):l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,!await g({force:!!t.force,message:`This operation revokes all access tokens for a user, affecting their access to all applications within the zone.`})){process.stderr.write(`Aborted.
+`);return}if(t.body){let e=l(t.body);a(await s(`Deleting`,async()=>n.zeroTrust.zoneOrganizations.revokeUserCreate({...e,zone_id:r})),{successLabel:`Deleted`});return}t.email===void 0&&(t.email=await h(`email`,`The email of the user to revoke.`));let c=d({email:f(t.email,`email`,`text`)});a(await s(`Deleting`,async()=>n.zeroTrust.zoneOrganizations.revokeUserCreate({...c,zone_id:r})),{successLabel:`Deleted`})}};function oy(e){return e.option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const sy={command:`update`,describe:`Updates the configuration for your Zero Trust organization.`,builder:oy,handler:async t=>{if(t.dryRun){o({command:`cf zero-trust zone-organizations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${t.zone??t.zoneId??`<zone>`}/access/organizations`,pathParams:{"zone-id":String(t.zone??t[`zone-id`]??``)},bodyKind:`json`,body:t.body===void 0?d({auth_domain:f(t[`auth-domain`],`auth-domain`,`text`),is_ui_read_only:t[`is-ui-read-only`],login_design:{background_color:f(t[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(t[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(t[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(t[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(t[`login-design-text-color`],`login-design-text-color`,`text`)},name:f(t.name,`name`,`text`),ui_read_only_toggle_reason:f(t[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(t[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)}):l(t.body)});return}let n=await i(t),r=await e({zone:t.zone},n,{quiet:t.quiet});if(t.zoneId=r,t.body){let e=l(t.body);a(await s(`Updating`,async()=>n.zeroTrust.zoneOrganizations.update({...e,zone_id:r})),{successLabel:`Updated`});return}let c=d({auth_domain:f(t[`auth-domain`],`auth-domain`,`text`),is_ui_read_only:t[`is-ui-read-only`],login_design:{background_color:f(t[`login-design-background-color`],`login-design-background-color`,`text`),footer_text:f(t[`login-design-footer-text`],`login-design-footer-text`,`text`),header_text:f(t[`login-design-header-text`],`login-design-header-text`,`text`),logo_path:f(t[`login-design-logo-path`],`login-design-logo-path`,`text`),text_color:f(t[`login-design-text-color`],`login-design-text-color`,`text`)},name:f(t.name,`name`,`text`),ui_read_only_toggle_reason:f(t[`ui-read-only-toggle-reason`],`ui-read-only-toggle-reason`,`text`),user_seat_expiration_inactive_time:f(t[`user-seat-expiration-inactive-time`],`user-seat-expiration-inactive-time`,`text`)});a(await s(`Updating`,async()=>n.zeroTrust.zoneOrganizations.update({...c,zone_id:r})),{successLabel:`Updated`})}},cy={command:`zone-organizations`,describe:`Operations for zone-organizations`,builder:e=>e.command(ty).command(ry).command(ay).command(sy).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ly={command:`zero-trust`,describe:`Cloudflare's SASE platform — secure access, device posture, DLP, tunnels, gateway policies, and network segmentation`,builder:e=>e.command(jr).command(Mi).command(aa).command(xa).command(Ea).command(Pc).command(pu).command(lf).command(Df).command(km).command(Bm).command(ih).command(mg).command(Og).command(zg).command(f_).command(h_).command(E_).command(F_).command(Lv).command(Hv).command($v).command(cy).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{ly as default};