cf 0.9.1 → 0.10.0

package/dist/{magic-transit-DwgZeIj-.mjs → magic-transit-BtsFePMx.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{t as e}from"./local-DTyuGwTw.mjs";import{f as t,g as n}from"./oauth-BPizUUqP.mjs";import{a as r,r as i}from"./auth-DuLchM18.mjs";import{t as a}from"./output-DgW1hQGX.mjs";import{n as o,t as s}from"./progress-B84wYh91.mjs";import{n as c,r as l,t as u}from"./body-parser-CYD7PKFC.mjs";import{n as d}from"./input-validation-BBKJRoRB.mjs";import{a as f,i as p,n as m}from"./prompt-CDtLWxNv.mjs";import{n as h,t as g}from"./raw-fetch-Dz-QBoP_.mjs";function _(e){return e.option(`block-any-queries`,{type:`boolean`,description:`Whether to block DNS ANY queries. Optional. Defaults to true.`}).option(`burst-sensitivity`,{type:`string`,description:`The burst sensitivity. Must be one of 'low', 'medium', 'high'.`}).option(`mode`,{type:`string`,description:`The mode for DNS Protection. Must be one of 'enabled', 'disabled', 'monitoring'.`}).option(`name`,{type:`string`,description:`The name of the DNS Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'.`}).option(`profile-sensitivity`,{type:`string`,description:`The profile sensitivity. Recommended setting is 'low'. Must be one of 'low', 'medium', 'high', or 'very_high'.`}).option(`rate-sensitivity`,{type:`string`,description:`The rate sensitivity. Must be one of 'low', 'medium', 'high'.`}).option(`scope`,{type:`string`,description:`The scope for the DNS Protection rule. Must be one of 'global', 'region', or 'datacenter'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The new DNS Protection rule to add.`})}const ee={command:`create`,describe:`Create a DNS Protection rule for an account.`,builder:_,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-dns-protection configs dns protection rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?u({block_any_queries:r[`block-any-queries`],burst_sensitivity:d(r[`burst-sensitivity`],`burst-sensitivity`,`text`),mode:d(r.mode,`mode`,`text`),name:d(r.name,`name`,`text`),profile_sensitivity:d(r[`profile-sensitivity`],`profile-sensitivity`,`text`),rate_sensitivity:d(r[`rate-sensitivity`],`rate-sensitivity`,`text`),scope:d(r.scope,`scope`,`text`)}):c(r.body)});return}let l=await i(r),p=r.local?e:await t();if(r.accountId=p,r.body){let e=c(r.body);a(await s(`Creating`,async()=>l.magicTransit.advancedDnsProtection.configs.dns.protection.rules.create({...e,account_id:p})),{successLabel:`Created`});return}r[`burst-sensitivity`]===void 0&&(r[`burst-sensitivity`]=await f(`burst-sensitivity`,`The burst sensitivity. Must be one of 'low', 'medium', 'high'.`)),r.mode===void 0&&(r.mode=await f(`mode`,`The mode for DNS Protection. Must be one of 'enabled', 'disabled', 'monitoring'.`)),r.name===void 0&&(r.name=await f(`name`,`The name of the DNS Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'.`)),r[`profile-sensitivity`]===void 0&&(r[`profile-sensitivity`]=await f(`profile-sensitivity`,`The profile sensitivity. Recommended setting is 'low'. Must be one of 'low', 'medium', 'high', or 'very_high'.`)),r[`rate-sensitivity`]===void 0&&(r[`rate-sensitivity`]=await f(`rate-sensitivity`,`The rate sensitivity. Must be one of 'low', 'medium', 'high'.`)),r.scope===void 0&&(r.scope=await f(`scope`,`The scope for the DNS Protection rule. Must be one of 'global', 'region', or 'datacenter'.`));let m=u({block_any_queries:r[`block-any-queries`],burst_sensitivity:d(r[`burst-sensitivity`],`burst-sensitivity`,`text`),mode:d(r.mode,`mode`,`text`),name:d(r.name,`name`,`text`),profile_sensitivity:d(r[`profile-sensitivity`],`profile-sensitivity`,`text`),rate_sensitivity:d(r[`rate-sensitivity`],`rate-sensitivity`,`text`),scope:d(r.scope,`scope`,`text`)});a(await s(`Creating`,async()=>l.magicTransit.advancedDnsProtection.configs.dns.protection.rules.create({...m,account_id:p})),{successLabel:`Created`})}};function te(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const v={command:`account`,describe:`Delete all DNS Protection rules for an account.`,builder:te,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-dns-protection configs dns protection rules delete for account`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await m({force:!!r.force})){process.stderr.write(`Aborted.
+import{t as e}from"./local-D-aVNu6A.mjs";import{f as t,g as n}from"./oauth-B0ETkNcX.mjs";import{a as r,r as i}from"./auth-MQEamPN9.mjs";import{t as a}from"./output-DrpYYfnB.mjs";import{n as o,t as s}from"./progress-CsHIt3Tp.mjs";import{n as c,r as l,t as u}from"./body-parser-C-c9gfH1.mjs";import{n as d}from"./input-validation-Bav2M9F-.mjs";import{a as f,i as p,n as m}from"./prompt-DdegNPpg.mjs";import{n as h,t as g}from"./raw-fetch-CteyTOM2.mjs";function _(e){return e.option(`block-any-queries`,{type:`boolean`,description:`Whether to block DNS ANY queries. Optional. Defaults to true.`}).option(`burst-sensitivity`,{type:`string`,description:`The burst sensitivity. Must be one of 'low', 'medium', 'high'.`}).option(`mode`,{type:`string`,description:`The mode for DNS Protection. Must be one of 'enabled', 'disabled', 'monitoring'.`}).option(`name`,{type:`string`,description:`The name of the DNS Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'.`}).option(`profile-sensitivity`,{type:`string`,description:`The profile sensitivity. Recommended setting is 'low'. Must be one of 'low', 'medium', 'high', or 'very_high'.`}).option(`rate-sensitivity`,{type:`string`,description:`The rate sensitivity. Must be one of 'low', 'medium', 'high'.`}).option(`scope`,{type:`string`,description:`The scope for the DNS Protection rule. Must be one of 'global', 'region', or 'datacenter'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The new DNS Protection rule to add.`})}const ee={command:`create`,describe:`Create a DNS Protection rule for an account.`,builder:_,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-dns-protection configs dns protection rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?u({block_any_queries:r[`block-any-queries`],burst_sensitivity:d(r[`burst-sensitivity`],`burst-sensitivity`,`text`),mode:d(r.mode,`mode`,`text`),name:d(r.name,`name`,`text`),profile_sensitivity:d(r[`profile-sensitivity`],`profile-sensitivity`,`text`),rate_sensitivity:d(r[`rate-sensitivity`],`rate-sensitivity`,`text`),scope:d(r.scope,`scope`,`text`)}):c(r.body)});return}let l=await i(r),p=r.local?e:await t();if(r.accountId=p,r.body){let e=c(r.body);a(await s(`Creating`,async()=>l.magicTransit.advancedDnsProtection.configs.dns.protection.rules.create({...e,account_id:p})),{successLabel:`Created`});return}r[`burst-sensitivity`]===void 0&&(r[`burst-sensitivity`]=await f(`burst-sensitivity`,`The burst sensitivity. Must be one of 'low', 'medium', 'high'.`)),r.mode===void 0&&(r.mode=await f(`mode`,`The mode for DNS Protection. Must be one of 'enabled', 'disabled', 'monitoring'.`)),r.name===void 0&&(r.name=await f(`name`,`The name of the DNS Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'.`)),r[`profile-sensitivity`]===void 0&&(r[`profile-sensitivity`]=await f(`profile-sensitivity`,`The profile sensitivity. Recommended setting is 'low'. Must be one of 'low', 'medium', 'high', or 'very_high'.`)),r[`rate-sensitivity`]===void 0&&(r[`rate-sensitivity`]=await f(`rate-sensitivity`,`The rate sensitivity. Must be one of 'low', 'medium', 'high'.`)),r.scope===void 0&&(r.scope=await f(`scope`,`The scope for the DNS Protection rule. Must be one of 'global', 'region', or 'datacenter'.`));let m=u({block_any_queries:r[`block-any-queries`],burst_sensitivity:d(r[`burst-sensitivity`],`burst-sensitivity`,`text`),mode:d(r.mode,`mode`,`text`),name:d(r.name,`name`,`text`),profile_sensitivity:d(r[`profile-sensitivity`],`profile-sensitivity`,`text`),rate_sensitivity:d(r[`rate-sensitivity`],`rate-sensitivity`,`text`),scope:d(r.scope,`scope`,`text`)});a(await s(`Creating`,async()=>l.magicTransit.advancedDnsProtection.configs.dns.protection.rules.create({...m,account_id:p})),{successLabel:`Created`})}};function te(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const v={command:`account`,describe:`Delete all DNS Protection rules for an account.`,builder:te,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-dns-protection configs dns protection rules delete for account`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await m({force:!!r.force})){process.stderr.write(`Aborted.
 `);return}a(await s(`Deleting`,async()=>c.magicTransit.advancedDnsProtection.configs.dns.protection.rules.delete.for.account({account_id:l})),{successLabel:`Deleted`})}},y={command:`for`,describe:`Operations for advanced-dns-protection.configs.dns.protection.rules.delete.for`,builder:e=>e.command(v).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function b(e){return e.positional(`rule-id`,{type:`string`,description:`The UUID of the DNS Protection rule to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const x={command:`rule <rule-id>`,describe:`Delete a DNS Protection rule specified by the given UUID.`,builder:b,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-dns-protection configs dns protection rules delete protection rule`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await m({force:!!r.force})){process.stderr.write(`Aborted.
 `);return}a(await s(`Deleting`,async()=>c.magicTransit.advancedDnsProtection.configs.dns.protection.rules.delete.protection.rule({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Deleted`})}},S={command:`protection`,describe:`Operations for advanced-dns-protection.configs.dns.protection.rules.delete.protection`,builder:e=>e.command(x).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},C={command:`delete`,describe:`Operations for advanced-dns-protection.configs.dns.protection.rules.delete`,builder:e=>e.command(y).command(S).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function w(e){return e.positional(`rule-id`,{type:`string`,description:`The UUID of the DNS Protection rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const T={command:`get <rule-id>`,describe:`Get a DNS Protection rule specified by the given UUID.`,builder:w,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-dns-protection configs dns protection rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.advancedDnsProtection.configs.dns.protection.rules.get({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Loaded`})}};function E(e){return e.option(`page`,{type:`number`,description:`The page number for pagination. Defaults to 1.`}).option(`per-page`,{type:`number`,description:`The number of items per page. Must be between 10 and 1000. Defaults to 25.`}).option(`order`,{type:`string`,description:`The field to order by. Defaults to 'prefix'.`}).option(`direction`,{type:`string`,description:`The direction of ordering (ASC or DESC). Defaults to 'ASC'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const D={command:`list`,describe:`List all DNS Protection rules for an account.`,builder:E,handler:async r=>{let c={page:r.page,per_page:r[`per-page`],order:r.order,direction:r.direction};if(r.dryRun){o({command:`cf magic-transit advanced-dns-protection configs dns protection rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules`,pathParams:{},query:c,bodyKind:`none`});return}let l=await i(r),u=r.local?e:await t();r.accountId=u,a(await s(`Loading`,async()=>l.magicTransit.advancedDnsProtection.configs.dns.protection.rules.list({account_id:u,...c})),{successLabel:`Loaded`})}};function O(e){return e.positional(`rule-id`,{type:`string`,description:`The UUID of the DNS Protection rule to update.`,demandOption:!0}).option(`block-any-queries`,{type:`boolean`,description:`The new value for whether to block DNS ANY queries. Optional.`}).option(`burst-sensitivity`,{type:`string`,description:`The new burst sensitivity. Optional. Must be one of 'low', 'medium', 'high'.`}).option(`mode`,{type:`string`,description:`The new mode for DNS Protection. Optional. Must be one of 'enabled', 'disabled', 'monitoring'.`}).option(`profile-sensitivity`,{type:`string`,description:`The new profile sensitivity. Optional. Recommended setting is 'low'. Must be one of 'low', 'medium', 'high', or 'very_high'.`}).option(`rate-sensitivity`,{type:`string`,description:`The new rate sensitivity. Optional. Must be one of 'low', 'medium', 'high'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updates to apply to the DNS Protection rule.`})}const k={command:`update <rule-id>`,describe:`Update a DNS Protection rule specified by the given UUID.`,builder:O,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-dns-protection configs dns protection rules update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({block_any_queries:r[`block-any-queries`],burst_sensitivity:d(r[`burst-sensitivity`],`burst-sensitivity`,`text`),mode:d(r.mode,`mode`,`text`),profile_sensitivity:d(r[`profile-sensitivity`],`profile-sensitivity`,`text`),rate_sensitivity:d(r[`rate-sensitivity`],`rate-sensitivity`,`text`)}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Updating`,async()=>l.magicTransit.advancedDnsProtection.configs.dns.protection.rules.update({...e,account_id:f,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}let p=u({block_any_queries:r[`block-any-queries`],burst_sensitivity:d(r[`burst-sensitivity`],`burst-sensitivity`,`text`),mode:d(r.mode,`mode`,`text`),profile_sensitivity:d(r[`profile-sensitivity`],`profile-sensitivity`,`text`),rate_sensitivity:d(r[`rate-sensitivity`],`rate-sensitivity`,`text`)});a(await s(`Updating`,async()=>l.magicTransit.advancedDnsProtection.configs.dns.protection.rules.update({...p,account_id:f,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},A={command:`rules`,describe:`Operations for advanced-dns-protection.configs.dns.protection.rules`,builder:e=>e.command(ee).command(T).command(D).command(k).command(C).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},j={command:`protection`,describe:`Operations for advanced-dns-protection.configs.dns.protection`,builder:e=>e.command(A).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},M={command:`dns`,describe:`Operations for advanced-dns-protection.configs.dns`,builder:e=>e.command(j).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},N={command:`configs`,describe:`Operations for advanced-dns-protection.configs`,builder:e=>e.command(M).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},P={command:`advanced-dns-protection`,describe:`Advanced Dns Protection operations`,builder:e=>e.command(N).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function F(e){return e.option(`comment`,{type:`string`,description:`An comment describing the allowlist prefix.`}).option(`enabled`,{type:`boolean`,description:`Whether to enable the allowlist prefix into effect.`}).option(`prefix`,{type:`string`,description:`The allowlist prefix to add in CIDR format.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The new allowlist prefix to create.`})}const I={command:`create`,describe:`Create an allowlist prefix for an account.`,builder:F,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs allowlist create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/allowlist`,pathParams:{},bodyKind:`json`,body:r.body===void 0?u({comment:d(r.comment,`comment`,`text`),enabled:r.enabled,prefix:d(r.prefix,`prefix`,`text`)}):c(r.body)});return}let l=await i(r),p=r.local?e:await t();if(r.accountId=p,r.body){let e=c(r.body);a(await s(`Creating`,async()=>l.magicTransit.advancedTcpProtection.configs.allowlist.create({...e,account_id:p})),{successLabel:`Created`});return}if(r.comment===void 0&&(r.comment=await f(`comment`,`An comment describing the allowlist prefix.`)),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.prefix===void 0&&(r.prefix=await f(`prefix`,`The allowlist prefix to add in CIDR format.`));let m=u({comment:d(r.comment,`comment`,`text`),enabled:r.enabled,prefix:d(r.prefix,`prefix`,`text`)});a(await s(`Creating`,async()=>l.magicTransit.advancedTcpProtection.configs.allowlist.create({...m,account_id:p})),{successLabel:`Created`})}};function L(e){return e.positional(`prefix-id`,{type:`string`,description:`The UUID of the allowlist prefix to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const R={command:`prefix <prefix-id>`,describe:`Delete the allowlist prefix for an account given a UUID.`,builder:L,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs allowlist delete allowlist prefix`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/allowlist/${r[`prefix-id`]==null?`<prefix-id>`:encodeURIComponent(String(r[`prefix-id`]))}`,pathParams:{"prefix-id":String(r[`prefix-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await m({force:!!r.force})){process.stderr.write(`Aborted.
 `);return}a(await s(`Deleting`,async()=>c.magicTransit.advancedTcpProtection.configs.allowlist.delete.allowlist.prefix({account_id:l,prefix_id:r[`prefix-id`]})),{successLabel:`Deleted`})}},z={command:`allowlist`,describe:`Operations for advanced-tcp-protection.configs.allowlist.delete.allowlist`,builder:e=>e.command(R).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function B(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const V={command:`account`,describe:`Delete all allowlist prefixes for an account.`,builder:B,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs allowlist delete for account`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/allowlist`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await m({force:!!r.force})){process.stderr.write(`Aborted.
@@ -51,7 +51,7 @@ character:
 In other words, MD5 keys may contain any printable ASCII character aside from newline (0x0A),
 quotation mark (\`"\`), vertical tab (0x0B), carriage return (0x0D), tab (0x09), form feed
 (0x0C), and the question mark (\`?\`). Requests specifying an MD5 key with one or more of
-these disallowed characters will be rejected.`}).option(`cloudflare-gre-endpoint`,{type:`string`,description:`The IP address assigned to the Cloudflare side of the GRE tunnel.`}).option(`customer-gre-endpoint`,{type:`string`,description:`The IP address assigned to the customer side of the GRE tunnel.`}).option(`description`,{type:`string`,description:`An optional description of the GRE tunnel.`}).option(`health-check-enabled`,{type:`boolean`,description:`Determines whether to run healthchecks for a tunnel.`,default:!0}).option(`health-check-rate`,{type:`string`,description:"How frequent the health check is run. The default value is `mid`.",choices:[`low`,`mid`,`high`],default:`mid`}).option(`health-check-target-saved`,{type:`string`,description:`The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.`}).option(`health-check-type`,{type:`string`,description:"The type of healthcheck to run, reply or request. The default value is `reply`.",choices:[`reply`,`request`],default:`reply`}).option(`health-check-direction`,{type:`string`,description:`The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.`,choices:[`unidirectional`,`bidirectional`],default:`unidirectional`}).option(`interface-address`,{type:`string`,description:`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`}).option(`interface-address6`,{type:`string`,description:`A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127`}).option(`mtu`,{type:`number`,description:`Maximum Transmission Unit (MTU) in bytes for the GRE tunnel. The minimum value is 576.`,default:1476}).option(`name`,{type:`string`,description:`The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.`}).option(`ttl`,{type:`number`,description:`Time To Live (TTL) in number of hops of the GRE tunnel.`,default:64}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`bgp-customer-asn`,`bgp-export-filter-id`,`bgp-extra-prefixes`,`bgp-import-filter-id`,`bgp-md5-key`].some(t=>e[t]!==void 0)){let t=[`bgp-customer-asn`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --bgp-* flag is set`)}return!0})}const Hn={command:`create`,describe:"Creates a new GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:Vn,handler:async p=>{let m={};if(p[`x-magic-new-hc-target`]!==void 0&&(m[`x-magic-new-hc-target`]=String(p[`x-magic-new-hc-target`])),p.dryRun){o({command:`cf magic-transit gre-tunnels create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/gre_tunnels`,pathParams:{},bodyKind:`json`,body:p.body===void 0?u({automatic_return_routing:p[`automatic-return-routing`],bgp:{customer_asn:p[`bgp-customer-asn`],export_filter_id:d(p[`bgp-export-filter-id`],`bgp-export-filter-id`,`text`),extra_prefixes:p[`bgp-extra-prefixes`],import_filter_id:d(p[`bgp-import-filter-id`],`bgp-import-filter-id`,`text`),md5_key:d(p[`bgp-md5-key`],`bgp-md5-key`,`text`)},cloudflare_gre_endpoint:d(p[`cloudflare-gre-endpoint`],`cloudflare-gre-endpoint`,`text`),customer_gre_endpoint:d(p[`customer-gre-endpoint`],`customer-gre-endpoint`,`text`),description:d(p.description,`description`,`text`),health_check:{enabled:p[`health-check-enabled`],rate:d(p[`health-check-rate`],`health-check-rate`,`text`),target:{saved:d(p[`health-check-target-saved`],`health-check-target-saved`,`text`)},type:d(p[`health-check-type`],`health-check-type`,`text`),direction:d(p[`health-check-direction`],`health-check-direction`,`text`)},interface_address:d(p[`interface-address`],`interface-address`,`text`),interface_address6:d(p[`interface-address6`],`interface-address6`,`text`),mtu:p.mtu,name:d(p.name,`name`,`text`),ttl:p.ttl}):c(p.body)});return}let h=await i(p),g=p.local?e:await t();if(p.accountId=g,p.body){let e=c(p.body);a(await s(`Creating`,async()=>r(h,`POST`,`/accounts/${g}/magic/gre_tunnels`,{body:e,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Created`});return}p[`cloudflare-gre-endpoint`]===void 0&&(p[`cloudflare-gre-endpoint`]=await f(`cloudflare-gre-endpoint`,`The IP address assigned to the Cloudflare side of the GRE tunnel.`)),p[`customer-gre-endpoint`]===void 0&&(p[`customer-gre-endpoint`]=await f(`customer-gre-endpoint`,`The IP address assigned to the customer side of the GRE tunnel.`)),p[`interface-address`]===void 0&&(p[`interface-address`]=await f(`interface-address`,`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`)),p.name===void 0&&(p.name=await f(`name`,`The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.`));let _={};p[`automatic-return-routing`]!==void 0&&l(_,[`automatic_return_routing`],p[`automatic-return-routing`]),p[`bgp-customer-asn`]!==void 0&&l(_,[`bgp`,`customer_asn`],p[`bgp-customer-asn`]),p[`bgp-export-filter-id`]!==void 0&&l(_,[`bgp`,`export_filter_id`],d(p[`bgp-export-filter-id`],`bgp-export-filter-id`,`text`)),p[`bgp-extra-prefixes`]!==void 0&&l(_,[`bgp`,`extra_prefixes`],p[`bgp-extra-prefixes`]),p[`bgp-import-filter-id`]!==void 0&&l(_,[`bgp`,`import_filter_id`],d(p[`bgp-import-filter-id`],`bgp-import-filter-id`,`text`)),p[`bgp-md5-key`]!==void 0&&l(_,[`bgp`,`md5_key`],d(p[`bgp-md5-key`],`bgp-md5-key`,`text`)),p[`cloudflare-gre-endpoint`]!==void 0&&l(_,[`cloudflare_gre_endpoint`],d(p[`cloudflare-gre-endpoint`],`cloudflare-gre-endpoint`,`text`)),p[`customer-gre-endpoint`]!==void 0&&l(_,[`customer_gre_endpoint`],d(p[`customer-gre-endpoint`],`customer-gre-endpoint`,`text`)),p.description!==void 0&&l(_,[`description`],d(p.description,`description`,`text`)),p[`health-check-enabled`]!==void 0&&l(_,[`health_check`,`enabled`],p[`health-check-enabled`]),p[`health-check-rate`]!==void 0&&l(_,[`health_check`,`rate`],d(p[`health-check-rate`],`health-check-rate`,`text`)),p[`health-check-target-saved`]!==void 0&&l(_,[`health_check`,`target`,`saved`],d(p[`health-check-target-saved`],`health-check-target-saved`,`text`)),p[`health-check-type`]!==void 0&&l(_,[`health_check`,`type`],d(p[`health-check-type`],`health-check-type`,`text`)),p[`health-check-direction`]!==void 0&&l(_,[`health_check`,`direction`],d(p[`health-check-direction`],`health-check-direction`,`text`)),p[`interface-address`]!==void 0&&l(_,[`interface_address`],d(p[`interface-address`],`interface-address`,`text`)),p[`interface-address6`]!==void 0&&l(_,[`interface_address6`],d(p[`interface-address6`],`interface-address6`,`text`)),p.mtu!==void 0&&l(_,[`mtu`],p.mtu),p.name!==void 0&&l(_,[`name`],d(p.name,`name`,`text`)),p.ttl!==void 0&&l(_,[`ttl`],p.ttl),a(await s(`Creating`,async()=>r(h,`POST`,`/accounts/${g}/magic/gre_tunnels`,{body:Object.keys(_).length>0?_:void 0,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Created`})}};function Un(e){return e.positional(`gre-tunnel-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Wn={command:`delete <gre-tunnel-id>`,describe:"Disables and removes a specific static GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:Un,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit gre-tunnels delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/gre_tunnels/${c[`gre-tunnel-id`]==null?`<gre-tunnel-id>`:encodeURIComponent(String(c[`gre-tunnel-id`]))}`,pathParams:{"gre-tunnel-id":String(c[`gre-tunnel-id`]??``)},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();if(c.accountId=d,!await m({force:!!c.force})){process.stderr.write(`Aborted.
+these disallowed characters will be rejected.`}).option(`cloudflare-gre-endpoint`,{type:`string`,description:`The IP address assigned to the Cloudflare side of the GRE tunnel.`}).option(`customer-gre-endpoint`,{type:`string`,description:`The IP address assigned to the customer side of the GRE tunnel.`}).option(`description`,{type:`string`,description:`An optional description of the GRE tunnel.`}).option(`health-check-enabled`,{type:`boolean`,description:`Determines whether to run healthchecks for a tunnel.`}).option(`health-check-rate`,{type:`string`,description:"How frequent the health check is run. The default value is `mid`.",choices:[`low`,`mid`,`high`]}).option(`health-check-target-saved`,{type:`string`,description:`The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.`}).option(`health-check-type`,{type:`string`,description:"The type of healthcheck to run, reply or request. The default value is `reply`.",choices:[`reply`,`request`]}).option(`health-check-direction`,{type:`string`,description:`The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.`,choices:[`unidirectional`,`bidirectional`]}).option(`interface-address`,{type:`string`,description:`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`}).option(`interface-address6`,{type:`string`,description:`A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127`}).option(`mtu`,{type:`number`,description:`Maximum Transmission Unit (MTU) in bytes for the GRE tunnel. The minimum value is 576.`,default:1476}).option(`name`,{type:`string`,description:`The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.`}).option(`ttl`,{type:`number`,description:`Time To Live (TTL) in number of hops of the GRE tunnel.`,default:64}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`bgp-customer-asn`,`bgp-export-filter-id`,`bgp-extra-prefixes`,`bgp-import-filter-id`,`bgp-md5-key`].some(t=>e[t]!==void 0)){let t=[`bgp-customer-asn`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --bgp-* flag is set`)}return!0})}const Hn={command:`create`,describe:"Creates a new GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:Vn,handler:async p=>{let m={};if(p[`x-magic-new-hc-target`]!==void 0&&(m[`x-magic-new-hc-target`]=String(p[`x-magic-new-hc-target`])),p.dryRun){o({command:`cf magic-transit gre-tunnels create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/gre_tunnels`,pathParams:{},bodyKind:`json`,body:p.body===void 0?u({automatic_return_routing:p[`automatic-return-routing`],bgp:{customer_asn:p[`bgp-customer-asn`],export_filter_id:d(p[`bgp-export-filter-id`],`bgp-export-filter-id`,`text`),extra_prefixes:p[`bgp-extra-prefixes`],import_filter_id:d(p[`bgp-import-filter-id`],`bgp-import-filter-id`,`text`),md5_key:d(p[`bgp-md5-key`],`bgp-md5-key`,`text`)},cloudflare_gre_endpoint:d(p[`cloudflare-gre-endpoint`],`cloudflare-gre-endpoint`,`text`),customer_gre_endpoint:d(p[`customer-gre-endpoint`],`customer-gre-endpoint`,`text`),description:d(p.description,`description`,`text`),health_check:{enabled:p[`health-check-enabled`],rate:d(p[`health-check-rate`],`health-check-rate`,`text`),target:{saved:d(p[`health-check-target-saved`],`health-check-target-saved`,`text`)},type:d(p[`health-check-type`],`health-check-type`,`text`),direction:d(p[`health-check-direction`],`health-check-direction`,`text`)},interface_address:d(p[`interface-address`],`interface-address`,`text`),interface_address6:d(p[`interface-address6`],`interface-address6`,`text`),mtu:p.mtu,name:d(p.name,`name`,`text`),ttl:p.ttl}):c(p.body)});return}let h=await i(p),g=p.local?e:await t();if(p.accountId=g,p.body){let e=c(p.body);a(await s(`Creating`,async()=>r(h,`POST`,`/accounts/${g}/magic/gre_tunnels`,{body:e,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Created`});return}p[`cloudflare-gre-endpoint`]===void 0&&(p[`cloudflare-gre-endpoint`]=await f(`cloudflare-gre-endpoint`,`The IP address assigned to the Cloudflare side of the GRE tunnel.`)),p[`customer-gre-endpoint`]===void 0&&(p[`customer-gre-endpoint`]=await f(`customer-gre-endpoint`,`The IP address assigned to the customer side of the GRE tunnel.`)),p[`interface-address`]===void 0&&(p[`interface-address`]=await f(`interface-address`,`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`)),p.name===void 0&&(p.name=await f(`name`,`The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.`));let _={};p[`automatic-return-routing`]!==void 0&&l(_,[`automatic_return_routing`],p[`automatic-return-routing`]),p[`bgp-customer-asn`]!==void 0&&l(_,[`bgp`,`customer_asn`],p[`bgp-customer-asn`]),p[`bgp-export-filter-id`]!==void 0&&l(_,[`bgp`,`export_filter_id`],d(p[`bgp-export-filter-id`],`bgp-export-filter-id`,`text`)),p[`bgp-extra-prefixes`]!==void 0&&l(_,[`bgp`,`extra_prefixes`],p[`bgp-extra-prefixes`]),p[`bgp-import-filter-id`]!==void 0&&l(_,[`bgp`,`import_filter_id`],d(p[`bgp-import-filter-id`],`bgp-import-filter-id`,`text`)),p[`bgp-md5-key`]!==void 0&&l(_,[`bgp`,`md5_key`],d(p[`bgp-md5-key`],`bgp-md5-key`,`text`)),p[`cloudflare-gre-endpoint`]!==void 0&&l(_,[`cloudflare_gre_endpoint`],d(p[`cloudflare-gre-endpoint`],`cloudflare-gre-endpoint`,`text`)),p[`customer-gre-endpoint`]!==void 0&&l(_,[`customer_gre_endpoint`],d(p[`customer-gre-endpoint`],`customer-gre-endpoint`,`text`)),p.description!==void 0&&l(_,[`description`],d(p.description,`description`,`text`)),p[`health-check-enabled`]!==void 0&&l(_,[`health_check`,`enabled`],p[`health-check-enabled`]),p[`health-check-rate`]!==void 0&&l(_,[`health_check`,`rate`],d(p[`health-check-rate`],`health-check-rate`,`text`)),p[`health-check-target-saved`]!==void 0&&l(_,[`health_check`,`target`,`saved`],d(p[`health-check-target-saved`],`health-check-target-saved`,`text`)),p[`health-check-type`]!==void 0&&l(_,[`health_check`,`type`],d(p[`health-check-type`],`health-check-type`,`text`)),p[`health-check-direction`]!==void 0&&l(_,[`health_check`,`direction`],d(p[`health-check-direction`],`health-check-direction`,`text`)),p[`interface-address`]!==void 0&&l(_,[`interface_address`],d(p[`interface-address`],`interface-address`,`text`)),p[`interface-address6`]!==void 0&&l(_,[`interface_address6`],d(p[`interface-address6`],`interface-address6`,`text`)),p.mtu!==void 0&&l(_,[`mtu`],p.mtu),p.name!==void 0&&l(_,[`name`],d(p.name,`name`,`text`)),p.ttl!==void 0&&l(_,[`ttl`],p.ttl),a(await s(`Creating`,async()=>r(h,`POST`,`/accounts/${g}/magic/gre_tunnels`,{body:Object.keys(_).length>0?_:void 0,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Created`})}};function Un(e){return e.positional(`gre-tunnel-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Wn={command:`delete <gre-tunnel-id>`,describe:"Disables and removes a specific static GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:Un,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit gre-tunnels delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/gre_tunnels/${c[`gre-tunnel-id`]==null?`<gre-tunnel-id>`:encodeURIComponent(String(c[`gre-tunnel-id`]))}`,pathParams:{"gre-tunnel-id":String(c[`gre-tunnel-id`]??``)},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();if(c.accountId=d,!await m({force:!!c.force})){process.stderr.write(`Aborted.
 `);return}a(await s(`Deleting`,async()=>r(u,`DELETE`,`/accounts/${d}/magic/gre_tunnels/${encodeURIComponent(String(c[`gre-tunnel-id`]))}`,{headers:Object.keys(l).length>0?l:void 0})),{successLabel:`Deleted`})}};function Gn(e){return e.positional(`gre-tunnel-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Kn={command:`get <gre-tunnel-id>`,describe:`Lists informtion for a specific GRE tunnel.`,builder:Gn,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit gre-tunnels get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/gre_tunnels/${c[`gre-tunnel-id`]==null?`<gre-tunnel-id>`:encodeURIComponent(String(c[`gre-tunnel-id`]))}`,pathParams:{"gre-tunnel-id":String(c[`gre-tunnel-id`]??``)},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();c.accountId=d,a(await s(`Loading`,async()=>r(u,`GET`,`/accounts/${d}/magic/gre_tunnels/${encodeURIComponent(String(c[`gre-tunnel-id`]))}`,{headers:Object.keys(l).length>0?l:void 0})),{successLabel:`Loaded`})}};function qn(e){return e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Jn={command:`list`,describe:`Lists GRE tunnels associated with an account.`,builder:qn,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit gre-tunnels list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/gre_tunnels`,pathParams:{},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();c.accountId=d,a(await s(`Loading`,async()=>r(u,`GET`,`/accounts/${d}/magic/gre_tunnels`,{headers:Object.keys(l).length>0?l:void 0})),{successLabel:`Loaded`})}};function Yn(e){return e.positional(`gre-tunnel-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`automatic-return-routing`,{type:`boolean`,description:"True if automatic stateful return routing should be enabled for a tunnel, false otherwise. Requires the `coupler_integration` account flag to be enabled; requests setting this to `true` without that flag will be rejected."}).option(`cloudflare-gre-endpoint`,{type:`string`,description:`The IP address assigned to the Cloudflare side of the GRE tunnel.`}).option(`customer-gre-endpoint`,{type:`string`,description:`The IP address assigned to the customer side of the GRE tunnel.`}).option(`description`,{type:`string`,description:`An optional description of the GRE tunnel.`}).option(`health-check-enabled`,{type:`boolean`,description:`Determines whether to run healthchecks for a tunnel.`}).option(`health-check-rate`,{type:`string`,description:"How frequent the health check is run. The default value is `mid`.",choices:[`low`,`mid`,`high`]}).option(`health-check-target-saved`,{type:`string`,description:`The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.`}).option(`health-check-type`,{type:`string`,description:"The type of healthcheck to run, reply or request. The default value is `reply`.",choices:[`reply`,`request`]}).option(`health-check-direction`,{type:`string`,description:`The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.`,choices:[`unidirectional`,`bidirectional`]}).option(`interface-address`,{type:`string`,description:`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`}).option(`interface-address6`,{type:`string`,description:`A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127`}).option(`mtu`,{type:`number`,description:`Maximum Transmission Unit (MTU) in bytes for the GRE tunnel. The minimum value is 576.`}).option(`name`,{type:`string`,description:`The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.`}).option(`ttl`,{type:`number`,description:`Time To Live (TTL) in number of hops of the GRE tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Xn={command:`update <gre-tunnel-id>`,describe:"Updates a specific GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:Yn,handler:async p=>{let m={};if(p[`x-magic-new-hc-target`]!==void 0&&(m[`x-magic-new-hc-target`]=String(p[`x-magic-new-hc-target`])),p.dryRun){o({command:`cf magic-transit gre-tunnels update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/gre_tunnels/${p[`gre-tunnel-id`]==null?`<gre-tunnel-id>`:encodeURIComponent(String(p[`gre-tunnel-id`]))}`,pathParams:{"gre-tunnel-id":String(p[`gre-tunnel-id`]??``)},bodyKind:`json`,body:p.body===void 0?u({automatic_return_routing:p[`automatic-return-routing`],cloudflare_gre_endpoint:d(p[`cloudflare-gre-endpoint`],`cloudflare-gre-endpoint`,`text`),customer_gre_endpoint:d(p[`customer-gre-endpoint`],`customer-gre-endpoint`,`text`),description:d(p.description,`description`,`text`),health_check:{enabled:p[`health-check-enabled`],rate:d(p[`health-check-rate`],`health-check-rate`,`text`),target:{saved:d(p[`health-check-target-saved`],`health-check-target-saved`,`text`)},type:d(p[`health-check-type`],`health-check-type`,`text`),direction:d(p[`health-check-direction`],`health-check-direction`,`text`)},interface_address:d(p[`interface-address`],`interface-address`,`text`),interface_address6:d(p[`interface-address6`],`interface-address6`,`text`),mtu:p.mtu,name:d(p.name,`name`,`text`),ttl:p.ttl}):c(p.body)});return}let h=await i(p),g=p.local?e:await t();if(p.accountId=g,p.body){let e=c(p.body);a(await s(`Updating`,async()=>r(h,`PUT`,`/accounts/${g}/magic/gre_tunnels/${encodeURIComponent(String(p[`gre-tunnel-id`]))}`,{body:e,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated`});return}p[`cloudflare-gre-endpoint`]===void 0&&(p[`cloudflare-gre-endpoint`]=await f(`cloudflare-gre-endpoint`,`The IP address assigned to the Cloudflare side of the GRE tunnel.`)),p[`customer-gre-endpoint`]===void 0&&(p[`customer-gre-endpoint`]=await f(`customer-gre-endpoint`,`The IP address assigned to the customer side of the GRE tunnel.`)),p[`interface-address`]===void 0&&(p[`interface-address`]=await f(`interface-address`,`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`)),p.name===void 0&&(p.name=await f(`name`,`The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.`));let _={};p[`automatic-return-routing`]!==void 0&&l(_,[`automatic_return_routing`],p[`automatic-return-routing`]),p[`cloudflare-gre-endpoint`]!==void 0&&l(_,[`cloudflare_gre_endpoint`],d(p[`cloudflare-gre-endpoint`],`cloudflare-gre-endpoint`,`text`)),p[`customer-gre-endpoint`]!==void 0&&l(_,[`customer_gre_endpoint`],d(p[`customer-gre-endpoint`],`customer-gre-endpoint`,`text`)),p.description!==void 0&&l(_,[`description`],d(p.description,`description`,`text`)),p[`health-check-enabled`]!==void 0&&l(_,[`health_check`,`enabled`],p[`health-check-enabled`]),p[`health-check-rate`]!==void 0&&l(_,[`health_check`,`rate`],d(p[`health-check-rate`],`health-check-rate`,`text`)),p[`health-check-target-saved`]!==void 0&&l(_,[`health_check`,`target`,`saved`],d(p[`health-check-target-saved`],`health-check-target-saved`,`text`)),p[`health-check-type`]!==void 0&&l(_,[`health_check`,`type`],d(p[`health-check-type`],`health-check-type`,`text`)),p[`health-check-direction`]!==void 0&&l(_,[`health_check`,`direction`],d(p[`health-check-direction`],`health-check-direction`,`text`)),p[`interface-address`]!==void 0&&l(_,[`interface_address`],d(p[`interface-address`],`interface-address`,`text`)),p[`interface-address6`]!==void 0&&l(_,[`interface_address6`],d(p[`interface-address6`],`interface-address6`,`text`)),p.mtu!==void 0&&l(_,[`mtu`],p.mtu),p.name!==void 0&&l(_,[`name`],d(p.name,`name`,`text`)),p.ttl!==void 0&&l(_,[`ttl`],p.ttl),a(await s(`Updating`,async()=>r(h,`PUT`,`/accounts/${g}/magic/gre_tunnels/${encodeURIComponent(String(p[`gre-tunnel-id`]))}`,{body:Object.keys(_).length>0?_:void 0,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated`})}},Zn={command:`gre-tunnels`,describe:`GRE tunnel endpoints that connect your network to Cloudflare for Magic Transit`,builder:e=>e.command(Bn).command(Hn).command(Wn).command(Kn).command(Jn).command(Xn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Qn(e){return e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const $n={command:`bulk-update`,describe:"Update multiple IPsec tunnels associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:Qn,handler:async l=>{let u={};if(l[`x-magic-new-hc-target`]!==void 0&&(u[`x-magic-new-hc-target`]=String(l[`x-magic-new-hc-target`])),l.dryRun){o({command:`cf magic-transit ipsec-tunnels bulk-update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/ipsec_tunnels`,pathParams:{},bodyKind:`json`,body:l.body===void 0?void 0:c(l.body)});return}let d=await i(l),f=l.local?e:await t();if(l.accountId=f,l.body){let e=c(l.body);a(await s(`Updating`,async()=>r(d,`PUT`,`/accounts/${f}/magic/ipsec_tunnels`,{body:e,headers:Object.keys(u).length>0?u:void 0})),{successLabel:`Updated`});return}a(await s(`Updating`,async()=>r(d,`PUT`,`/accounts/${f}/magic/ipsec_tunnels`,{headers:Object.keys(u).length>0?u:void 0})),{successLabel:`Updated`})}};function er(e){return e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`automatic-return-routing`,{type:`boolean`,description:"True if automatic stateful return routing should be enabled for a tunnel, false otherwise. Requires the `coupler_integration` account flag to be enabled; requests setting this to `true` without that flag will be rejected.",default:!1}).option(`bgp-customer-asn`,{type:`number`,description:`ASN used on the customer end of the BGP session`}).option(`bgp-export-filter-id`,{type:`string`,description:`ID of the BGP filter profile applied to routes advertised to the customer.`}).option(`bgp-extra-prefixes`,{type:`string`,array:!0,description:`Prefixes in this list will be advertised to the customer device, in addition to the routes in the Magic routing table.`}).option(`bgp-import-filter-id`,{type:`string`,description:`ID of the BGP filter profile applied to routes received from the customer.`}).option(`bgp-md5-key`,{type:`string`,description:`MD5 key to use for session authentication.
 
 Note that *this is not a security measure*. MD5 is not a valid security mechanism, and the
@@ -74,7 +74,7 @@ Must be of the form \`<custom label>.<account ID>.custom.ipsec.cloudflare.com\`.
 
 This custom ID does not need to be unique. Two IPsec tunnels may have the same custom
 fqdn_id. However, if another IPsec tunnel has the same value then the two tunnels
-cannot have the same cloudflare_endpoint.`}).option(`customer-endpoint`,{type:`string`,description:`The IP address assigned to the customer side of the IPsec tunnel. Not required, but must be set for proactive traceroutes to work.`}).option(`description`,{type:`string`,description:`An optional description forthe IPsec tunnel.`}).option(`health-check-enabled`,{type:`boolean`,description:`Determines whether to run healthchecks for a tunnel.`,default:!0}).option(`health-check-rate`,{type:`string`,description:"How frequent the health check is run. The default value is `mid`.",choices:[`low`,`mid`,`high`],default:`mid`}).option(`health-check-target-saved`,{type:`string`,description:`The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.`}).option(`health-check-type`,{type:`string`,description:"The type of healthcheck to run, reply or request. The default value is `reply`.",choices:[`reply`,`request`],default:`reply`}).option(`health-check-direction`,{type:`string`,description:`The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.`,choices:[`unidirectional`,`bidirectional`],default:`unidirectional`}).option(`interface-address`,{type:`string`,description:`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`}).option(`interface-address6`,{type:`string`,description:`A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127`}).option(`name`,{type:`string`,description:`The name of the IPsec tunnel. The name cannot share a name with other tunnels.`}).option(`psk`,{type:`string`,description:`A randomly generated or provided string for use in the IPsec tunnel.`}).option(`replay-protection`,{type:`boolean`,description:"If `true`, then IPsec replay protection will be supported in the Cloudflare-to-customer direction.",default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`bgp-customer-asn`,`bgp-export-filter-id`,`bgp-extra-prefixes`,`bgp-import-filter-id`,`bgp-md5-key`].some(t=>e[t]!==void 0)){let t=[`bgp-customer-asn`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --bgp-* flag is set`)}return!0})}const tr={command:`create`,describe:"Creates a new IPsec tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:er,handler:async p=>{let m={};if(p[`x-magic-new-hc-target`]!==void 0&&(m[`x-magic-new-hc-target`]=String(p[`x-magic-new-hc-target`])),p.dryRun){o({command:`cf magic-transit ipsec-tunnels create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/ipsec_tunnels`,pathParams:{},bodyKind:`json`,body:p.body===void 0?u({automatic_return_routing:p[`automatic-return-routing`],bgp:{customer_asn:p[`bgp-customer-asn`],export_filter_id:d(p[`bgp-export-filter-id`],`bgp-export-filter-id`,`text`),extra_prefixes:p[`bgp-extra-prefixes`],import_filter_id:d(p[`bgp-import-filter-id`],`bgp-import-filter-id`,`text`),md5_key:d(p[`bgp-md5-key`],`bgp-md5-key`,`text`)},cloudflare_endpoint:d(p[`cloudflare-endpoint`],`cloudflare-endpoint`,`text`),custom_remote_identities:{fqdn_id:d(p[`custom-remote-identities-fqdn-id`],`custom-remote-identities-fqdn-id`,`text`)},customer_endpoint:d(p[`customer-endpoint`],`customer-endpoint`,`text`),description:d(p.description,`description`,`text`),health_check:{enabled:p[`health-check-enabled`],rate:d(p[`health-check-rate`],`health-check-rate`,`text`),target:{saved:d(p[`health-check-target-saved`],`health-check-target-saved`,`text`)},type:d(p[`health-check-type`],`health-check-type`,`text`),direction:d(p[`health-check-direction`],`health-check-direction`,`text`)},interface_address:d(p[`interface-address`],`interface-address`,`text`),interface_address6:d(p[`interface-address6`],`interface-address6`,`text`),name:d(p.name,`name`,`text`),psk:d(p.psk,`psk`,`text`),replay_protection:p[`replay-protection`]}):c(p.body)});return}let h=await i(p),g=p.local?e:await t();if(p.accountId=g,p.body){let e=c(p.body);a(await s(`Creating`,async()=>r(h,`POST`,`/accounts/${g}/magic/ipsec_tunnels`,{body:e,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Created`});return}p[`cloudflare-endpoint`]===void 0&&(p[`cloudflare-endpoint`]=await f(`cloudflare-endpoint`,`The IP address assigned to the Cloudflare side of the IPsec tunnel.`)),p[`interface-address`]===void 0&&(p[`interface-address`]=await f(`interface-address`,`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`)),p.name===void 0&&(p.name=await f(`name`,`The name of the IPsec tunnel. The name cannot share a name with other tunnels.`));let _={};p[`automatic-return-routing`]!==void 0&&l(_,[`automatic_return_routing`],p[`automatic-return-routing`]),p[`bgp-customer-asn`]!==void 0&&l(_,[`bgp`,`customer_asn`],p[`bgp-customer-asn`]),p[`bgp-export-filter-id`]!==void 0&&l(_,[`bgp`,`export_filter_id`],d(p[`bgp-export-filter-id`],`bgp-export-filter-id`,`text`)),p[`bgp-extra-prefixes`]!==void 0&&l(_,[`bgp`,`extra_prefixes`],p[`bgp-extra-prefixes`]),p[`bgp-import-filter-id`]!==void 0&&l(_,[`bgp`,`import_filter_id`],d(p[`bgp-import-filter-id`],`bgp-import-filter-id`,`text`)),p[`bgp-md5-key`]!==void 0&&l(_,[`bgp`,`md5_key`],d(p[`bgp-md5-key`],`bgp-md5-key`,`text`)),p[`cloudflare-endpoint`]!==void 0&&l(_,[`cloudflare_endpoint`],d(p[`cloudflare-endpoint`],`cloudflare-endpoint`,`text`)),p[`custom-remote-identities-fqdn-id`]!==void 0&&l(_,[`custom_remote_identities`,`fqdn_id`],d(p[`custom-remote-identities-fqdn-id`],`custom-remote-identities-fqdn-id`,`text`)),p[`customer-endpoint`]!==void 0&&l(_,[`customer_endpoint`],d(p[`customer-endpoint`],`customer-endpoint`,`text`)),p.description!==void 0&&l(_,[`description`],d(p.description,`description`,`text`)),p[`health-check-enabled`]!==void 0&&l(_,[`health_check`,`enabled`],p[`health-check-enabled`]),p[`health-check-rate`]!==void 0&&l(_,[`health_check`,`rate`],d(p[`health-check-rate`],`health-check-rate`,`text`)),p[`health-check-target-saved`]!==void 0&&l(_,[`health_check`,`target`,`saved`],d(p[`health-check-target-saved`],`health-check-target-saved`,`text`)),p[`health-check-type`]!==void 0&&l(_,[`health_check`,`type`],d(p[`health-check-type`],`health-check-type`,`text`)),p[`health-check-direction`]!==void 0&&l(_,[`health_check`,`direction`],d(p[`health-check-direction`],`health-check-direction`,`text`)),p[`interface-address`]!==void 0&&l(_,[`interface_address`],d(p[`interface-address`],`interface-address`,`text`)),p[`interface-address6`]!==void 0&&l(_,[`interface_address6`],d(p[`interface-address6`],`interface-address6`,`text`)),p.name!==void 0&&l(_,[`name`],d(p.name,`name`,`text`)),p.psk!==void 0&&l(_,[`psk`],d(p.psk,`psk`,`text`)),p[`replay-protection`]!==void 0&&l(_,[`replay_protection`],p[`replay-protection`]),a(await s(`Creating`,async()=>r(h,`POST`,`/accounts/${g}/magic/ipsec_tunnels`,{body:Object.keys(_).length>0?_:void 0,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Created`})}};function nr(e){return e.positional(`ipsec-tunnel-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const rr={command:`delete <ipsec-tunnel-id>`,describe:"Disables and removes a specific static IPsec Tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:nr,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit ipsec-tunnels delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/ipsec_tunnels/${c[`ipsec-tunnel-id`]==null?`<ipsec-tunnel-id>`:encodeURIComponent(String(c[`ipsec-tunnel-id`]))}`,pathParams:{"ipsec-tunnel-id":String(c[`ipsec-tunnel-id`]??``)},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();if(c.accountId=d,!await m({force:!!c.force})){process.stderr.write(`Aborted.
+cannot have the same cloudflare_endpoint.`}).option(`customer-endpoint`,{type:`string`,description:`The IP address assigned to the customer side of the IPsec tunnel. Not required, but must be set for proactive traceroutes to work.`}).option(`description`,{type:`string`,description:`An optional description forthe IPsec tunnel.`}).option(`health-check-enabled`,{type:`boolean`,description:`Determines whether to run healthchecks for a tunnel.`}).option(`health-check-rate`,{type:`string`,description:"How frequent the health check is run. The default value is `mid`.",choices:[`low`,`mid`,`high`]}).option(`health-check-target-saved`,{type:`string`,description:`The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.`}).option(`health-check-type`,{type:`string`,description:"The type of healthcheck to run, reply or request. The default value is `reply`.",choices:[`reply`,`request`]}).option(`health-check-direction`,{type:`string`,description:`The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.`,choices:[`unidirectional`,`bidirectional`]}).option(`interface-address`,{type:`string`,description:`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`}).option(`interface-address6`,{type:`string`,description:`A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127`}).option(`name`,{type:`string`,description:`The name of the IPsec tunnel. The name cannot share a name with other tunnels.`}).option(`psk`,{type:`string`,description:`A randomly generated or provided string for use in the IPsec tunnel.`}).option(`replay-protection`,{type:`boolean`,description:"If `true`, then IPsec replay protection will be supported in the Cloudflare-to-customer direction.",default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`bgp-customer-asn`,`bgp-export-filter-id`,`bgp-extra-prefixes`,`bgp-import-filter-id`,`bgp-md5-key`].some(t=>e[t]!==void 0)){let t=[`bgp-customer-asn`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --bgp-* flag is set`)}return!0})}const tr={command:`create`,describe:"Creates a new IPsec tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:er,handler:async p=>{let m={};if(p[`x-magic-new-hc-target`]!==void 0&&(m[`x-magic-new-hc-target`]=String(p[`x-magic-new-hc-target`])),p.dryRun){o({command:`cf magic-transit ipsec-tunnels create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/ipsec_tunnels`,pathParams:{},bodyKind:`json`,body:p.body===void 0?u({automatic_return_routing:p[`automatic-return-routing`],bgp:{customer_asn:p[`bgp-customer-asn`],export_filter_id:d(p[`bgp-export-filter-id`],`bgp-export-filter-id`,`text`),extra_prefixes:p[`bgp-extra-prefixes`],import_filter_id:d(p[`bgp-import-filter-id`],`bgp-import-filter-id`,`text`),md5_key:d(p[`bgp-md5-key`],`bgp-md5-key`,`text`)},cloudflare_endpoint:d(p[`cloudflare-endpoint`],`cloudflare-endpoint`,`text`),custom_remote_identities:{fqdn_id:d(p[`custom-remote-identities-fqdn-id`],`custom-remote-identities-fqdn-id`,`text`)},customer_endpoint:d(p[`customer-endpoint`],`customer-endpoint`,`text`),description:d(p.description,`description`,`text`),health_check:{enabled:p[`health-check-enabled`],rate:d(p[`health-check-rate`],`health-check-rate`,`text`),target:{saved:d(p[`health-check-target-saved`],`health-check-target-saved`,`text`)},type:d(p[`health-check-type`],`health-check-type`,`text`),direction:d(p[`health-check-direction`],`health-check-direction`,`text`)},interface_address:d(p[`interface-address`],`interface-address`,`text`),interface_address6:d(p[`interface-address6`],`interface-address6`,`text`),name:d(p.name,`name`,`text`),psk:d(p.psk,`psk`,`text`),replay_protection:p[`replay-protection`]}):c(p.body)});return}let h=await i(p),g=p.local?e:await t();if(p.accountId=g,p.body){let e=c(p.body);a(await s(`Creating`,async()=>r(h,`POST`,`/accounts/${g}/magic/ipsec_tunnels`,{body:e,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Created`});return}p[`cloudflare-endpoint`]===void 0&&(p[`cloudflare-endpoint`]=await f(`cloudflare-endpoint`,`The IP address assigned to the Cloudflare side of the IPsec tunnel.`)),p[`interface-address`]===void 0&&(p[`interface-address`]=await f(`interface-address`,`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`)),p.name===void 0&&(p.name=await f(`name`,`The name of the IPsec tunnel. The name cannot share a name with other tunnels.`));let _={};p[`automatic-return-routing`]!==void 0&&l(_,[`automatic_return_routing`],p[`automatic-return-routing`]),p[`bgp-customer-asn`]!==void 0&&l(_,[`bgp`,`customer_asn`],p[`bgp-customer-asn`]),p[`bgp-export-filter-id`]!==void 0&&l(_,[`bgp`,`export_filter_id`],d(p[`bgp-export-filter-id`],`bgp-export-filter-id`,`text`)),p[`bgp-extra-prefixes`]!==void 0&&l(_,[`bgp`,`extra_prefixes`],p[`bgp-extra-prefixes`]),p[`bgp-import-filter-id`]!==void 0&&l(_,[`bgp`,`import_filter_id`],d(p[`bgp-import-filter-id`],`bgp-import-filter-id`,`text`)),p[`bgp-md5-key`]!==void 0&&l(_,[`bgp`,`md5_key`],d(p[`bgp-md5-key`],`bgp-md5-key`,`text`)),p[`cloudflare-endpoint`]!==void 0&&l(_,[`cloudflare_endpoint`],d(p[`cloudflare-endpoint`],`cloudflare-endpoint`,`text`)),p[`custom-remote-identities-fqdn-id`]!==void 0&&l(_,[`custom_remote_identities`,`fqdn_id`],d(p[`custom-remote-identities-fqdn-id`],`custom-remote-identities-fqdn-id`,`text`)),p[`customer-endpoint`]!==void 0&&l(_,[`customer_endpoint`],d(p[`customer-endpoint`],`customer-endpoint`,`text`)),p.description!==void 0&&l(_,[`description`],d(p.description,`description`,`text`)),p[`health-check-enabled`]!==void 0&&l(_,[`health_check`,`enabled`],p[`health-check-enabled`]),p[`health-check-rate`]!==void 0&&l(_,[`health_check`,`rate`],d(p[`health-check-rate`],`health-check-rate`,`text`)),p[`health-check-target-saved`]!==void 0&&l(_,[`health_check`,`target`,`saved`],d(p[`health-check-target-saved`],`health-check-target-saved`,`text`)),p[`health-check-type`]!==void 0&&l(_,[`health_check`,`type`],d(p[`health-check-type`],`health-check-type`,`text`)),p[`health-check-direction`]!==void 0&&l(_,[`health_check`,`direction`],d(p[`health-check-direction`],`health-check-direction`,`text`)),p[`interface-address`]!==void 0&&l(_,[`interface_address`],d(p[`interface-address`],`interface-address`,`text`)),p[`interface-address6`]!==void 0&&l(_,[`interface_address6`],d(p[`interface-address6`],`interface-address6`,`text`)),p.name!==void 0&&l(_,[`name`],d(p.name,`name`,`text`)),p.psk!==void 0&&l(_,[`psk`],d(p.psk,`psk`,`text`)),p[`replay-protection`]!==void 0&&l(_,[`replay_protection`],p[`replay-protection`]),a(await s(`Creating`,async()=>r(h,`POST`,`/accounts/${g}/magic/ipsec_tunnels`,{body:Object.keys(_).length>0?_:void 0,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Created`})}};function nr(e){return e.positional(`ipsec-tunnel-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const rr={command:`delete <ipsec-tunnel-id>`,describe:"Disables and removes a specific static IPsec Tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:nr,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit ipsec-tunnels delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/ipsec_tunnels/${c[`ipsec-tunnel-id`]==null?`<ipsec-tunnel-id>`:encodeURIComponent(String(c[`ipsec-tunnel-id`]))}`,pathParams:{"ipsec-tunnel-id":String(c[`ipsec-tunnel-id`]??``)},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();if(c.accountId=d,!await m({force:!!c.force})){process.stderr.write(`Aborted.
 `);return}a(await s(`Deleting`,async()=>r(u,`DELETE`,`/accounts/${d}/magic/ipsec_tunnels/${encodeURIComponent(String(c[`ipsec-tunnel-id`]))}`,{headers:Object.keys(l).length>0?l:void 0})),{successLabel:`Deleted`})}};function ir(e){return e.positional(`ipsec-tunnel-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ar={command:`get <ipsec-tunnel-id>`,describe:`Lists details for a specific IPsec tunnel.`,builder:ir,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit ipsec-tunnels get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/ipsec_tunnels/${c[`ipsec-tunnel-id`]==null?`<ipsec-tunnel-id>`:encodeURIComponent(String(c[`ipsec-tunnel-id`]))}`,pathParams:{"ipsec-tunnel-id":String(c[`ipsec-tunnel-id`]??``)},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();c.accountId=d,a(await s(`Loading`,async()=>r(u,`GET`,`/accounts/${d}/magic/ipsec_tunnels/${encodeURIComponent(String(c[`ipsec-tunnel-id`]))}`,{headers:Object.keys(l).length>0?l:void 0})),{successLabel:`Loaded`})}};function or(e){return e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const sr={command:`list`,describe:`Lists IPsec tunnels associated with an account.`,builder:or,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit ipsec-tunnels list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/ipsec_tunnels`,pathParams:{},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();c.accountId=d,a(await s(`Loading`,async()=>r(u,`GET`,`/accounts/${d}/magic/ipsec_tunnels`,{headers:Object.keys(l).length>0?l:void 0})),{successLabel:`Loaded`})}};function cr(e){return e.positional(`ipsec-tunnel-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const lr={command:`psk-generate <ipsec-tunnel-id>`,describe:"Generates a Pre-Shared Key for a specific IPsec tunnel used in the IKE session. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. After a PSK is generated, the PSK is immediately persisted to Cloudflare's edge and cannot be retrieved later. Store the PSK in a safe place.",builder:cr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit ipsec-tunnels psk-generate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/ipsec_tunnels/${r[`ipsec-tunnel-id`]==null?`<ipsec-tunnel-id>`:encodeURIComponent(String(r[`ipsec-tunnel-id`]))}/psk_generate`,pathParams:{"ipsec-tunnel-id":String(r[`ipsec-tunnel-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Creating`,async()=>c.magicTransit.ipsecTunnels.pskGenerate({account_id:l,ipsec_tunnel_id:r[`ipsec-tunnel-id`]})),{successLabel:`Created`})}};function ur(e){return e.option(`validate-only`,{type:`boolean`,description:"If `true`, only run validation without persisting changes."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Request body for setting PSKs for multiple IPsec tunnels.`})}const dr={command:`psk-set`,describe:"Sets Pre-Shared Keys for multiple IPsec tunnels associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. After PSKs are applied, they are immediately persisted to Cloudflare's edge and cannot be retrieved later. Store the PSKs in a safe place.",builder:ur,handler:async r=>{let l={validate_only:r[`validate-only`]};if(r.dryRun){o({command:`cf magic-transit ipsec-tunnels psk-set`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/ipsec_tunnels/psk`,pathParams:{},query:l,bodyKind:`json`,body:r.body===void 0?void 0:c(r.body)});return}let u=await i(r),d=r.local?e:await t();if(r.accountId=d,r.body){let e=c(r.body);new URLSearchParams(Object.entries(l).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString(),a(await s(`Creating`,async()=>u.magicTransit.ipsecTunnels.pskSet({...e,account_id:d,...l})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function fr(e){return e.positional(`ipsec-tunnel-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`automatic-return-routing`,{type:`boolean`,description:"True if automatic stateful return routing should be enabled for a tunnel, false otherwise. Requires the `coupler_integration` account flag to be enabled; requests setting this to `true` without that flag will be rejected."}).option(`bgp-customer-asn`,{type:`number`,description:`ASN used on the customer end of the BGP session`}).option(`bgp-export-filter-id`,{type:`string`,description:`ID of the BGP filter profile applied to routes advertised to the customer.`}).option(`bgp-extra-prefixes`,{type:`string`,array:!0,description:`Prefixes in this list will be advertised to the customer device, in addition to the routes in the Magic routing table.`}).option(`bgp-import-filter-id`,{type:`string`,description:`ID of the BGP filter profile applied to routes received from the customer.`}).option(`bgp-md5-key`,{type:`string`,description:`MD5 key to use for session authentication.
 
 Note that *this is not a security measure*. MD5 is not a valid security mechanism, and the
@@ -105,7 +105,7 @@ cannot have the same cloudflare_endpoint.`}).option(`customer-endpoint`,{type:`s
 `);return}if(r.body){let e=c(r.body);a(await s(`Deleting`,async()=>l.magicTransit.routes.empty({...e,account_id:u})),{successLabel:`Deleted`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function ti(e){return e.positional(`route-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ni={command:`get <route-id>`,describe:`Get a specific Magic static route.`,builder:ti,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit routes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/routes/${r[`route-id`]==null?`<route-id>`:encodeURIComponent(String(r[`route-id`]))}`,pathParams:{"route-id":String(r[`route-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.routes.get({account_id:l,route_id:r[`route-id`]})),{successLabel:`Loaded`})}};function ri(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ii={command:`list`,describe:`List all Magic static routes.`,builder:ri,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit routes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/routes`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.routes.list({account_id:l})),{successLabel:`Loaded`})}};function ai(e){return e.positional(`route-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`description`,{type:`string`,description:`An optional human provided description of the static route.`}).option(`nexthop`,{type:`string`,description:`The next-hop IP Address for the static route.`}).option(`prefix`,{type:`string`,description:`IP Prefix in Classless Inter-Domain Routing format.`}).option(`priority`,{type:`number`,description:`Priority of the static route.`}).option(`scope-colo-names`,{type:`string`,array:!0,description:`List of colo names for the ECMP scope.`}).option(`scope-colo-regions`,{type:`string`,array:!0,description:`List of colo regions for the ECMP scope.`}).option(`weight`,{type:`number`,description:`Optional weight of the ECMP scope - if provided.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const oi={command:`update <route-id>`,describe:"Update a specific Magic static route. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes.",builder:ai,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit routes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/routes/${r[`route-id`]==null?`<route-id>`:encodeURIComponent(String(r[`route-id`]))}`,pathParams:{"route-id":String(r[`route-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({description:d(r.description,`description`,`text`),nexthop:d(r.nexthop,`nexthop`,`text`),prefix:d(r.prefix,`prefix`,`text`),priority:r.priority,scope:{colo_names:r[`scope-colo-names`],colo_regions:r[`scope-colo-regions`]},weight:r.weight}):c(r.body)});return}let l=await i(r),p=r.local?e:await t();if(r.accountId=p,r.body){let e=c(r.body);a(await s(`Updating`,async()=>l.magicTransit.routes.update({body:e,account_id:p,route_id:r[`route-id`]})),{successLabel:`Updated`});return}if(r.nexthop===void 0&&(r.nexthop=await f(`nexthop`,`The next-hop IP Address for the static route.`)),r.prefix===void 0&&(r.prefix=await f(`prefix`,`IP Prefix in Classless Inter-Domain Routing format.`)),r.priority===void 0)throw Error(`--priority is required (or pass --body with this field set).`);let m=u({description:d(r.description,`description`,`text`),nexthop:d(r.nexthop,`nexthop`,`text`),prefix:d(r.prefix,`prefix`,`text`),priority:r.priority,scope:{colo_names:r[`scope-colo-names`],colo_regions:r[`scope-colo-regions`]},weight:r.weight});a(await s(`Updating`,async()=>l.magicTransit.routes.update({body:m,account_id:p,route_id:r[`route-id`]})),{successLabel:`Updated`})}},si={command:`routes`,describe:`Static routes that direct IP prefix traffic through specific GRE/IPsec tunnels`,builder:e=>e.command(Jr).command(Xr).command(Qr).command(ei).command(ni).command(ii).command(oi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ci(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`description`,{type:`string`,description:`Description for the ACL.`}).option(`forward-locally`,{type:`boolean`,description:`The desired forwarding action for this ACL policy. If set to "false", the policy will forward traffic to Cloudflare. If set to "true", the policy will forward traffic locally on the Magic Connector. If not included in request, will default to false.`}).option(`lan-1-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-1-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-1-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-1-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-2-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-2-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`name`,{type:`string`,description:`The name of the ACL.`}).option(`protocols`,{type:`string`,array:!0,description:`The protocols field`}).option(`unidirectional`,{type:`boolean`,description:`The desired traffic direction for this ACL policy. If set to "false", the policy will allow bidirectional traffic. If set to "true", the policy will only allow traffic in one direction. If not included in request, will default to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Bidirectional ACL policy for local network traffic within a site.`})}const li={command:`create <site-id>`,describe:`Creates a new Site ACL.`,builder:ci,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites acls create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/acls`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({description:d(r.description,`description`,`text`),forward_locally:r[`forward-locally`],lan_1:{lan_id:d(r[`lan-1-lan-id`],`lan-1-lan-id`,`text`),lan_name:d(r[`lan-1-lan-name`],`lan-1-lan-name`,`text`),port_ranges:r[`lan-1-port-ranges`],ports:r[`lan-1-ports`]},lan_2:{lan_id:d(r[`lan-2-lan-id`],`lan-2-lan-id`,`text`),lan_name:d(r[`lan-2-lan-name`],`lan-2-lan-name`,`text`),port_ranges:r[`lan-2-port-ranges`],ports:r[`lan-2-ports`]},name:d(r.name,`name`,`text`),protocols:r.protocols,unidirectional:r.unidirectional}):c(r.body)});return}let l=await i(r),p=r.local?e:await t();if(r.accountId=p,r.body){let e=c(r.body);a(await s(`Creating`,async()=>l.magicTransit.sites.acls.create({...e,account_id:p,site_id:r[`site-id`]})),{successLabel:`Created`});return}r[`lan-1-lan-id`]===void 0&&(r[`lan-1-lan-id`]=await f(`lan-1-lan-id`,`The identifier for the LAN you want to create an ACL policy with.`)),r[`lan-2-lan-id`]===void 0&&(r[`lan-2-lan-id`]=await f(`lan-2-lan-id`,`The identifier for the LAN you want to create an ACL policy with.`)),r.name===void 0&&(r.name=await f(`name`,`The name of the ACL.`));let m=u({description:d(r.description,`description`,`text`),forward_locally:r[`forward-locally`],lan_1:{lan_id:d(r[`lan-1-lan-id`],`lan-1-lan-id`,`text`),lan_name:d(r[`lan-1-lan-name`],`lan-1-lan-name`,`text`),port_ranges:r[`lan-1-port-ranges`],ports:r[`lan-1-ports`]},lan_2:{lan_id:d(r[`lan-2-lan-id`],`lan-2-lan-id`,`text`),lan_name:d(r[`lan-2-lan-name`],`lan-2-lan-name`,`text`),port_ranges:r[`lan-2-port-ranges`],ports:r[`lan-2-ports`]},name:d(r.name,`name`,`text`),protocols:r.protocols,unidirectional:r.unidirectional});a(await s(`Creating`,async()=>l.magicTransit.sites.acls.create({...m,account_id:p,site_id:r[`site-id`]})),{successLabel:`Created`})}};function ui(e){return e.positional(`acl-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const di={command:`delete <acl-id>`,describe:`Remove a specific Site ACL.`,builder:ui,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites acls delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/acls/${r[`acl-id`]==null?`<acl-id>`:encodeURIComponent(String(r[`acl-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"acl-id":String(r[`acl-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await m({force:!!r.force})){process.stderr.write(`Aborted.
 `);return}a(await s(`Deleting`,async()=>c.magicTransit.sites.acls.delete({account_id:l,site_id:r[`site-id`],acl_id:r[`acl-id`]})),{successLabel:`Deleted`})}};function fi(e){return e.positional(`acl-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`description`,{type:`string`,description:`Description for the ACL.`}).option(`forward-locally`,{type:`boolean`,description:`The desired forwarding action for this ACL policy. If set to "false", the policy will forward traffic to Cloudflare. If set to "true", the policy will forward traffic locally on the Magic Connector. If not included in request, will default to false.`}).option(`lan-1-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-1-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-1-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-1-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-2-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-2-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`name`,{type:`string`,description:`The name of the ACL.`}).option(`protocols`,{type:`string`,array:!0,description:`The protocols field`}).option(`unidirectional`,{type:`boolean`,description:`The desired traffic direction for this ACL policy. If set to "false", the policy will allow bidirectional traffic. If set to "true", the policy will only allow traffic in one direction. If not included in request, will default to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`lan-1-lan-id`,`lan-1-lan-name`,`lan-1-port-ranges`,`lan-1-ports`].some(t=>e[t]!==void 0)){let t=[`lan-1-lan-id`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --lan_1-* flag is set`)}return!0}).check(e=>{if([`lan-2-lan-id`,`lan-2-lan-name`,`lan-2-port-ranges`,`lan-2-ports`].some(t=>e[t]!==void 0)){let t=[`lan-2-lan-id`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --lan_2-* flag is set`)}return!0})}const pi={command:`edit <acl-id>`,describe:`Patch a specific Site ACL.`,builder:fi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites acls edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/acls/${r[`acl-id`]==null?`<acl-id>`:encodeURIComponent(String(r[`acl-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"acl-id":String(r[`acl-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({description:d(r.description,`description`,`text`),forward_locally:r[`forward-locally`],lan_1:{lan_id:d(r[`lan-1-lan-id`],`lan-1-lan-id`,`text`),lan_name:d(r[`lan-1-lan-name`],`lan-1-lan-name`,`text`),port_ranges:r[`lan-1-port-ranges`],ports:r[`lan-1-ports`]},lan_2:{lan_id:d(r[`lan-2-lan-id`],`lan-2-lan-id`,`text`),lan_name:d(r[`lan-2-lan-name`],`lan-2-lan-name`,`text`),port_ranges:r[`lan-2-port-ranges`],ports:r[`lan-2-ports`]},name:d(r.name,`name`,`text`),protocols:r.protocols,unidirectional:r.unidirectional}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Updating`,async()=>l.magicTransit.sites.acls.edit({body:e,account_id:f,site_id:r[`site-id`],acl_id:r[`acl-id`]})),{successLabel:`Updated`});return}let p=u({description:d(r.description,`description`,`text`),forward_locally:r[`forward-locally`],lan_1:{lan_id:d(r[`lan-1-lan-id`],`lan-1-lan-id`,`text`),lan_name:d(r[`lan-1-lan-name`],`lan-1-lan-name`,`text`),port_ranges:r[`lan-1-port-ranges`],ports:r[`lan-1-ports`]},lan_2:{lan_id:d(r[`lan-2-lan-id`],`lan-2-lan-id`,`text`),lan_name:d(r[`lan-2-lan-name`],`lan-2-lan-name`,`text`),port_ranges:r[`lan-2-port-ranges`],ports:r[`lan-2-ports`]},name:d(r.name,`name`,`text`),protocols:r.protocols,unidirectional:r.unidirectional});a(await s(`Updating`,async()=>l.magicTransit.sites.acls.edit({body:p,account_id:f,site_id:r[`site-id`],acl_id:r[`acl-id`]})),{successLabel:`Updated`})}};function mi(e){return e.positional(`acl-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const hi={command:`get <acl-id>`,describe:`Get a specific Site ACL.`,builder:mi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites acls get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/acls/${r[`acl-id`]==null?`<acl-id>`:encodeURIComponent(String(r[`acl-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"acl-id":String(r[`acl-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.acls.get({account_id:l,site_id:r[`site-id`],acl_id:r[`acl-id`]})),{successLabel:`Loaded`})}};function gi(e){return e.option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _i={command:`list`,describe:`Lists Site ACLs associated with an account.`,builder:gi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites acls list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/acls`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.acls.list({account_id:l,site_id:r[`site-id`]})),{successLabel:`Loaded`})}};function vi(e){return e.positional(`acl-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`description`,{type:`string`,description:`Description for the ACL.`}).option(`forward-locally`,{type:`boolean`,description:`The desired forwarding action for this ACL policy. If set to "false", the policy will forward traffic to Cloudflare. If set to "true", the policy will forward traffic locally on the Magic Connector. If not included in request, will default to false.`}).option(`lan-1-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-1-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-1-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-1-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-2-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-2-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`name`,{type:`string`,description:`The name of the ACL.`}).option(`protocols`,{type:`string`,array:!0,description:`The protocols field`}).option(`unidirectional`,{type:`boolean`,description:`The desired traffic direction for this ACL policy. If set to "false", the policy will allow bidirectional traffic. If set to "true", the policy will only allow traffic in one direction. If not included in request, will default to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`lan-1-lan-id`,`lan-1-lan-name`,`lan-1-port-ranges`,`lan-1-ports`].some(t=>e[t]!==void 0)){let t=[`lan-1-lan-id`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --lan_1-* flag is set`)}return!0}).check(e=>{if([`lan-2-lan-id`,`lan-2-lan-name`,`lan-2-port-ranges`,`lan-2-ports`].some(t=>e[t]!==void 0)){let t=[`lan-2-lan-id`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --lan_2-* flag is set`)}return!0})}const yi={command:`update <acl-id>`,describe:`Update a specific Site ACL.`,builder:vi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites acls update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/acls/${r[`acl-id`]==null?`<acl-id>`:encodeURIComponent(String(r[`acl-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"acl-id":String(r[`acl-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({description:d(r.description,`description`,`text`),forward_locally:r[`forward-locally`],lan_1:{lan_id:d(r[`lan-1-lan-id`],`lan-1-lan-id`,`text`),lan_name:d(r[`lan-1-lan-name`],`lan-1-lan-name`,`text`),port_ranges:r[`lan-1-port-ranges`],ports:r[`lan-1-ports`]},lan_2:{lan_id:d(r[`lan-2-lan-id`],`lan-2-lan-id`,`text`),lan_name:d(r[`lan-2-lan-name`],`lan-2-lan-name`,`text`),port_ranges:r[`lan-2-port-ranges`],ports:r[`lan-2-ports`]},name:d(r.name,`name`,`text`),protocols:r.protocols,unidirectional:r.unidirectional}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Updating`,async()=>l.magicTransit.sites.acls.update({body:e,account_id:f,site_id:r[`site-id`],acl_id:r[`acl-id`]})),{successLabel:`Updated`});return}let p=u({description:d(r.description,`description`,`text`),forward_locally:r[`forward-locally`],lan_1:{lan_id:d(r[`lan-1-lan-id`],`lan-1-lan-id`,`text`),lan_name:d(r[`lan-1-lan-name`],`lan-1-lan-name`,`text`),port_ranges:r[`lan-1-port-ranges`],ports:r[`lan-1-ports`]},lan_2:{lan_id:d(r[`lan-2-lan-id`],`lan-2-lan-id`,`text`),lan_name:d(r[`lan-2-lan-name`],`lan-2-lan-name`,`text`),port_ranges:r[`lan-2-port-ranges`],ports:r[`lan-2-ports`]},name:d(r.name,`name`,`text`),protocols:r.protocols,unidirectional:r.unidirectional});a(await s(`Updating`,async()=>l.magicTransit.sites.acls.update({body:p,account_id:f,site_id:r[`site-id`],acl_id:r[`acl-id`]})),{successLabel:`Updated`})}},bi={command:`acls`,describe:`Operations for sites.acls`,builder:e=>e.command(li).command(di).command(pi).command(hi).command(_i).command(yi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function xi(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`breakout`,{type:`boolean`,description:`Whether to breakout traffic to the app's endpoints directly. Null preserves default behavior.`}).option(`preferred-wans`,{type:`string`,array:!0,description:`WAN interfaces to prefer over default WANs, highest-priority first. Can only be specified for breakout rules (breakout must be true).`}).option(`priority`,{type:`number`,description:`Priority of traffic. 0 is default, anything greater is prioritized. (Currently only 0 and 1 are supported)`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Si={command:`create <site-id>`,describe:`Creates a new App Config for a site`,builder:xi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites app-configuration create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/app_configs`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({breakout:r.breakout,preferred_wans:r[`preferred-wans`],priority:r.priority}):c(r.body)});return}let l=await i(r),d=r.local?e:await t();if(r.accountId=d,r.body){let e=c(r.body);a(await s(`Creating`,async()=>l.magicTransit.sites.appConfiguration.create({...e,account_id:d,site_id:r[`site-id`]})),{successLabel:`Created`});return}let f=u({breakout:r.breakout,preferred_wans:r[`preferred-wans`],priority:r.priority});a(await s(`Creating`,async()=>l.magicTransit.sites.appConfiguration.create({...f,account_id:d,site_id:r[`site-id`]})),{successLabel:`Created`})}};function Ci(e){return e.positional(`app-config-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const wi={command:`delete <app-config-id>`,describe:`Deletes specific App Config associated with a site.`,builder:Ci,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites app-configuration delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/app_configs/${r[`app-config-id`]==null?`<app-config-id>`:encodeURIComponent(String(r[`app-config-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"app-config-id":String(r[`app-config-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await m({force:!!r.force})){process.stderr.write(`Aborted.
 `);return}a(await s(`Deleting`,async()=>c.magicTransit.sites.appConfiguration.delete({account_id:l,site_id:r[`site-id`],app_config_id:r[`app-config-id`]})),{successLabel:`Deleted`})}};function Ti(e){return e.positional(`app-config-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`account-app-id`,{type:`string`,description:`Magic account app ID.`}).option(`breakout`,{type:`boolean`,description:`Whether to breakout traffic to the app's endpoints directly. Null preserves default behavior.`}).option(`managed-app-id`,{type:`string`,description:`Managed app ID.`}).option(`preferred-wans`,{type:`string`,array:!0,description:`WAN interfaces to prefer over default WANs, highest-priority first. Can only be specified for breakout rules (breakout must be true).`}).option(`priority`,{type:`number`,description:`Priority of traffic. 0 is default, anything greater is prioritized. (Currently only 0 and 1 are supported)`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ei={command:`edit <app-config-id>`,describe:`Updates an App Config for a site`,builder:Ti,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites app-configuration edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/app_configs/${r[`app-config-id`]==null?`<app-config-id>`:encodeURIComponent(String(r[`app-config-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"app-config-id":String(r[`app-config-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({account_app_id:d(r[`account-app-id`],`account-app-id`,`text`),breakout:r.breakout,managed_app_id:d(r[`managed-app-id`],`managed-app-id`,`text`),preferred_wans:r[`preferred-wans`],priority:r.priority}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Updating`,async()=>l.magicTransit.sites.appConfiguration.edit({body:e,account_id:f,site_id:r[`site-id`],app_config_id:r[`app-config-id`]})),{successLabel:`Updated`});return}let p=u({account_app_id:d(r[`account-app-id`],`account-app-id`,`text`),breakout:r.breakout,managed_app_id:d(r[`managed-app-id`],`managed-app-id`,`text`),preferred_wans:r[`preferred-wans`],priority:r.priority});a(await s(`Updating`,async()=>l.magicTransit.sites.appConfiguration.edit({body:p,account_id:f,site_id:r[`site-id`],app_config_id:r[`app-config-id`]})),{successLabel:`Updated`})}};function Di(e){return e.option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Oi={command:`list`,describe:`Lists App Configs associated with a site.`,builder:Di,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites app-configuration list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/app_configs`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.appConfiguration.list({account_id:l,site_id:r[`site-id`]})),{successLabel:`Loaded`})}};function ki(e){return e.positional(`app-config-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`account-app-id`,{type:`string`,description:`Magic account app ID.`}).option(`breakout`,{type:`boolean`,description:`Whether to breakout traffic to the app's endpoints directly. Null preserves default behavior.`}).option(`managed-app-id`,{type:`string`,description:`Managed app ID.`}).option(`preferred-wans`,{type:`string`,array:!0,description:`WAN interfaces to prefer over default WANs, highest-priority first. Can only be specified for breakout rules (breakout must be true).`}).option(`priority`,{type:`number`,description:`Priority of traffic. 0 is default, anything greater is prioritized. (Currently only 0 and 1 are supported)`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ai={command:`update <app-config-id>`,describe:`Updates an App Config for a site`,builder:ki,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites app-configuration update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/app_configs/${r[`app-config-id`]==null?`<app-config-id>`:encodeURIComponent(String(r[`app-config-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"app-config-id":String(r[`app-config-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({account_app_id:d(r[`account-app-id`],`account-app-id`,`text`),breakout:r.breakout,managed_app_id:d(r[`managed-app-id`],`managed-app-id`,`text`),preferred_wans:r[`preferred-wans`],priority:r.priority}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Updating`,async()=>l.magicTransit.sites.appConfiguration.update({body:e,account_id:f,site_id:r[`site-id`],app_config_id:r[`app-config-id`]})),{successLabel:`Updated`});return}let p=u({account_app_id:d(r[`account-app-id`],`account-app-id`,`text`),breakout:r.breakout,managed_app_id:d(r[`managed-app-id`],`managed-app-id`,`text`),preferred_wans:r[`preferred-wans`],priority:r.priority});a(await s(`Updating`,async()=>l.magicTransit.sites.appConfiguration.update({body:p,account_id:f,site_id:r[`site-id`],app_config_id:r[`app-config-id`]})),{successLabel:`Updated`})}},ji={command:`app-configuration`,describe:`Operations for sites.app-configuration`,builder:e=>e.command(Si).command(wi).command(Ei).command(Oi).command(Ai).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Mi(e){return e.option(`connector-id`,{type:`string`,description:`Magic Connector identifier tag.`}).option(`description`,{type:`string`,description:`The description field`}).option(`ha-mode`,{type:`boolean`,description:`Site high availability mode. If set to true, the site can have two connectors and runs in high availability mode.`}).option(`location-lat`,{type:`string`,description:`Latitude`}).option(`location-lon`,{type:`string`,description:`Longitude`}).option(`name`,{type:`string`,description:`The name of the site.`}).option(`secondary-connector-id`,{type:`string`,description:`Magic Connector identifier tag. Used when high availability mode is on.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ni={command:`create`,describe:`Creates a new Site`,builder:Mi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites`,pathParams:{},bodyKind:`json`,body:r.body===void 0?u({connector_id:d(r[`connector-id`],`connector-id`,`text`),description:d(r.description,`description`,`text`),ha_mode:r[`ha-mode`],location:{lat:d(r[`location-lat`],`location-lat`,`text`),lon:d(r[`location-lon`],`location-lon`,`text`)},name:d(r.name,`name`,`text`),secondary_connector_id:d(r[`secondary-connector-id`],`secondary-connector-id`,`text`)}):c(r.body)});return}let l=await i(r),p=r.local?e:await t();if(r.accountId=p,r.body){let e=c(r.body);a(await s(`Creating`,async()=>l.magicTransit.sites.create({...e,account_id:p})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await f(`name`,`The name of the site.`));let m=u({connector_id:d(r[`connector-id`],`connector-id`,`text`),description:d(r.description,`description`,`text`),ha_mode:r[`ha-mode`],location:{lat:d(r[`location-lat`],`location-lat`,`text`),lon:d(r[`location-lon`],`location-lon`,`text`)},name:d(r.name,`name`,`text`),secondary_connector_id:d(r[`secondary-connector-id`],`secondary-connector-id`,`text`)});a(await s(`Creating`,async()=>l.magicTransit.sites.create({...m,account_id:p})),{successLabel:`Created`})}};function Pi(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Fi={command:`delete <site-id>`,describe:`Remove a specific Site.`,builder:Pi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await m({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}a(await s(`Deleting`,async()=>c.magicTransit.sites.delete({account_id:l,site_id:r[`site-id`]})),{successLabel:`Deleted`})}};function Ii(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`connector-id`,{type:`string`,description:`Magic Connector identifier tag.`}).option(`description`,{type:`string`,description:`The description field`}).option(`location-lat`,{type:`string`,description:`Latitude`}).option(`location-lon`,{type:`string`,description:`Longitude`}).option(`name`,{type:`string`,description:`The name of the site.`}).option(`secondary-connector-id`,{type:`string`,description:`Magic Connector identifier tag. Used when high availability mode is on.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Li={command:`edit <site-id>`,describe:`Patch a specific Site.`,builder:Ii,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({connector_id:d(r[`connector-id`],`connector-id`,`text`),description:d(r.description,`description`,`text`),location:{lat:d(r[`location-lat`],`location-lat`,`text`),lon:d(r[`location-lon`],`location-lon`,`text`)},name:d(r.name,`name`,`text`),secondary_connector_id:d(r[`secondary-connector-id`],`secondary-connector-id`,`text`)}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Updating`,async()=>l.magicTransit.sites.edit({body:e,account_id:f,site_id:r[`site-id`]})),{successLabel:`Updated`});return}let p=u({connector_id:d(r[`connector-id`],`connector-id`,`text`),description:d(r.description,`description`,`text`),location:{lat:d(r[`location-lat`],`location-lat`,`text`),lon:d(r[`location-lon`],`location-lon`,`text`)},name:d(r.name,`name`,`text`),secondary_connector_id:d(r[`secondary-connector-id`],`secondary-connector-id`,`text`)});a(await s(`Updating`,async()=>l.magicTransit.sites.edit({body:p,account_id:f,site_id:r[`site-id`]})),{successLabel:`Updated`})}};function Ri(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zi={command:`get <site-id>`,describe:`Get a specific Site.`,builder:Ri,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit sites get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${c[`site-id`]==null?`<site-id>`:encodeURIComponent(String(c[`site-id`]))}`,pathParams:{"site-id":String(c[`site-id`]??``)},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();c.accountId=d,a(await s(`Loading`,async()=>r(u,`GET`,`/accounts/${d}/magic/sites/${encodeURIComponent(String(c[`site-id`]))}`,{headers:Object.keys(l).length>0?l:void 0})),{successLabel:`Loaded`})}};function Bi(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`bond-id`,{type:`number`,description:`The bond_id field`}).option(`ha-link`,{type:`boolean`,description:`mark true to use this LAN for HA probing. only works for site with HA turned on. only one LAN can be set as the ha_link.`}).option(`is-breakout`,{type:`boolean`,description:`mark true to use this LAN for source-based breakout traffic`}).option(`is-prioritized`,{type:`boolean`,description:`mark true to use this LAN for source-based prioritized traffic`}).option(`name`,{type:`string`,description:`The name field`}).option(`nat-static-prefix`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-dhcp-relay-server-addresses`,{type:`string`,array:!0,description:`List of DHCP server IPs.`}).option(`static-addressing-dhcp-server-dhcp-pool-end`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dhcp-pool-start`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-server`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-servers`,{type:`string`,array:!0,description:`The static_addressing.dhcp_server.dns_servers field`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-virtual-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-dhcp-relay-server-addresses`,`static-addressing-dhcp-server-dhcp-pool-end`,`static-addressing-dhcp-server-dhcp-pool-start`,`static-addressing-dhcp-server-dns-server`,`static-addressing-dhcp-server-dns-servers`,`static-addressing-secondary-address`,`static-addressing-virtual-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0})}const Vi={command:`create <site-id>`,describe:`Creates a new Site LAN. If the site is in high availability mode, static_addressing is required along with secondary and virtual address.`,builder:Bi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({bond_id:r[`bond-id`],ha_link:r[`ha-link`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:d(r.name,`name`,`text`),nat:{static_prefix:d(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:d(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:d(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_server:d(r[`static-addressing-dhcp-server-dns-server`],`static-addressing-dhcp-server-dns-server`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:d(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Creating`,async()=>l.magicTransit.sites.lans.create({...e,account_id:f,site_id:r[`site-id`]})),{successLabel:`Created`});return}let p=u({bond_id:r[`bond-id`],ha_link:r[`ha-link`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:d(r.name,`name`,`text`),nat:{static_prefix:d(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:d(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:d(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_server:d(r[`static-addressing-dhcp-server-dns-server`],`static-addressing-dhcp-server-dns-server`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:d(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]});a(await s(`Creating`,async()=>l.magicTransit.sites.lans.create({...p,account_id:f,site_id:r[`site-id`]})),{successLabel:`Created`})}};function Hi(e){return e.positional(`lan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ui={command:`delete <lan-id>`,describe:`Remove a specific Site LAN.`,builder:Hi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans/${r[`lan-id`]==null?`<lan-id>`:encodeURIComponent(String(r[`lan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"lan-id":String(r[`lan-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await m({force:!!r.force})){process.stderr.write(`Aborted.
-`);return}a(await s(`Deleting`,async()=>c.magicTransit.sites.lans.delete({account_id:l,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Deleted`})}};function Wi(e){return e.positional(`lan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`bond-id`,{type:`number`,description:`The bond_id field`}).option(`is-breakout`,{type:`boolean`,description:`mark true to use this LAN for source-based breakout traffic`}).option(`is-prioritized`,{type:`boolean`,description:`mark true to use this LAN for source-based prioritized traffic`}).option(`name`,{type:`string`,description:`The name field`}).option(`nat-static-prefix`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-dhcp-relay-server-addresses`,{type:`string`,array:!0,description:`List of DHCP server IPs.`}).option(`static-addressing-dhcp-server-dhcp-pool-end`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dhcp-pool-start`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-server`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-servers`,{type:`string`,array:!0,description:`The static_addressing.dhcp_server.dns_servers field`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-virtual-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-dhcp-relay-server-addresses`,`static-addressing-dhcp-server-dhcp-pool-end`,`static-addressing-dhcp-server-dhcp-pool-start`,`static-addressing-dhcp-server-dns-server`,`static-addressing-dhcp-server-dns-servers`,`static-addressing-secondary-address`,`static-addressing-virtual-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0})}const Gi={command:`edit <lan-id>`,describe:`Patch a specific Site LAN.`,builder:Wi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans/${r[`lan-id`]==null?`<lan-id>`:encodeURIComponent(String(r[`lan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"lan-id":String(r[`lan-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({bond_id:r[`bond-id`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:d(r.name,`name`,`text`),nat:{static_prefix:d(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:d(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:d(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_server:d(r[`static-addressing-dhcp-server-dns-server`],`static-addressing-dhcp-server-dns-server`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:d(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Updating`,async()=>l.magicTransit.sites.lans.edit({body:e,account_id:f,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Updated`});return}let p=u({bond_id:r[`bond-id`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:d(r.name,`name`,`text`),nat:{static_prefix:d(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:d(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:d(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_server:d(r[`static-addressing-dhcp-server-dns-server`],`static-addressing-dhcp-server-dns-server`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:d(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]});a(await s(`Updating`,async()=>l.magicTransit.sites.lans.edit({body:p,account_id:f,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Updated`})}};function Ki(e){return e.positional(`lan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qi={command:`get <lan-id>`,describe:`Get a specific Site LAN.`,builder:Ki,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans/${r[`lan-id`]==null?`<lan-id>`:encodeURIComponent(String(r[`lan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"lan-id":String(r[`lan-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.lans.get({account_id:l,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Loaded`})}};function Ji(e){return e.option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yi={command:`list`,describe:`Lists Site LANs associated with an account.`,builder:Ji,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.lans.list({account_id:l,site_id:r[`site-id`]})),{successLabel:`Loaded`})}};function Xi(e){return e.positional(`lan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`bond-id`,{type:`number`,description:`The bond_id field`}).option(`is-breakout`,{type:`boolean`,description:`mark true to use this LAN for source-based breakout traffic`}).option(`is-prioritized`,{type:`boolean`,description:`mark true to use this LAN for source-based prioritized traffic`}).option(`name`,{type:`string`,description:`The name field`}).option(`nat-static-prefix`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-dhcp-relay-server-addresses`,{type:`string`,array:!0,description:`List of DHCP server IPs.`}).option(`static-addressing-dhcp-server-dhcp-pool-end`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dhcp-pool-start`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-server`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-servers`,{type:`string`,array:!0,description:`The static_addressing.dhcp_server.dns_servers field`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-virtual-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-dhcp-relay-server-addresses`,`static-addressing-dhcp-server-dhcp-pool-end`,`static-addressing-dhcp-server-dhcp-pool-start`,`static-addressing-dhcp-server-dns-server`,`static-addressing-dhcp-server-dns-servers`,`static-addressing-secondary-address`,`static-addressing-virtual-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0})}const Zi={command:`update <lan-id>`,describe:`Update a specific Site LAN.`,builder:Xi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans/${r[`lan-id`]==null?`<lan-id>`:encodeURIComponent(String(r[`lan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"lan-id":String(r[`lan-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({bond_id:r[`bond-id`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:d(r.name,`name`,`text`),nat:{static_prefix:d(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:d(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:d(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_server:d(r[`static-addressing-dhcp-server-dns-server`],`static-addressing-dhcp-server-dns-server`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:d(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Updating`,async()=>l.magicTransit.sites.lans.update({body:e,account_id:f,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Updated`});return}let p=u({bond_id:r[`bond-id`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:d(r.name,`name`,`text`),nat:{static_prefix:d(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:d(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:d(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_server:d(r[`static-addressing-dhcp-server-dns-server`],`static-addressing-dhcp-server-dns-server`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:d(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]});a(await s(`Updating`,async()=>l.magicTransit.sites.lans.update({body:p,account_id:f,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Updated`})}},Qi={command:`lans`,describe:`Operations for sites.lans`,builder:e=>e.command(Vi).command(Ui).command(Gi).command(qi).command(Yi).command(Zi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $i(e){return e.option(`connectorid`,{type:`string`,description:`Identifier`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ea={command:`list`,describe:`Lists Sites associated with an account. Use connectorid query param to return sites where connectorid matches either site.ConnectorID or site.SecondaryConnectorID.`,builder:$i,handler:async r=>{let c={connectorid:r.connectorid};if(r.dryRun){o({command:`cf magic-transit sites list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites`,pathParams:{},query:c,bodyKind:`none`});return}let l=await i(r),u=r.local?e:await t();r.accountId=u,a(await s(`Loading`,async()=>l.magicTransit.sites.list({account_id:u,...c})),{successLabel:`Loaded`})}};function ta(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`active-timeout`,{type:`number`,description:`Timeout in seconds for active flows.`}).option(`collector-ip`,{type:`string`,description:`IPv4 address of the NetFlow collector.`}).option(`collector-port`,{type:`number`,description:`UDP port of the NetFlow collector.`}).option(`inactive-timeout`,{type:`number`,description:`Timeout in seconds for inactive flows.`}).option(`sampling-rate`,{type:`number`,description:`Sampling rate for NetFlow records (1 = every packet).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const na={command:`create <site-id>`,describe:`Creates a NetFlow configuration for a site.`,builder:ta,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites netflow-config create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/netflow_config`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({active_timeout:r[`active-timeout`],collector_ip:d(r[`collector-ip`],`collector-ip`,`text`),collector_port:r[`collector-port`],inactive_timeout:r[`inactive-timeout`],sampling_rate:r[`sampling-rate`]}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Creating`,async()=>l.magicTransit.sites.netflowConfig.create({body:e,account_id:f,site_id:r[`site-id`]})),{successLabel:`Created`});return}let p=u({active_timeout:r[`active-timeout`],collector_ip:d(r[`collector-ip`],`collector-ip`,`text`),collector_port:r[`collector-port`],inactive_timeout:r[`inactive-timeout`],sampling_rate:r[`sampling-rate`]});a(await s(`Creating`,async()=>l.magicTransit.sites.netflowConfig.create({body:p,account_id:f,site_id:r[`site-id`]})),{successLabel:`Created`})}};function ra(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ia={command:`delete <site-id>`,describe:`Remove NetFlow configuration for a site.`,builder:ra,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites netflow-config delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/netflow_config`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await m({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.sites.delete({account_id:l,site_id:r[`site-id`]})),{successLabel:`Deleted`})}};function Ii(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`connector-id`,{type:`string`,description:`Magic Connector identifier tag.`}).option(`description`,{type:`string`,description:`The description field`}).option(`location-lat`,{type:`string`,description:`Latitude`}).option(`location-lon`,{type:`string`,description:`Longitude`}).option(`name`,{type:`string`,description:`The name of the site.`}).option(`secondary-connector-id`,{type:`string`,description:`Magic Connector identifier tag. Used when high availability mode is on.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Li={command:`edit <site-id>`,describe:`Patch a specific Site.`,builder:Ii,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({connector_id:d(r[`connector-id`],`connector-id`,`text`),description:d(r.description,`description`,`text`),location:{lat:d(r[`location-lat`],`location-lat`,`text`),lon:d(r[`location-lon`],`location-lon`,`text`)},name:d(r.name,`name`,`text`),secondary_connector_id:d(r[`secondary-connector-id`],`secondary-connector-id`,`text`)}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Updating`,async()=>l.magicTransit.sites.edit({body:e,account_id:f,site_id:r[`site-id`]})),{successLabel:`Updated`});return}let p=u({connector_id:d(r[`connector-id`],`connector-id`,`text`),description:d(r.description,`description`,`text`),location:{lat:d(r[`location-lat`],`location-lat`,`text`),lon:d(r[`location-lon`],`location-lon`,`text`)},name:d(r.name,`name`,`text`),secondary_connector_id:d(r[`secondary-connector-id`],`secondary-connector-id`,`text`)});a(await s(`Updating`,async()=>l.magicTransit.sites.edit({body:p,account_id:f,site_id:r[`site-id`]})),{successLabel:`Updated`})}};function Ri(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const zi={command:`get <site-id>`,describe:`Get a specific Site.`,builder:Ri,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit sites get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${c[`site-id`]==null?`<site-id>`:encodeURIComponent(String(c[`site-id`]))}`,pathParams:{"site-id":String(c[`site-id`]??``)},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();c.accountId=d,a(await s(`Loading`,async()=>r(u,`GET`,`/accounts/${d}/magic/sites/${encodeURIComponent(String(c[`site-id`]))}`,{headers:Object.keys(l).length>0?l:void 0})),{successLabel:`Loaded`})}};function Bi(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`bond-id`,{type:`number`,description:`The bond_id field`}).option(`ha-link`,{type:`boolean`,description:`mark true to use this LAN for HA probing. only works for site with HA turned on. only one LAN can be set as the ha_link.`}).option(`is-breakout`,{type:`boolean`,description:`mark true to use this LAN for source-based breakout traffic`}).option(`is-prioritized`,{type:`boolean`,description:`mark true to use this LAN for source-based prioritized traffic`}).option(`name`,{type:`string`,description:`The name field`}).option(`nat-static-prefix`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-dhcp-relay-server-addresses`,{type:`string`,array:!0,description:`List of DHCP server IPs.`}).option(`static-addressing-dhcp-server-dhcp-pool-end`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dhcp-pool-start`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-servers`,{type:`string`,array:!0,description:`The static_addressing.dhcp_server.dns_servers field`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-virtual-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-dhcp-relay-server-addresses`,`static-addressing-dhcp-server-dhcp-pool-end`,`static-addressing-dhcp-server-dhcp-pool-start`,`static-addressing-dhcp-server-dns-servers`,`static-addressing-secondary-address`,`static-addressing-virtual-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0})}const Vi={command:`create <site-id>`,describe:`Creates a new Site LAN. If the site is in high availability mode, static_addressing is required along with secondary and virtual address.`,builder:Bi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({bond_id:r[`bond-id`],ha_link:r[`ha-link`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:d(r.name,`name`,`text`),nat:{static_prefix:d(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:d(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:d(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:d(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Creating`,async()=>l.magicTransit.sites.lans.create({...e,account_id:f,site_id:r[`site-id`]})),{successLabel:`Created`});return}let p=u({bond_id:r[`bond-id`],ha_link:r[`ha-link`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:d(r.name,`name`,`text`),nat:{static_prefix:d(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:d(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:d(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:d(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]});a(await s(`Creating`,async()=>l.magicTransit.sites.lans.create({...p,account_id:f,site_id:r[`site-id`]})),{successLabel:`Created`})}};function Hi(e){return e.positional(`lan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ui={command:`delete <lan-id>`,describe:`Remove a specific Site LAN.`,builder:Hi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans/${r[`lan-id`]==null?`<lan-id>`:encodeURIComponent(String(r[`lan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"lan-id":String(r[`lan-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await m({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.sites.lans.delete({account_id:l,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Deleted`})}};function Wi(e){return e.positional(`lan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`bond-id`,{type:`number`,description:`The bond_id field`}).option(`is-breakout`,{type:`boolean`,description:`mark true to use this LAN for source-based breakout traffic`}).option(`is-prioritized`,{type:`boolean`,description:`mark true to use this LAN for source-based prioritized traffic`}).option(`name`,{type:`string`,description:`The name field`}).option(`nat-static-prefix`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-dhcp-relay-server-addresses`,{type:`string`,array:!0,description:`List of DHCP server IPs.`}).option(`static-addressing-dhcp-server-dhcp-pool-end`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dhcp-pool-start`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-servers`,{type:`string`,array:!0,description:`The static_addressing.dhcp_server.dns_servers field`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-virtual-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-dhcp-relay-server-addresses`,`static-addressing-dhcp-server-dhcp-pool-end`,`static-addressing-dhcp-server-dhcp-pool-start`,`static-addressing-dhcp-server-dns-servers`,`static-addressing-secondary-address`,`static-addressing-virtual-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0})}const Gi={command:`edit <lan-id>`,describe:`Patch a specific Site LAN.`,builder:Wi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans/${r[`lan-id`]==null?`<lan-id>`:encodeURIComponent(String(r[`lan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"lan-id":String(r[`lan-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({bond_id:r[`bond-id`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:d(r.name,`name`,`text`),nat:{static_prefix:d(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:d(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:d(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:d(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Updating`,async()=>l.magicTransit.sites.lans.edit({body:e,account_id:f,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Updated`});return}let p=u({bond_id:r[`bond-id`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:d(r.name,`name`,`text`),nat:{static_prefix:d(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:d(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:d(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:d(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]});a(await s(`Updating`,async()=>l.magicTransit.sites.lans.edit({body:p,account_id:f,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Updated`})}};function Ki(e){return e.positional(`lan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qi={command:`get <lan-id>`,describe:`Get a specific Site LAN.`,builder:Ki,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans/${r[`lan-id`]==null?`<lan-id>`:encodeURIComponent(String(r[`lan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"lan-id":String(r[`lan-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.lans.get({account_id:l,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Loaded`})}};function Ji(e){return e.option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yi={command:`list`,describe:`Lists Site LANs associated with an account.`,builder:Ji,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.lans.list({account_id:l,site_id:r[`site-id`]})),{successLabel:`Loaded`})}};function Xi(e){return e.positional(`lan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`bond-id`,{type:`number`,description:`The bond_id field`}).option(`is-breakout`,{type:`boolean`,description:`mark true to use this LAN for source-based breakout traffic`}).option(`is-prioritized`,{type:`boolean`,description:`mark true to use this LAN for source-based prioritized traffic`}).option(`name`,{type:`string`,description:`The name field`}).option(`nat-static-prefix`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-dhcp-relay-server-addresses`,{type:`string`,array:!0,description:`List of DHCP server IPs.`}).option(`static-addressing-dhcp-server-dhcp-pool-end`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dhcp-pool-start`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-servers`,{type:`string`,array:!0,description:`The static_addressing.dhcp_server.dns_servers field`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-virtual-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-dhcp-relay-server-addresses`,`static-addressing-dhcp-server-dhcp-pool-end`,`static-addressing-dhcp-server-dhcp-pool-start`,`static-addressing-dhcp-server-dns-servers`,`static-addressing-secondary-address`,`static-addressing-virtual-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0})}const Zi={command:`update <lan-id>`,describe:`Update a specific Site LAN.`,builder:Xi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans/${r[`lan-id`]==null?`<lan-id>`:encodeURIComponent(String(r[`lan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"lan-id":String(r[`lan-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({bond_id:r[`bond-id`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:d(r.name,`name`,`text`),nat:{static_prefix:d(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:d(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:d(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:d(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Updating`,async()=>l.magicTransit.sites.lans.update({body:e,account_id:f,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Updated`});return}let p=u({bond_id:r[`bond-id`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:d(r.name,`name`,`text`),nat:{static_prefix:d(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:d(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:d(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:d(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]});a(await s(`Updating`,async()=>l.magicTransit.sites.lans.update({body:p,account_id:f,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Updated`})}},Qi={command:`lans`,describe:`Operations for sites.lans`,builder:e=>e.command(Vi).command(Ui).command(Gi).command(qi).command(Yi).command(Zi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $i(e){return e.option(`connectorid`,{type:`string`,description:`Identifier`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ea={command:`list`,describe:`Lists Sites associated with an account. Use connectorid query param to return sites where connectorid matches either site.ConnectorID or site.SecondaryConnectorID.`,builder:$i,handler:async r=>{let c={connectorid:r.connectorid};if(r.dryRun){o({command:`cf magic-transit sites list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites`,pathParams:{},query:c,bodyKind:`none`});return}let l=await i(r),u=r.local?e:await t();r.accountId=u,a(await s(`Loading`,async()=>l.magicTransit.sites.list({account_id:u,...c})),{successLabel:`Loaded`})}};function ta(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`active-timeout`,{type:`number`,description:`Timeout in seconds for active flows.`}).option(`collector-ip`,{type:`string`,description:`IPv4 address of the NetFlow collector.`}).option(`collector-port`,{type:`number`,description:`UDP port of the NetFlow collector.`}).option(`inactive-timeout`,{type:`number`,description:`Timeout in seconds for inactive flows.`}).option(`sampling-rate`,{type:`number`,description:`Sampling rate for NetFlow records (1 = every packet).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const na={command:`create <site-id>`,describe:`Creates a NetFlow configuration for a site.`,builder:ta,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites netflow-config create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/netflow_config`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({active_timeout:r[`active-timeout`],collector_ip:d(r[`collector-ip`],`collector-ip`,`text`),collector_port:r[`collector-port`],inactive_timeout:r[`inactive-timeout`],sampling_rate:r[`sampling-rate`]}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Creating`,async()=>l.magicTransit.sites.netflowConfig.create({body:e,account_id:f,site_id:r[`site-id`]})),{successLabel:`Created`});return}let p=u({active_timeout:r[`active-timeout`],collector_ip:d(r[`collector-ip`],`collector-ip`,`text`),collector_port:r[`collector-port`],inactive_timeout:r[`inactive-timeout`],sampling_rate:r[`sampling-rate`]});a(await s(`Creating`,async()=>l.magicTransit.sites.netflowConfig.create({body:p,account_id:f,site_id:r[`site-id`]})),{successLabel:`Created`})}};function ra(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ia={command:`delete <site-id>`,describe:`Remove NetFlow configuration for a site.`,builder:ra,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites netflow-config delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/netflow_config`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await m({force:!!r.force})){process.stderr.write(`Aborted.
 `);return}a(await s(`Deleting`,async()=>c.magicTransit.sites.netflowConfig.delete({account_id:l,site_id:r[`site-id`]})),{successLabel:`Deleted`})}};function aa(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`active-timeout`,{type:`number`,description:`Timeout in seconds for active flows.`}).option(`collector-ip`,{type:`string`,description:`IPv4 address of the NetFlow collector.`}).option(`collector-port`,{type:`number`,description:`UDP port of the NetFlow collector.`}).option(`inactive-timeout`,{type:`number`,description:`Timeout in seconds for inactive flows.`}).option(`sampling-rate`,{type:`number`,description:`Sampling rate for NetFlow records (1 = every packet).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const oa={command:`edit <site-id>`,describe:`Updates NetFlow configuration for a site.`,builder:aa,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites netflow-config edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/netflow_config`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({active_timeout:r[`active-timeout`],collector_ip:d(r[`collector-ip`],`collector-ip`,`text`),collector_port:r[`collector-port`],inactive_timeout:r[`inactive-timeout`],sampling_rate:r[`sampling-rate`]}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Updating`,async()=>l.magicTransit.sites.netflowConfig.edit({body:e,account_id:f,site_id:r[`site-id`]})),{successLabel:`Updated`});return}let p=u({active_timeout:r[`active-timeout`],collector_ip:d(r[`collector-ip`],`collector-ip`,`text`),collector_port:r[`collector-port`],inactive_timeout:r[`inactive-timeout`],sampling_rate:r[`sampling-rate`]});a(await s(`Updating`,async()=>l.magicTransit.sites.netflowConfig.edit({body:p,account_id:f,site_id:r[`site-id`]})),{successLabel:`Updated`})}};function sa(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ca={command:`get <site-id>`,describe:`Get NetFlow configuration for a site.`,builder:sa,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites netflow-config get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/netflow_config`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.netflowConfig.get({account_id:l,site_id:r[`site-id`]})),{successLabel:`Loaded`})}};function la(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`active-timeout`,{type:`number`,description:`Timeout in seconds for active flows.`}).option(`collector-ip`,{type:`string`,description:`IPv4 address of the NetFlow collector.`}).option(`collector-port`,{type:`number`,description:`UDP port of the NetFlow collector.`}).option(`inactive-timeout`,{type:`number`,description:`Timeout in seconds for inactive flows.`}).option(`sampling-rate`,{type:`number`,description:`Sampling rate for NetFlow records (1 = every packet).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ua={command:`update <site-id>`,describe:`Updates NetFlow configuration for a site (partial update).`,builder:la,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites netflow-config update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/netflow_config`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({active_timeout:r[`active-timeout`],collector_ip:d(r[`collector-ip`],`collector-ip`,`text`),collector_port:r[`collector-port`],inactive_timeout:r[`inactive-timeout`],sampling_rate:r[`sampling-rate`]}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Updating`,async()=>l.magicTransit.sites.netflowConfig.update({body:e,account_id:f,site_id:r[`site-id`]})),{successLabel:`Updated`});return}let p=u({active_timeout:r[`active-timeout`],collector_ip:d(r[`collector-ip`],`collector-ip`,`text`),collector_port:r[`collector-port`],inactive_timeout:r[`inactive-timeout`],sampling_rate:r[`sampling-rate`]});a(await s(`Updating`,async()=>l.magicTransit.sites.netflowConfig.update({body:p,account_id:f,site_id:r[`site-id`]})),{successLabel:`Updated`})}},da={command:`netflow-config`,describe:`Operations for sites.netflow-config`,builder:e=>e.command(na).command(ia).command(oa).command(ca).command(ua).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function fa(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`connector-id`,{type:`string`,description:`Magic Connector identifier tag.`}).option(`description`,{type:`string`,description:`The description field`}).option(`location-lat`,{type:`string`,description:`Latitude`}).option(`location-lon`,{type:`string`,description:`Longitude`}).option(`name`,{type:`string`,description:`The name of the site.`}).option(`secondary-connector-id`,{type:`string`,description:`Magic Connector identifier tag. Used when high availability mode is on.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pa={command:`update <site-id>`,describe:`Update a specific Site.`,builder:fa,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({connector_id:d(r[`connector-id`],`connector-id`,`text`),description:d(r.description,`description`,`text`),location:{lat:d(r[`location-lat`],`location-lat`,`text`),lon:d(r[`location-lon`],`location-lon`,`text`)},name:d(r.name,`name`,`text`),secondary_connector_id:d(r[`secondary-connector-id`],`secondary-connector-id`,`text`)}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Updating`,async()=>l.magicTransit.sites.update({body:e,account_id:f,site_id:r[`site-id`]})),{successLabel:`Updated`});return}let p=u({connector_id:d(r[`connector-id`],`connector-id`,`text`),description:d(r.description,`description`,`text`),location:{lat:d(r[`location-lat`],`location-lat`,`text`),lon:d(r[`location-lon`],`location-lon`,`text`)},name:d(r.name,`name`,`text`),secondary_connector_id:d(r[`secondary-connector-id`],`secondary-connector-id`,`text`)});a(await s(`Updating`,async()=>l.magicTransit.sites.update({body:p,account_id:f,site_id:r[`site-id`]})),{successLabel:`Updated`})}};function ma(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`name`,{type:`string`,description:`The name field`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`priority`,{type:`number`,description:`The priority field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-gateway-address`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-gateway-address`,`static-addressing-secondary-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`,`static-addressing-gateway-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0})}const ha={command:`create <site-id>`,describe:`Creates a new Site WAN.`,builder:ma,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites wans create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/wans`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({name:d(r.name,`name`,`text`),physport:r.physport,priority:r.priority,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),gateway_address:d(r[`static-addressing-gateway-address`],`static-addressing-gateway-address`,`text`),secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`)},vlan_tag:r[`vlan-tag`]}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Creating`,async()=>l.magicTransit.sites.wans.create({...e,account_id:f,site_id:r[`site-id`]})),{successLabel:`Created`});return}if(r.physport===void 0)throw Error(`--physport is required (or pass --body with this field set).`);let p=u({name:d(r.name,`name`,`text`),physport:r.physport,priority:r.priority,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),gateway_address:d(r[`static-addressing-gateway-address`],`static-addressing-gateway-address`,`text`),secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`)},vlan_tag:r[`vlan-tag`]});a(await s(`Creating`,async()=>l.magicTransit.sites.wans.create({...p,account_id:f,site_id:r[`site-id`]})),{successLabel:`Created`})}};function ga(e){return e.positional(`wan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const _a={command:`delete <wan-id>`,describe:`Remove a specific Site WAN.`,builder:ga,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites wans delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/wans/${r[`wan-id`]==null?`<wan-id>`:encodeURIComponent(String(r[`wan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"wan-id":String(r[`wan-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await m({force:!!r.force})){process.stderr.write(`Aborted.
 `);return}a(await s(`Deleting`,async()=>c.magicTransit.sites.wans.delete({account_id:l,site_id:r[`site-id`],wan_id:r[`wan-id`]})),{successLabel:`Deleted`})}};function va(e){return e.positional(`wan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`name`,{type:`string`,description:`The name field`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`priority`,{type:`number`,description:`The priority field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-gateway-address`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-gateway-address`,`static-addressing-secondary-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`,`static-addressing-gateway-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0})}const ya={command:`edit <wan-id>`,describe:`Patch a specific Site WAN.`,builder:va,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites wans edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/wans/${r[`wan-id`]==null?`<wan-id>`:encodeURIComponent(String(r[`wan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"wan-id":String(r[`wan-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({name:d(r.name,`name`,`text`),physport:r.physport,priority:r.priority,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),gateway_address:d(r[`static-addressing-gateway-address`],`static-addressing-gateway-address`,`text`),secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`)},vlan_tag:r[`vlan-tag`]}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Updating`,async()=>l.magicTransit.sites.wans.edit({body:e,account_id:f,site_id:r[`site-id`],wan_id:r[`wan-id`]})),{successLabel:`Updated`});return}let p=u({name:d(r.name,`name`,`text`),physport:r.physport,priority:r.priority,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),gateway_address:d(r[`static-addressing-gateway-address`],`static-addressing-gateway-address`,`text`),secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`)},vlan_tag:r[`vlan-tag`]});a(await s(`Updating`,async()=>l.magicTransit.sites.wans.edit({body:p,account_id:f,site_id:r[`site-id`],wan_id:r[`wan-id`]})),{successLabel:`Updated`})}};function ba(e){return e.positional(`wan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xa={command:`get <wan-id>`,describe:`Get a specific Site WAN.`,builder:ba,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites wans get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/wans/${r[`wan-id`]==null?`<wan-id>`:encodeURIComponent(String(r[`wan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"wan-id":String(r[`wan-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.wans.get({account_id:l,site_id:r[`site-id`],wan_id:r[`wan-id`]})),{successLabel:`Loaded`})}};function Sa(e){return e.option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ca={command:`list`,describe:`Lists Site WANs associated with an account.`,builder:Sa,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites wans list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/wans`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.wans.list({account_id:l,site_id:r[`site-id`]})),{successLabel:`Loaded`})}};function wa(e){return e.positional(`wan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`name`,{type:`string`,description:`The name field`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`priority`,{type:`number`,description:`The priority field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-gateway-address`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-gateway-address`,`static-addressing-secondary-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`,`static-addressing-gateway-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0})}const Ta={command:`update <wan-id>`,describe:`Update a specific Site WAN.`,builder:wa,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites wans update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/wans/${r[`wan-id`]==null?`<wan-id>`:encodeURIComponent(String(r[`wan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"wan-id":String(r[`wan-id`]??``)},bodyKind:`json`,body:r.body===void 0?u({name:d(r.name,`name`,`text`),physport:r.physport,priority:r.priority,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),gateway_address:d(r[`static-addressing-gateway-address`],`static-addressing-gateway-address`,`text`),secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`)},vlan_tag:r[`vlan-tag`]}):c(r.body)});return}let l=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=c(r.body);a(await s(`Updating`,async()=>l.magicTransit.sites.wans.update({body:e,account_id:f,site_id:r[`site-id`],wan_id:r[`wan-id`]})),{successLabel:`Updated`});return}let p=u({name:d(r.name,`name`,`text`),physport:r.physport,priority:r.priority,static_addressing:{address:d(r[`static-addressing-address`],`static-addressing-address`,`text`),gateway_address:d(r[`static-addressing-gateway-address`],`static-addressing-gateway-address`,`text`),secondary_address:d(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`)},vlan_tag:r[`vlan-tag`]});a(await s(`Updating`,async()=>l.magicTransit.sites.wans.update({body:p,account_id:f,site_id:r[`site-id`],wan_id:r[`wan-id`]})),{successLabel:`Updated`})}},Ea={command:`wans`,describe:`Operations for sites.wans`,builder:e=>e.command(ha).command(_a).command(ya).command(xa).command(Ca).command(Ta).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Da={command:`sites`,describe:`Magic WAN branch sites — base CRUD, LAN/WAN interface configuration, ACLs, connectors, app configuration, and NetFlow config`,builder:e=>e.command(Ni).command(Fi).command(Li).command(zi).command(ea).command(pa).command(bi).command(ji).command(Qi).command(da).command(Ea).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Oa={command:`magic-transit`,describe:`DDoS-protected network transit — GRE/IPsec tunnels, static routes, Magic WAN sites, connectors, and packet captures`,builder:e=>e.command(P).command(It).command(qt).command(an).command(un).command(yn).command(Rn).command(Zn).command(mr).command(Fr).command(Kr).command(si).command(Da).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{Oa as default};

package/dist/{managed-transforms-DCmogkxv.mjs → managed-transforms-Cm_KVCMB.mjs}

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import{h as e}from"./oauth-BPizUUqP.mjs";import{r as t}from"./auth-DuLchM18.mjs";import{t as n}from"./output-DgW1hQGX.mjs";import{n as r,t as i}from"./progress-B84wYh91.mjs";import{n as a}from"./body-parser-CYD7PKFC.mjs";import{n as o}from"./prompt-CDtLWxNv.mjs";function s(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const c={command:`delete`,describe:`Disables all Managed Transforms.`,builder:s,handler:async a=>{if(a.dryRun){r({command:`cf managed-transforms delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${a.zone??a.zoneId??`<zone>`}/managed_headers`,pathParams:{"zone-id":String(a.zone??a[`zone-id`]??``)},bodyKind:`none`});return}let s=await t(a),c=await e({zone:a.zone},s,{quiet:a.quiet});if(a.zoneId=c,!await o({force:!!a.force})){process.stderr.write(`Aborted.
+import{h as e}from"./oauth-B0ETkNcX.mjs";import{r as t}from"./auth-MQEamPN9.mjs";import{t as n}from"./output-DrpYYfnB.mjs";import{n as r,t as i}from"./progress-CsHIt3Tp.mjs";import{n as a}from"./body-parser-C-c9gfH1.mjs";import{n as o}from"./prompt-DdegNPpg.mjs";function s(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const c={command:`delete`,describe:`Disables all Managed Transforms.`,builder:s,handler:async a=>{if(a.dryRun){r({command:`cf managed-transforms delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${a.zone??a.zoneId??`<zone>`}/managed_headers`,pathParams:{"zone-id":String(a.zone??a[`zone-id`]??``)},bodyKind:`none`});return}let s=await t(a),c=await e({zone:a.zone},s,{quiet:a.quiet});if(a.zoneId=c,!await o({force:!!a.force})){process.stderr.write(`Aborted.
 `);return}n(await i(`Deleting`,async()=>s.managedTransforms.delete({zone_id:c})),{successLabel:`Deleted`})}};function l(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const u={command:`list`,describe:`Fetches a list of all Managed Transforms.`,builder:l,handler:async a=>{if(a.dryRun){r({command:`cf managed-transforms list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/zones/${a.zone??a.zoneId??`<zone>`}/managed_headers`,pathParams:{"zone-id":String(a.zone??a[`zone-id`]??``)},bodyKind:`none`});return}let o=await t(a),s=await e({zone:a.zone},o,{quiet:a.quiet});a.zoneId=s,n(await i(`Loading`,async()=>o.managedTransforms.list({zone_id:s})),{successLabel:`Loaded`})}};function d(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A Managed Transforms patch object. Both fields are optional; only the sections provided will be updated.`})}const f={command:`update`,describe:`Updates the status of one or more Managed Transforms.`,builder:d,handler:async o=>{if(o.dryRun){r({command:`cf managed-transforms update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/zones/${o.zone??o.zoneId??`<zone>`}/managed_headers`,pathParams:{"zone-id":String(o.zone??o[`zone-id`]??``)},bodyKind:`json`,body:o.body===void 0?void 0:a(o.body)});return}let s=await t(o),c=await e({zone:o.zone},s,{quiet:o.quiet});if(o.zoneId=c,o.body){let e=a(o.body);n(await i(`Updating`,async()=>s.managedTransforms.update({...e,zone_id:c})),{successLabel:`Updated`});return}n(await i(`Updating`,async()=>s.managedTransforms.update({zone_id:c})),{successLabel:`Updated`})}},p={command:`managed-transforms`,describe:`managed-transforms`,builder:e=>e.command(c).command(u).command(f).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{p as default};

package/dist/{matches-BAeN8VM1.mjs → matches-InA1hwII.mjs}

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-import{t as e}from"./local-DTyuGwTw.mjs";import{f as t,g as n}from"./oauth-BPizUUqP.mjs";import{r}from"./auth-DuLchM18.mjs";import{t as i}from"./output-DgW1hQGX.mjs";import{n as a,t as o}from"./progress-B84wYh91.mjs";function s(e){return e.option(`id`,{type:`string`,description:`ID`}).option(`offset`,{type:`number`,description:`Offset`}).option(`limit`,{type:`number`,description:`Limit`}).option(`include-domain-id`,{type:`boolean`,description:`Include domain ID`}).option(`include-dismissed`,{type:`boolean`,description:`Include dismissed`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const c={command:`get`,describe:`Return matches as CSV for string queries based on ID`,builder:s,handler:async s=>{let c={id:s.id,offset:s.offset,limit:s.limit,include_domain_id:s[`include-domain-id`],include_dismissed:s[`include-dismissed`]};if(s.dryRun){a({command:`cf matches download get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/brand-protection/matches/download`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(s),u=s.local?e:await t();s.accountId=u,i(await o(`Loading`,async()=>l.matches.download.get({account_id:u,...c})),{successLabel:`Loaded`})}},l={command:`download`,describe:`Operations for download`,builder:e=>e.command(c).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function u(e){return e.option(`id`,{type:`string`,description:`ID`}).option(`offset`,{type:`number`,description:`Offset`}).option(`limit`,{type:`number`,description:`Limit`}).option(`include-domain-id`,{type:`boolean`,description:`Include domain ID`}).option(`include-dismissed`,{type:`boolean`,description:`Include dismissed`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const d={command:`get`,describe:`Return matches for string queries based on ID`,builder:u,handler:async s=>{let c={id:s.id,offset:s.offset,limit:s.limit,include_domain_id:s[`include-domain-id`],include_dismissed:s[`include-dismissed`]};if(s.dryRun){a({command:`cf matches get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/brand-protection/matches`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(s),u=s.local?e:await t();s.accountId=u,i(await o(`Loading`,async()=>l.matches.get({account_id:u,...c})),{successLabel:`Loaded`})}},f={command:`matches`,describe:`matches`,builder:e=>e.command(d).command(l).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{f as default};
+import{t as e}from"./local-D-aVNu6A.mjs";import{f as t,g as n}from"./oauth-B0ETkNcX.mjs";import{r}from"./auth-MQEamPN9.mjs";import{t as i}from"./output-DrpYYfnB.mjs";import{n as a,t as o}from"./progress-CsHIt3Tp.mjs";function s(e){return e.option(`id`,{type:`string`,description:`ID`}).option(`offset`,{type:`number`,description:`Offset`}).option(`limit`,{type:`number`,description:`Limit`}).option(`include-domain-id`,{type:`boolean`,description:`Include domain ID`}).option(`include-dismissed`,{type:`boolean`,description:`Include dismissed`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const c={command:`get`,describe:`Return matches as CSV for string queries based on ID`,builder:s,handler:async s=>{let c={id:s.id,offset:s.offset,limit:s.limit,include_domain_id:s[`include-domain-id`],include_dismissed:s[`include-dismissed`]};if(s.dryRun){a({command:`cf matches download get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/brand-protection/matches/download`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(s),u=s.local?e:await t();s.accountId=u,i(await o(`Loading`,async()=>l.matches.download.get({account_id:u,...c})),{successLabel:`Loaded`})}},l={command:`download`,describe:`Operations for download`,builder:e=>e.command(c).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function u(e){return e.option(`id`,{type:`string`,description:`ID`}).option(`offset`,{type:`number`,description:`Offset`}).option(`limit`,{type:`number`,description:`Limit`}).option(`include-domain-id`,{type:`boolean`,description:`Include domain ID`}).option(`include-dismissed`,{type:`boolean`,description:`Include dismissed`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const d={command:`get`,describe:`Return matches for string queries based on ID`,builder:u,handler:async s=>{let c={id:s.id,offset:s.offset,limit:s.limit,include_domain_id:s[`include-domain-id`],include_dismissed:s[`include-dismissed`]};if(s.dryRun){a({command:`cf matches get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/brand-protection/matches`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(s),u=s.local?e:await t();s.accountId=u,i(await o(`Loading`,async()=>l.matches.get({account_id:u,...c})),{successLabel:`Loaded`})}},f={command:`matches`,describe:`matches`,builder:e=>e.command(d).command(l).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{f as default};

package/dist/{mcp-DKZ2D050.mjs → mcp-mJ7bekNJ.mjs}

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
-import{t as e}from"./local-DTyuGwTw.mjs";import{f as t,g as n}from"./oauth-BPizUUqP.mjs";import{r}from"./auth-DuLchM18.mjs";import{t as i}from"./output-DgW1hQGX.mjs";import{n as a,t as o}from"./progress-B84wYh91.mjs";import{n as s,t as c}from"./body-parser-CYD7PKFC.mjs";import{n as l}from"./input-validation-BBKJRoRB.mjs";import{a as u,i as d,n as f}from"./prompt-CDtLWxNv.mjs";import{t as p}from"./cli-types-BWdZbsFE.mjs";function m(e){return e.option(`granularity`,{type:`string`,description:`Granularity`,choices:[`daily`,`monthly`]}).option(`aggregate`,{type:`string`,description:`Aggregate`,choices:[`true`,`false`]}).option(`tz`,{type:`string`,description:`Tz`}).option(`days`,{type:`number`,description:`Daily trailing-window size; defaults to 7 and is ignored for monthly`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const h={command:`account-tool-call-timeseries`,describe:`Returns daily or monthly tool-call counts across the account.`,builder:p(m),handler:async s=>{let c={granularity:s.granularity,aggregate:s.aggregate,tz:s.tz,days:s.days};if(s.dryRun){a({command:`cf mcp portals account-tool-call-timeseries`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/ai-controls/mcp/analytics/tool-calls/timeseries`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(s),u=s.local?e:await t();s.accountId=u,i(await o(`Loading`,async()=>l.mcp.portals.accountToolCallTimeseries({account_id:u,...c})),{successLabel:`Loaded`})}};function g(e){return e.option(`allow-code-mode`,{type:`boolean`,description:"Deprecated: use `code_mode` for new integrations. `true` maps to any non-off Code Mode policy; `false` maps to `code_mode: off`. If both fields are sent, they must be consistent or the request returns a 400."}).option(`code-mode`,{type:`string`,description:"Code Mode policy for this portal. `off`: Code Mode is unavailable; query parameters are ignored. `opt_in`: Code Mode is off by default; clients turn it on with `?codemode=search_and_execute`. `default_on`: Code Mode is on by default; clients can opt out with `?codemode=off`. `enforced`: Code Mode is always on; query parameters are ignored. Defaults to `opt_in` when omitted on create. If both `code_mode` and `allow_code_mode` are sent, they must be consistent or the request returns a 400.",choices:[`off`,`opt_in`,`default_on`,`enforced`]}).option(`description`,{type:`string`,description:`Optional description of the MCP portal.`}).option(`hostname`,{type:`string`,description:`Hostname where the MCP portal is available.`}).option(`id`,{type:`string`,description:`Unique identifier for the MCP portal.`}).option(`name`,{type:`string`,description:`Display name for the MCP portal.`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound MCP traffic through Zero Trust Secure Web Gateway.`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _={command:`create`,describe:`Creates a new MCP portal for managing AI tool access through Cloudflare Access.`,builder:g,handler:async d=>{if(d.dryRun){a({command:`cf mcp portals create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/ai-controls/mcp/portals`,pathParams:{},bodyKind:`json`,body:d.body===void 0?c({allow_code_mode:d[`allow-code-mode`],code_mode:l(d[`code-mode`],`code-mode`,`text`),description:l(d.description,`description`,`text`),hostname:l(d.hostname,`hostname`,`text`),id:l(d.id,`id`,`text`),name:l(d.name,`name`,`text`),secure_web_gateway:d[`secure-web-gateway`]}):s(d.body)});return}let f=await r(d),p=d.local?e:await t();if(d.accountId=p,d.body){let e=s(d.body);i(await o(`Creating`,async()=>f.mcp.portals.create({...e,account_id:p})),{successLabel:`Created`});return}d.hostname===void 0&&(d.hostname=await u(`hostname`,`Hostname where the MCP portal is available.`)),d.id===void 0&&(d.id=await u(`id`,`Unique identifier for the MCP portal.`)),d.name===void 0&&(d.name=await u(`name`,`Display name for the MCP portal.`));let m=c({allow_code_mode:d[`allow-code-mode`],code_mode:l(d[`code-mode`],`code-mode`,`text`),description:l(d.description,`description`,`text`),hostname:l(d.hostname,`hostname`,`text`),id:l(d.id,`id`,`text`),name:l(d.name,`name`,`text`),secure_web_gateway:d[`secure-web-gateway`]});i(await o(`Creating`,async()=>f.mcp.portals.create({...m,account_id:p})),{successLabel:`Created`})}};function v(e){return e.positional(`id`,{type:`string`,description:`Unique identifier for the MCP portal.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const y={command:`delete <id>`,describe:`Deletes an MCP portal from the account.`,builder:v,handler:async s=>{if(s.dryRun){a({command:`cf mcp portals delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/ai-controls/mcp/portals/${s.id==null?`<id>`:encodeURIComponent(String(s.id))}`,pathParams:{id:String(s.id??``)},bodyKind:`none`});return}let c=await r(s),l=s.local?e:await t();if(s.accountId=l,!await f({force:!!s.force,message:`This operation permanently deletes the MCP portal.`})){process.stderr.write(`Aborted.
+import{t as e}from"./local-D-aVNu6A.mjs";import{f as t,g as n}from"./oauth-B0ETkNcX.mjs";import{r}from"./auth-MQEamPN9.mjs";import{t as i}from"./output-DrpYYfnB.mjs";import{n as a,t as o}from"./progress-CsHIt3Tp.mjs";import{n as s,t as c}from"./body-parser-C-c9gfH1.mjs";import{n as l}from"./input-validation-Bav2M9F-.mjs";import{a as u,i as d,n as f}from"./prompt-DdegNPpg.mjs";import{t as p}from"./cli-types-BsTty22w.mjs";function m(e){return e.option(`granularity`,{type:`string`,description:`Granularity`,choices:[`daily`,`monthly`]}).option(`aggregate`,{type:`string`,description:`Aggregate`,choices:[`true`,`false`]}).option(`tz`,{type:`string`,description:`Tz`}).option(`days`,{type:`number`,description:`Daily trailing-window size; defaults to 7 and is ignored for monthly`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const h={command:`account-tool-call-timeseries`,describe:`Returns daily or monthly tool-call counts across the account.`,builder:p(m),handler:async s=>{let c={granularity:s.granularity,aggregate:s.aggregate,tz:s.tz,days:s.days};if(s.dryRun){a({command:`cf mcp portals account-tool-call-timeseries`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/ai-controls/mcp/analytics/tool-calls/timeseries`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(s),u=s.local?e:await t();s.accountId=u,i(await o(`Loading`,async()=>l.mcp.portals.accountToolCallTimeseries({account_id:u,...c})),{successLabel:`Loaded`})}};function g(e){return e.option(`allow-code-mode`,{type:`boolean`,description:"Deprecated: use `code_mode` for new integrations. `true` maps to any non-off Code Mode policy; `false` maps to `code_mode: off`. If both fields are sent, they must be consistent or the request returns a 400."}).option(`code-mode`,{type:`string`,description:"Code Mode policy for this portal. `off`: Code Mode is unavailable; query parameters are ignored. `opt_in`: Code Mode is off by default; clients turn it on with `?codemode=search_and_execute`. `default_on`: Code Mode is on by default; clients can opt out with `?codemode=off`. `enforced`: Code Mode is always on; query parameters are ignored. Defaults to `opt_in` when omitted on create. If both `code_mode` and `allow_code_mode` are sent, they must be consistent or the request returns a 400.",choices:[`off`,`opt_in`,`default_on`,`enforced`]}).option(`description`,{type:`string`,description:`Optional description of the MCP portal.`}).option(`hostname`,{type:`string`,description:`Hostname where the MCP portal is available.`}).option(`id`,{type:`string`,description:`Unique identifier for the MCP portal.`}).option(`name`,{type:`string`,description:`Display name for the MCP portal.`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound MCP traffic through Zero Trust Secure Web Gateway.`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _={command:`create`,describe:`Creates a new MCP portal for managing AI tool access through Cloudflare Access.`,builder:g,handler:async d=>{if(d.dryRun){a({command:`cf mcp portals create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/ai-controls/mcp/portals`,pathParams:{},bodyKind:`json`,body:d.body===void 0?c({allow_code_mode:d[`allow-code-mode`],code_mode:l(d[`code-mode`],`code-mode`,`text`),description:l(d.description,`description`,`text`),hostname:l(d.hostname,`hostname`,`text`),id:l(d.id,`id`,`text`),name:l(d.name,`name`,`text`),secure_web_gateway:d[`secure-web-gateway`]}):s(d.body)});return}let f=await r(d),p=d.local?e:await t();if(d.accountId=p,d.body){let e=s(d.body);i(await o(`Creating`,async()=>f.mcp.portals.create({...e,account_id:p})),{successLabel:`Created`});return}d.hostname===void 0&&(d.hostname=await u(`hostname`,`Hostname where the MCP portal is available.`)),d.id===void 0&&(d.id=await u(`id`,`Unique identifier for the MCP portal.`)),d.name===void 0&&(d.name=await u(`name`,`Display name for the MCP portal.`));let m=c({allow_code_mode:d[`allow-code-mode`],code_mode:l(d[`code-mode`],`code-mode`,`text`),description:l(d.description,`description`,`text`),hostname:l(d.hostname,`hostname`,`text`),id:l(d.id,`id`,`text`),name:l(d.name,`name`,`text`),secure_web_gateway:d[`secure-web-gateway`]});i(await o(`Creating`,async()=>f.mcp.portals.create({...m,account_id:p})),{successLabel:`Created`})}};function v(e){return e.positional(`id`,{type:`string`,description:`Unique identifier for the MCP portal.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const y={command:`delete <id>`,describe:`Deletes an MCP portal from the account.`,builder:v,handler:async s=>{if(s.dryRun){a({command:`cf mcp portals delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/ai-controls/mcp/portals/${s.id==null?`<id>`:encodeURIComponent(String(s.id))}`,pathParams:{id:String(s.id??``)},bodyKind:`none`});return}let c=await r(s),l=s.local?e:await t();if(s.accountId=l,!await f({force:!!s.force,message:`This operation permanently deletes the MCP portal.`})){process.stderr.write(`Aborted.
 `);return}i(await o(`Deleting`,async()=>c.mcp.portals.delete({account_id:l,id:s.id})),{successLabel:`Deleted`})}};function b(e){return e.option(`page`,{type:`number`,description:`Page`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`search`,{type:`string`,description:`Search by id, name, hostname`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const x={command:`list`,describe:`Lists all MCP portals configured for the account.`,builder:b,handler:async s=>{let c={page:s.page,per_page:s[`per-page`],search:s.search};if(s.dryRun){a({command:`cf mcp portals list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/ai-controls/mcp/portals`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(s),u=s.local?e:await t();s.accountId=u,i(await o(`Loading`,async()=>l.mcp.portals.list({account_id:u,...c})),{successLabel:`Loaded`})}};function S(e){return e.positional(`portal-id`,{type:`string`,description:`Portal ID`,demandOption:!0}).option(`granularity`,{type:`string`,description:`Granularity`,choices:[`daily`,`monthly`]}).option(`aggregate`,{type:`string`,description:`Aggregate`,choices:[`true`,`false`]}).option(`tz`,{type:`string`,description:`Tz`}).option(`days`,{type:`number`,description:`Daily trailing-window size; defaults to 7 and is ignored for monthly`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const C={command:`portal-tool-call-timeseries <portal-id>`,describe:`Returns daily or monthly tool-call counts for a portal.`,builder:p(S),handler:async s=>{let c={granularity:s.granularity,aggregate:s.aggregate,tz:s.tz,days:s.days};if(s.dryRun){a({command:`cf mcp portals portal-tool-call-timeseries`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/ai-controls/mcp/analytics/portals/${s[`portal-id`]==null?`<portal-id>`:encodeURIComponent(String(s[`portal-id`]))}/tool-calls/timeseries`,pathParams:{"portal-id":String(s[`portal-id`]??``)},query:c,bodyKind:`none`});return}let l=await r(s),u=s.local?e:await t();s.accountId=u,i(await o(`Loading`,async()=>l.mcp.portals.portalToolCallTimeseries({account_id:u,portal_id:s[`portal-id`],...c})),{successLabel:`Loaded`})}};function w(e){return e.positional(`id`,{type:`string`,description:`Unique identifier for the MCP portal.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const T={command:`read <id>`,describe:`Read the details of a single MCP Portal, including its configured servers.`,builder:w,handler:async s=>{if(s.dryRun){a({command:`cf mcp portals read`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/ai-controls/mcp/portals/${s.id==null?`<id>`:encodeURIComponent(String(s.id))}`,pathParams:{id:String(s.id??``)},bodyKind:`none`});return}let c=await r(s),l=s.local?e:await t();s.accountId=l,i(await o(`Loading`,async()=>c.mcp.portals.read({account_id:l,id:s.id})),{successLabel:`Loaded`})}};function E(e){return e.positional(`id`,{type:`string`,description:`Unique identifier for the MCP portal.`,demandOption:!0}).option(`allow-code-mode`,{type:`boolean`,description:"Deprecated: use `code_mode` for new integrations. `true` maps to any non-off Code Mode policy; `false` maps to `code_mode: off`. If both fields are sent, they must be consistent or the request returns a 400."}).option(`code-mode`,{type:`string`,description:"Code Mode policy for this portal. `off`: Code Mode is unavailable; query parameters are ignored. `opt_in`: Code Mode is off by default; clients turn it on with `?codemode=search_and_execute`. `default_on`: Code Mode is on by default; clients can opt out with `?codemode=off`. `enforced`: Code Mode is always on; query parameters are ignored. Defaults to `opt_in` when omitted on create. If both `code_mode` and `allow_code_mode` are sent, they must be consistent or the request returns a 400.",choices:[`off`,`opt_in`,`default_on`,`enforced`]}).option(`description`,{type:`string`,description:`Optional description of the MCP portal.`}).option(`hostname`,{type:`string`,description:`Hostname where the MCP portal is available.`}).option(`name`,{type:`string`,description:`Display name for the MCP portal.`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound MCP traffic through Zero Trust Secure Web Gateway.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const D={command:`update <id>`,describe:`Updates an MCP portal configuration.`,builder:E,handler:async u=>{if(u.dryRun){a({command:`cf mcp portals update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/ai-controls/mcp/portals/${u.id==null?`<id>`:encodeURIComponent(String(u.id))}`,pathParams:{id:String(u.id??``)},bodyKind:`json`,body:u.body===void 0?c({allow_code_mode:u[`allow-code-mode`],code_mode:l(u[`code-mode`],`code-mode`,`text`),description:l(u.description,`description`,`text`),hostname:l(u.hostname,`hostname`,`text`),name:l(u.name,`name`,`text`),secure_web_gateway:u[`secure-web-gateway`]}):s(u.body)});return}let d=await r(u),f=u.local?e:await t();if(u.accountId=f,u.body){let e=s(u.body);i(await o(`Updating`,async()=>d.mcp.portals.update({...e,account_id:f,id:u.id})),{successLabel:`Updated`});return}let p=c({allow_code_mode:u[`allow-code-mode`],code_mode:l(u[`code-mode`],`code-mode`,`text`),description:l(u.description,`description`,`text`),hostname:l(u.hostname,`hostname`,`text`),name:l(u.name,`name`,`text`),secure_web_gateway:u[`secure-web-gateway`]});i(await o(`Updating`,async()=>d.mcp.portals.update({...p,account_id:f,id:u.id})),{successLabel:`Updated`})}},O={command:`portals`,describe:`Manage MCP portals, attached servers, and Code Mode settings`,builder:e=>e.command(h).command(_).command(y).command(x).command(C).command(T).command(D).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function k(e){return e.option(`auth-credentials`,{type:`string`,description:'Static credential for the upstream MCP server. For auth_type "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as `Authorization: Bearer <token>`, or a JSON-encoded object of the form `{"headers":{"Header-Name":"value",...}}` for custom or multiple static headers (e.g. Cloudflare Access service tokens: `{"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}`).'}).option(`auth-type`,{type:`string`,description:`Authentication method used to connect to the upstream MCP server.`,choices:[`oauth`,`bearer`,`unauthenticated`]}).option(`client-secret`,{type:`string`,description:`Pre-registered OAuth client_secret. Write-only - accepted on create/update when auth_credentials.auth_mode is 'manual'. Stored AES-GCM-encrypted in server_oauth_secrets; never returned by read endpoints.`}).option(`description`,{type:`string`,description:`Optional description of the MCP server.`}).option(`hostname`,{type:`string`,description:`URL of the upstream MCP endpoint.`}).option(`id`,{type:`string`,description:`Unique identifier for the MCP server.`}).option(`is-shared-oauth-callback-enabled`,{type:`boolean`,description:`When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.`,default:!1}).option(`name`,{type:`string`,description:`Display name for the MCP server.`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const A={command:`create`,describe:`Creates a new MCP server for connecting to an upstream MCP endpoint.`,builder:k,handler:async f=>{if(f.dryRun){a({command:`cf mcp servers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/ai-controls/mcp/servers`,pathParams:{},bodyKind:`json`,body:f.body===void 0?c({auth_credentials:l(f[`auth-credentials`],`auth-credentials`,`text`),auth_type:l(f[`auth-type`],`auth-type`,`text`),client_secret:l(f[`client-secret`],`client-secret`,`text`),description:l(f.description,`description`,`text`),hostname:l(f.hostname,`hostname`,`text`),id:l(f.id,`id`,`text`),is_shared_oauth_callback_enabled:f[`is-shared-oauth-callback-enabled`],name:l(f.name,`name`,`text`),secure_web_gateway:f[`secure-web-gateway`]}):s(f.body)});return}let p=await r(f),m=f.local?e:await t();if(f.accountId=m,f.body){let e=s(f.body);i(await o(`Creating`,async()=>p.mcp.servers.create({...e,account_id:m})),{successLabel:`Created`});return}f[`auth-type`]===void 0&&(f[`auth-type`]=await d(`auth-type`,`Authentication method used to connect to the upstream MCP server.`,[`oauth`,`bearer`,`unauthenticated`])),f.hostname===void 0&&(f.hostname=await u(`hostname`,`URL of the upstream MCP endpoint.`)),f.id===void 0&&(f.id=await u(`id`,`Unique identifier for the MCP server.`)),f.name===void 0&&(f.name=await u(`name`,`Display name for the MCP server.`));let h=c({auth_credentials:l(f[`auth-credentials`],`auth-credentials`,`text`),auth_type:l(f[`auth-type`],`auth-type`,`text`),client_secret:l(f[`client-secret`],`client-secret`,`text`),description:l(f.description,`description`,`text`),hostname:l(f.hostname,`hostname`,`text`),id:l(f.id,`id`,`text`),is_shared_oauth_callback_enabled:f[`is-shared-oauth-callback-enabled`],name:l(f.name,`name`,`text`),secure_web_gateway:f[`secure-web-gateway`]});i(await o(`Creating`,async()=>p.mcp.servers.create({...h,account_id:m})),{successLabel:`Created`})}};function j(e){return e.positional(`id`,{type:`string`,description:`Unique identifier for the MCP server.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const M={command:`delete <id>`,describe:`Deletes an MCP server from the account.`,builder:j,handler:async s=>{if(s.dryRun){a({command:`cf mcp servers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/ai-controls/mcp/servers/${s.id==null?`<id>`:encodeURIComponent(String(s.id))}`,pathParams:{id:String(s.id??``)},bodyKind:`none`});return}let c=await r(s),l=s.local?e:await t();if(s.accountId=l,!await f({force:!!s.force,message:`This operation permanently deletes the MCP server, removes it from every portal, and deletes its stored OAuth secrets.`})){process.stderr.write(`Aborted.
 `);return}i(await o(`Deleting`,async()=>c.mcp.servers.delete({account_id:l,id:s.id})),{successLabel:`Deleted`})}};function N(e){return e.option(`page`,{type:`number`,description:`Page`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`search`,{type:`string`,description:`Search by id, name`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const P={command:`list`,describe:`Lists all MCP servers configured for the account.`,builder:N,handler:async s=>{let c={page:s.page,per_page:s[`per-page`],search:s.search};if(s.dryRun){a({command:`cf mcp servers list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/ai-controls/mcp/servers`,pathParams:{},query:c,bodyKind:`none`});return}let l=await r(s),u=s.local?e:await t();s.accountId=u,i(await o(`Loading`,async()=>l.mcp.servers.list({account_id:u,...c})),{successLabel:`Loaded`})}};function F(e){return e.positional(`id`,{type:`string`,description:`Unique identifier for the MCP server.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const I={command:`read <id>`,describe:`Retrieves an MCP server's configuration and capability sync state.`,builder:F,handler:async s=>{if(s.dryRun){a({command:`cf mcp servers read`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/ai-controls/mcp/servers/${s.id==null?`<id>`:encodeURIComponent(String(s.id))}`,pathParams:{id:String(s.id??``)},bodyKind:`none`});return}let c=await r(s),l=s.local?e:await t();s.accountId=l,i(await o(`Loading`,async()=>c.mcp.servers.read({account_id:l,id:s.id})),{successLabel:`Loaded`})}};function L(e){return e.positional(`server-id`,{type:`string`,description:`Server ID`,demandOption:!0}).option(`granularity`,{type:`string`,description:`Granularity`,choices:[`daily`,`monthly`]}).option(`aggregate`,{type:`string`,description:`Aggregate`,choices:[`true`,`false`]}).option(`tz`,{type:`string`,description:`Tz`}).option(`days`,{type:`number`,description:`Daily trailing-window size; defaults to 7 and is ignored for monthly`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const R={command:`server-tool-call-timeseries <server-id>`,describe:`Returns daily or monthly tool-call counts for a server.`,builder:p(L),handler:async s=>{let c={granularity:s.granularity,aggregate:s.aggregate,tz:s.tz,days:s.days};if(s.dryRun){a({command:`cf mcp servers server-tool-call-timeseries`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/ai-controls/mcp/analytics/servers/${s[`server-id`]==null?`<server-id>`:encodeURIComponent(String(s[`server-id`]))}/tool-calls/timeseries`,pathParams:{"server-id":String(s[`server-id`]??``)},query:c,bodyKind:`none`});return}let l=await r(s),u=s.local?e:await t();s.accountId=u,i(await o(`Loading`,async()=>l.mcp.servers.serverToolCallTimeseries({account_id:u,server_id:s[`server-id`],...c})),{successLabel:`Loaded`})}};function z(e){return e.positional(`id`,{type:`string`,description:`Unique identifier for the MCP server.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const B={command:`sync <id>`,describe:`Syncs an MCP server's capabilities and returns the updated server state, including any connection errors.`,builder:z,handler:async s=>{if(s.dryRun){a({command:`cf mcp servers sync`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/ai-controls/mcp/servers/${s.id==null?`<id>`:encodeURIComponent(String(s.id))}/sync`,pathParams:{id:String(s.id??``)},bodyKind:`none`});return}let c=await r(s),l=s.local?e:await t();s.accountId=l,i(await o(`Creating`,async()=>c.mcp.servers.sync({account_id:l,id:s.id})),{successLabel:`Created`})}};function V(e){return e.positional(`id`,{type:`string`,description:`Unique identifier for the MCP server.`,demandOption:!0}).option(`auth-credentials`,{type:`string`,description:'Static credential for the upstream MCP server. For auth_type "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as `Authorization: Bearer <token>`, or a JSON-encoded object of the form `{"headers":{"Header-Name":"value",...}}` for custom or multiple static headers (e.g. Cloudflare Access service tokens: `{"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}`).'}).option(`client-secret`,{type:`string`,description:`Pre-registered OAuth client_secret. Write-only - accepted on create/update when auth_credentials.auth_mode is 'manual'. Stored AES-GCM-encrypted in server_oauth_secrets; never returned by read endpoints.`}).option(`description`,{type:`string`,description:`Optional description of the MCP server.`}).option(`is-shared-oauth-callback-enabled`,{type:`boolean`,description:`When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.`}).option(`name`,{type:`string`,description:`Display name for the MCP server.`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const H={command:`update <id>`,describe:`Updates an MCP server's configuration and credentials.`,builder:V,handler:async u=>{if(u.dryRun){a({command:`cf mcp servers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/access/ai-controls/mcp/servers/${u.id==null?`<id>`:encodeURIComponent(String(u.id))}`,pathParams:{id:String(u.id??``)},bodyKind:`json`,body:u.body===void 0?c({auth_credentials:l(u[`auth-credentials`],`auth-credentials`,`text`),client_secret:l(u[`client-secret`],`client-secret`,`text`),description:l(u.description,`description`,`text`),is_shared_oauth_callback_enabled:u[`is-shared-oauth-callback-enabled`],name:l(u.name,`name`,`text`),secure_web_gateway:u[`secure-web-gateway`]}):s(u.body)});return}let d=await r(u),f=u.local?e:await t();if(u.accountId=f,u.body){let e=s(u.body);i(await o(`Updating`,async()=>d.mcp.servers.update({...e,account_id:f,id:u.id})),{successLabel:`Updated`});return}let p=c({auth_credentials:l(u[`auth-credentials`],`auth-credentials`,`text`),client_secret:l(u[`client-secret`],`client-secret`,`text`),description:l(u.description,`description`,`text`),is_shared_oauth_callback_enabled:u[`is-shared-oauth-callback-enabled`],name:l(u.name,`name`,`text`),secure_web_gateway:u[`secure-web-gateway`]});i(await o(`Updating`,async()=>d.mcp.servers.update({...p,account_id:f,id:u.id})),{successLabel:`Updated`})}},U={command:`servers`,describe:`Manage upstream MCP servers, credentials, capabilities, and sync state`,builder:e=>e.command(A).command(M).command(P).command(I).command(R).command(B).command(H).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},W={command:`mcp`,describe:`mcp`,builder:e=>e.command(O).command(U).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{W as default};