cf 0.9.1 → 0.11.0

package/dist/magic-transit-BK_3asH2.mjs

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+import{t as e}from"./local-Be3lg_9E.mjs";import{f as t,g as n}from"./oauth-DuEONNgC.mjs";import{a as r,r as i}from"./auth-D3X9HYhD.mjs";import{t as a}from"./output-Ccqw2WOb.mjs";import{t as o}from"./dry-run-DL2V6yFm.mjs";import{t as s}from"./progress-BqQcF5QH.mjs";import{i as c,n as l,r as u,t as d}from"./body-parser-BshbixEq.mjs";import{n as f}from"./input-validation-QDIYu7Vb.mjs";import{a as p,i as m,n as h}from"./prompt-B0sWIs9c.mjs";import{n as g,t as _}from"./raw-fetch-Cc-MjHeL.mjs";function ee(e){return e.option(`block-any-queries`,{type:`boolean`,description:`Whether to block DNS ANY queries. Optional. Defaults to true.`}).option(`burst-sensitivity`,{type:`string`,description:`The burst sensitivity. Must be one of 'low', 'medium', 'high'.`}).option(`name`,{type:`string`,description:`The name of the DNS Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'.`}).option(`profile-sensitivity`,{type:`string`,description:`The profile sensitivity. Recommended setting is 'low'. Must be one of 'low', 'medium', 'high', or 'very_high'.`}).option(`rate-sensitivity`,{type:`string`,description:`The rate sensitivity. Must be one of 'low', 'medium', 'high'.`}).option(`scope`,{type:`string`,description:`The scope for the DNS Protection rule. Must be one of 'global', 'region', or 'datacenter'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The new DNS Protection rule to add.`})}const te={command:`create`,describe:`Create a DNS Protection rule for an account.`,builder:ee,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-dns-protection configs dns protection rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({block_any_queries:r[`block-any-queries`],burst_sensitivity:f(r[`burst-sensitivity`],`burst-sensitivity`,`text`),name:f(r.name,`name`,`text`),profile_sensitivity:f(r[`profile-sensitivity`],`profile-sensitivity`,`text`),rate_sensitivity:f(r[`rate-sensitivity`],`rate-sensitivity`,`text`),scope:f(r.scope,`scope`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.advancedDnsProtection.configs.dns.protection.rules.create({...e,account_id:u})),{successLabel:`Created`});return}r[`burst-sensitivity`]===void 0&&(r[`burst-sensitivity`]=await p(`burst-sensitivity`,`The burst sensitivity. Must be one of 'low', 'medium', 'high'.`)),r.name===void 0&&(r.name=await p(`name`,`The name of the DNS Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'.`)),r[`profile-sensitivity`]===void 0&&(r[`profile-sensitivity`]=await p(`profile-sensitivity`,`The profile sensitivity. Recommended setting is 'low'. Must be one of 'low', 'medium', 'high', or 'very_high'.`)),r[`rate-sensitivity`]===void 0&&(r[`rate-sensitivity`]=await p(`rate-sensitivity`,`The rate sensitivity. Must be one of 'low', 'medium', 'high'.`)),r.scope===void 0&&(r.scope=await p(`scope`,`The scope for the DNS Protection rule. Must be one of 'global', 'region', or 'datacenter'.`));let m=d({block_any_queries:r[`block-any-queries`],burst_sensitivity:f(r[`burst-sensitivity`],`burst-sensitivity`,`text`),name:f(r.name,`name`,`text`),profile_sensitivity:f(r[`profile-sensitivity`],`profile-sensitivity`,`text`),rate_sensitivity:f(r[`rate-sensitivity`],`rate-sensitivity`,`text`),scope:f(r.scope,`scope`,`text`)});a(await s(`Creating`,async()=>c.magicTransit.advancedDnsProtection.configs.dns.protection.rules.create({...m,account_id:u})),{successLabel:`Created`})}};function v(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const y={command:`account`,describe:`Delete all DNS Protection rules for an account.`,builder:v,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-dns-protection configs dns protection rules delete for account`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.advancedDnsProtection.configs.dns.protection.rules.delete.for.account({account_id:l})),{successLabel:`Deleted`})}},b={command:`for`,describe:`Operations for advanced-dns-protection.configs.dns.protection.rules.delete.for`,builder:e=>e.command(y).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function x(e){return e.positional(`rule-id`,{type:`string`,description:`The UUID of the DNS Protection rule to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const S={command:`rule <rule-id>`,describe:`Delete a DNS Protection rule specified by the given UUID.`,builder:x,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-dns-protection configs dns protection rules delete protection rule`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.advancedDnsProtection.configs.dns.protection.rules.delete.protection.rule({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Deleted`})}},C={command:`protection`,describe:`Operations for advanced-dns-protection.configs.dns.protection.rules.delete.protection`,builder:e=>e.command(S).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},w={command:`delete`,describe:`Operations for advanced-dns-protection.configs.dns.protection.rules.delete`,builder:e=>e.command(b).command(C).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function T(e){return e.positional(`rule-id`,{type:`string`,description:`The UUID of the DNS Protection rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const E={command:`get <rule-id>`,describe:`Get a DNS Protection rule specified by the given UUID.`,builder:T,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-dns-protection configs dns protection rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.advancedDnsProtection.configs.dns.protection.rules.get({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Loaded`})}};function D(e){return e.option(`page`,{type:`number`,description:`The page number for pagination. Defaults to 1.`}).option(`per-page`,{type:`number`,description:`The number of items per page. Must be between 10 and 1000. Defaults to 25.`}).option(`order`,{type:`string`,description:`The field to order by. Defaults to 'prefix'.`}).option(`direction`,{type:`string`,description:`The direction of ordering (ASC or DESC). Defaults to 'ASC'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const O={command:`list`,describe:`List all DNS Protection rules for an account.`,builder:D,handler:async r=>{let c={page:r.page,per_page:r[`per-page`],order:r.order,direction:r.direction};if(r.dryRun){o({command:`cf magic-transit advanced-dns-protection configs dns protection rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules`,pathParams:{},query:c,bodyKind:`none`});return}let l=await i(r),u=r.local?e:await t();r.accountId=u,a(await s(`Loading`,async()=>l.magicTransit.advancedDnsProtection.configs.dns.protection.rules.list({account_id:u,...c})),{successLabel:`Loaded`})}};function k(e){return e.positional(`rule-id`,{type:`string`,description:`The UUID of the DNS Protection rule to update.`,demandOption:!0}).option(`block-any-queries`,{type:`boolean`,description:`The new value for whether to block DNS ANY queries. Optional.`}).option(`burst-sensitivity`,{type:`string`,description:`The new burst sensitivity. Optional. Must be one of 'low', 'medium', 'high'.`}).option(`profile-sensitivity`,{type:`string`,description:`The new profile sensitivity. Optional. Recommended setting is 'low'. Must be one of 'low', 'medium', 'high', or 'very_high'.`}).option(`rate-sensitivity`,{type:`string`,description:`The new rate sensitivity. Optional. Must be one of 'low', 'medium', 'high'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updates to apply to the DNS Protection rule.`})}const A={command:`update <rule-id>`,describe:`Update a DNS Protection rule specified by the given UUID.`,builder:k,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-dns-protection configs dns protection rules update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({block_any_queries:r[`block-any-queries`],burst_sensitivity:f(r[`burst-sensitivity`],`burst-sensitivity`,`text`),profile_sensitivity:f(r[`profile-sensitivity`],`profile-sensitivity`,`text`),rate_sensitivity:f(r[`rate-sensitivity`],`rate-sensitivity`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.advancedDnsProtection.configs.dns.protection.rules.update({...e,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}let p=d({block_any_queries:r[`block-any-queries`],burst_sensitivity:f(r[`burst-sensitivity`],`burst-sensitivity`,`text`),profile_sensitivity:f(r[`profile-sensitivity`],`profile-sensitivity`,`text`),rate_sensitivity:f(r[`rate-sensitivity`],`rate-sensitivity`,`text`)});a(await s(`Updating`,async()=>c.magicTransit.advancedDnsProtection.configs.dns.protection.rules.update({...p,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},j={command:`rules`,describe:`Operations for advanced-dns-protection.configs.dns.protection.rules`,builder:e=>e.command(te).command(E).command(O).command(A).command(w).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},M={command:`protection`,describe:`Operations for advanced-dns-protection.configs.dns.protection`,builder:e=>e.command(j).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},N={command:`dns`,describe:`Operations for advanced-dns-protection.configs.dns`,builder:e=>e.command(M).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},P={command:`configs`,describe:`Operations for advanced-dns-protection.configs`,builder:e=>e.command(N).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},F={command:`advanced-dns-protection`,describe:`Advanced Dns Protection operations`,builder:e=>e.command(P).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function I(e){return e.option(`comment`,{type:`string`,description:`An comment describing the allowlist prefix.`}).option(`enabled`,{type:`boolean`,description:`Whether to enable the allowlist prefix into effect.`}).option(`prefix`,{type:`string`,description:`The allowlist prefix to add in CIDR format.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The new allowlist prefix to create.`})}const L={command:`create`,describe:`Create an allowlist prefix for an account.`,builder:I,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs allowlist create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/allowlist`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({comment:f(r.comment,`comment`,`text`),enabled:r.enabled,prefix:f(r.prefix,`prefix`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.advancedTcpProtection.configs.allowlist.create({...e,account_id:u})),{successLabel:`Created`});return}if(r.comment===void 0&&(r.comment=await p(`comment`,`An comment describing the allowlist prefix.`)),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.prefix===void 0&&(r.prefix=await p(`prefix`,`The allowlist prefix to add in CIDR format.`));let m=d({comment:f(r.comment,`comment`,`text`),enabled:r.enabled,prefix:f(r.prefix,`prefix`,`text`)});a(await s(`Creating`,async()=>c.magicTransit.advancedTcpProtection.configs.allowlist.create({...m,account_id:u})),{successLabel:`Created`})}};function R(e){return e.positional(`prefix-id`,{type:`string`,description:`The UUID of the allowlist prefix to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const z={command:`prefix <prefix-id>`,describe:`Delete the allowlist prefix for an account given a UUID.`,builder:R,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs allowlist delete allowlist prefix`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/allowlist/${r[`prefix-id`]==null?`<prefix-id>`:encodeURIComponent(String(r[`prefix-id`]))}`,pathParams:{"prefix-id":String(r[`prefix-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.advancedTcpProtection.configs.allowlist.delete.allowlist.prefix({account_id:l,prefix_id:r[`prefix-id`]})),{successLabel:`Deleted`})}},B={command:`allowlist`,describe:`Operations for advanced-tcp-protection.configs.allowlist.delete.allowlist`,builder:e=>e.command(z).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function V(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const H={command:`account`,describe:`Delete all allowlist prefixes for an account.`,builder:V,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs allowlist delete for account`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/allowlist`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.advancedTcpProtection.configs.allowlist.delete.for.account({account_id:l})),{successLabel:`Deleted`})}},U={command:`for`,describe:`Operations for advanced-tcp-protection.configs.allowlist.delete.for`,builder:e=>e.command(H).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},W={command:`delete`,describe:`Operations for advanced-tcp-protection.configs.allowlist.delete`,builder:e=>e.command(B).command(U).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function G(e){return e.positional(`prefix-id`,{type:`string`,description:`The UUID of the allowlist prefix.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const K={command:`get <prefix-id>`,describe:`Get an allowlist prefix specified by the given UUID.`,builder:G,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs allowlist get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/allowlist/${r[`prefix-id`]==null?`<prefix-id>`:encodeURIComponent(String(r[`prefix-id`]))}`,pathParams:{"prefix-id":String(r[`prefix-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.advancedTcpProtection.configs.allowlist.get({account_id:l,prefix_id:r[`prefix-id`]})),{successLabel:`Loaded`})}};function q(e){return e.option(`page`,{type:`number`,description:`The page number for pagination. Defaults to 1.`}).option(`per-page`,{type:`number`,description:`The number of items per page. Must be between 10 and 1000. Defaults to 25.`}).option(`order`,{type:`string`,description:`The field to order by. Defaults to 'prefix'.`}).option(`direction`,{type:`string`,description:`The direction of ordering (ASC or DESC). Defaults to 'ASC'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const J={command:`list`,describe:`List all allowlist prefixes for an account.`,builder:q,handler:async r=>{let c={page:r.page,per_page:r[`per-page`],order:r.order,direction:r.direction};if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs allowlist list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/allowlist`,pathParams:{},query:c,bodyKind:`none`});return}let l=await i(r),u=r.local?e:await t();r.accountId=u,a(await s(`Loading`,async()=>l.magicTransit.advancedTcpProtection.configs.allowlist.list({account_id:u,...c})),{successLabel:`Loaded`})}};function Y(e){return e.positional(`prefix-id`,{type:`string`,description:`The UUID of the allowlist prefix to update.`,demandOption:!0}).option(`comment`,{type:`string`,description:`A comment describing the allowlist prefix. Optional.`}).option(`enabled`,{type:`boolean`,description:`Whether to enable the allowlist prefix into effect. Optional.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updates to apply to the allowlist prefix.`})}const X={command:`update <prefix-id>`,describe:`Update an allowlist prefix specified by the given UUID.`,builder:Y,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs allowlist update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/allowlist/${r[`prefix-id`]==null?`<prefix-id>`:encodeURIComponent(String(r[`prefix-id`]))}`,pathParams:{"prefix-id":String(r[`prefix-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({comment:f(r.comment,`comment`,`text`),enabled:r.enabled}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.advancedTcpProtection.configs.allowlist.update({...e,account_id:u,prefix_id:r[`prefix-id`]})),{successLabel:`Updated`});return}let p=d({comment:f(r.comment,`comment`,`text`),enabled:r.enabled});a(await s(`Updating`,async()=>c.magicTransit.advancedTcpProtection.configs.allowlist.update({...p,account_id:u,prefix_id:r[`prefix-id`]})),{successLabel:`Updated`})}},Z={command:`allowlist`,describe:`Operations for advanced-tcp-protection.configs.allowlist`,builder:e=>e.command(L).command(K).command(J).command(X).command(W).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Q(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The list of new prefixes to create.`})}const ne={command:`create`,describe:`Create multiple prefixes for an account.`,builder:Q,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs prefixes bulk create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/prefixes/bulk`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.advancedTcpProtection.configs.prefixes.bulk.create({body:e,account_id:u})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},re={command:`bulk`,describe:`Operations for advanced-tcp-protection.configs.prefixes.bulk`,builder:e=>e.command(ne).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ie(e){return e.option(`comment`,{type:`string`,description:`A comment describing the prefix.`}).option(`excluded`,{type:`boolean`,description:`Whether to exclude the prefix from protection.`}).option(`prefix`,{type:`string`,description:`The prefix to add in CIDR format.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The new prefix to create.`})}const ae={command:`create`,describe:`Create a prefix for an account.`,builder:ie,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs prefixes create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/prefixes`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({comment:f(r.comment,`comment`,`text`),excluded:r.excluded,prefix:f(r.prefix,`prefix`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.advancedTcpProtection.configs.prefixes.create({body:e,account_id:u})),{successLabel:`Created`});return}if(r.comment===void 0&&(r.comment=await p(`comment`,`A comment describing the prefix.`)),r.excluded===void 0)throw Error(`--excluded is required (or pass --body with this field set).`);r.prefix===void 0&&(r.prefix=await p(`prefix`,`The prefix to add in CIDR format.`));let m=d({comment:f(r.comment,`comment`,`text`),excluded:r.excluded,prefix:f(r.prefix,`prefix`,`text`)});a(await s(`Creating`,async()=>c.magicTransit.advancedTcpProtection.configs.prefixes.create({body:m,account_id:u})),{successLabel:`Created`})}};function oe(e){return e.positional(`prefix-id`,{type:`string`,description:`The UUID of the prefix to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const se={command:`delete <prefix-id>`,describe:`Delete the prefix for an account given a UUID.`,builder:oe,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs prefixes delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/prefixes/${r[`prefix-id`]==null?`<prefix-id>`:encodeURIComponent(String(r[`prefix-id`]))}`,pathParams:{"prefix-id":String(r[`prefix-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.advancedTcpProtection.configs.prefixes.delete({account_id:l,prefix_id:r[`prefix-id`]})),{successLabel:`Deleted`})}};function ce(e){return e.positional(`prefix-id`,{type:`string`,description:`The UUID of the prefix.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const le={command:`get <prefix-id>`,describe:`Get a prefix specified by the given UUID.`,builder:ce,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs prefixes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/prefixes/${r[`prefix-id`]==null?`<prefix-id>`:encodeURIComponent(String(r[`prefix-id`]))}`,pathParams:{"prefix-id":String(r[`prefix-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.advancedTcpProtection.configs.prefixes.get({account_id:l,prefix_id:r[`prefix-id`]})),{successLabel:`Loaded`})}};function ue(e){return e.option(`page`,{type:`number`,description:`The page number for pagination. Defaults to 1.`}).option(`per-page`,{type:`number`,description:`The number of items per page. Must be between 10 and 1000. Defaults to 25.`}).option(`order`,{type:`string`,description:`The field to order by. Defaults to 'prefix'.`}).option(`direction`,{type:`string`,description:`The direction of ordering (ASC or DESC). Defaults to 'ASC'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const de={command:`list`,describe:`List all prefixes for an account.`,builder:ue,handler:async r=>{let c={page:r.page,per_page:r[`per-page`],order:r.order,direction:r.direction};if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs prefixes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/prefixes`,pathParams:{},query:c,bodyKind:`none`});return}let l=await i(r),u=r.local?e:await t();r.accountId=u,a(await s(`Loading`,async()=>l.magicTransit.advancedTcpProtection.configs.prefixes.list({account_id:u,...c})),{successLabel:`Loaded`})}};function fe(e){return e.positional(`prefix-id`,{type:`string`,description:`The UUID of the prefix to update.`,demandOption:!0}).option(`comment`,{type:`string`,description:`A new comment for the prefix. Optional.`}).option(`excluded`,{type:`boolean`,description:`Whether to exclude the prefix from protection. Optional.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updates to apply to the prefix.`})}const pe={command:`update <prefix-id>`,describe:`Update a prefix specified by the given UUID.`,builder:fe,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs prefixes update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/prefixes/${r[`prefix-id`]==null?`<prefix-id>`:encodeURIComponent(String(r[`prefix-id`]))}`,pathParams:{"prefix-id":String(r[`prefix-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({comment:f(r.comment,`comment`,`text`),excluded:r.excluded}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.advancedTcpProtection.configs.prefixes.update({...e,account_id:u,prefix_id:r[`prefix-id`]})),{successLabel:`Updated`});return}let p=d({comment:f(r.comment,`comment`,`text`),excluded:r.excluded});a(await s(`Updating`,async()=>c.magicTransit.advancedTcpProtection.configs.prefixes.update({...p,account_id:u,prefix_id:r[`prefix-id`]})),{successLabel:`Updated`})}},me={command:`prefixes`,describe:`Operations for advanced-tcp-protection.configs.prefixes`,builder:e=>e.command(ae).command(se).command(le).command(de).command(pe).command(re).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function he(e){return e.option(`expression`,{type:`string`,description:`The filter expression.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The new filter to create.`})}const ge={command:`create`,describe:`Create a SYN Protection filter for an account.`,builder:he,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs syn protection filters create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/filters`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({expression:f(r.expression,`expression`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.advancedTcpProtection.configs.syn.protection.filters.create({body:e,account_id:u})),{successLabel:`Created`});return}r.expression===void 0&&(r.expression=await p(`expression`,`The filter expression.`));let m=d({expression:f(r.expression,`expression`,`text`)});a(await s(`Creating`,async()=>c.magicTransit.advancedTcpProtection.configs.syn.protection.filters.create({body:m,account_id:u})),{successLabel:`Created`})}};function _e(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ve={command:`account`,describe:`Delete all SYN Protection filters for an account.`,builder:_e,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs syn protection filters delete for account`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/filters`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.advancedTcpProtection.configs.syn.protection.filters.delete.for.account({account_id:l})),{successLabel:`Deleted`})}},ye={command:`for`,describe:`Operations for advanced-tcp-protection.configs.syn.protection.filters.delete.for`,builder:e=>e.command(ve).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function be(e){return e.positional(`filter-id`,{type:`string`,description:`The UUID of the filter to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const xe={command:`filter <filter-id>`,describe:`Delete a SYN Protection filter specified by the given UUID.`,builder:be,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs syn protection filters delete protection filter`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/filters/${r[`filter-id`]==null?`<filter-id>`:encodeURIComponent(String(r[`filter-id`]))}`,pathParams:{"filter-id":String(r[`filter-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.advancedTcpProtection.configs.syn.protection.filters.delete.protection.filter({account_id:l,filter_id:r[`filter-id`]})),{successLabel:`Deleted`})}},Se={command:`protection`,describe:`Operations for advanced-tcp-protection.configs.syn.protection.filters.delete.protection`,builder:e=>e.command(xe).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ce={command:`delete`,describe:`Operations for advanced-tcp-protection.configs.syn.protection.filters.delete`,builder:e=>e.command(ye).command(Se).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function we(e){return e.positional(`filter-id`,{type:`string`,description:`The UUID of the filter to retrieve.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Te={command:`get <filter-id>`,describe:`Get a SYN Protection filter specified by the given UUID.`,builder:we,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs syn protection filters get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/filters/${r[`filter-id`]==null?`<filter-id>`:encodeURIComponent(String(r[`filter-id`]))}`,pathParams:{"filter-id":String(r[`filter-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.advancedTcpProtection.configs.syn.protection.filters.get({account_id:l,filter_id:r[`filter-id`]})),{successLabel:`Loaded`})}};function Ee(e){return e.option(`page`,{type:`number`,description:`The page number for pagination. Defaults to 1.`}).option(`per-page`,{type:`number`,description:`The number of items per page. Must be between 10 and 1000. Defaults to 25.`}).option(`order`,{type:`string`,description:`The field to order by. Defaults to 'prefix'.`}).option(`direction`,{type:`string`,description:`The direction of ordering (ASC or DESC). Defaults to 'ASC'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const De={command:`list`,describe:`List all SYN Protection filters for an account.`,builder:Ee,handler:async r=>{let c={page:r.page,per_page:r[`per-page`],order:r.order,direction:r.direction};if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs syn protection filters list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/filters`,pathParams:{},query:c,bodyKind:`none`});return}let l=await i(r),u=r.local?e:await t();r.accountId=u,a(await s(`Loading`,async()=>l.magicTransit.advancedTcpProtection.configs.syn.protection.filters.list({account_id:u,...c})),{successLabel:`Loaded`})}};function Oe(e){return e.positional(`filter-id`,{type:`string`,description:`The UUID of the filter to update.`,demandOption:!0}).option(`expression`,{type:`string`,description:`The new filter expression. Optional.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updates to apply to the filter.`})}const ke={command:`update <filter-id>`,describe:`Update a SYN Protection filter specified by the given UUID.`,builder:Oe,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs syn protection filters update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/filters/${r[`filter-id`]==null?`<filter-id>`:encodeURIComponent(String(r[`filter-id`]))}`,pathParams:{"filter-id":String(r[`filter-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({expression:f(r.expression,`expression`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.advancedTcpProtection.configs.syn.protection.filters.update({body:e,account_id:u,filter_id:r[`filter-id`]})),{successLabel:`Updated`});return}let p=d({expression:f(r.expression,`expression`,`text`)});a(await s(`Updating`,async()=>c.magicTransit.advancedTcpProtection.configs.syn.protection.filters.update({body:p,account_id:u,filter_id:r[`filter-id`]})),{successLabel:`Updated`})}},Ae={command:`filters`,describe:`Operations for advanced-tcp-protection.configs.syn.protection.filters`,builder:e=>e.command(ge).command(Te).command(De).command(ke).command(Ce).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function je(e){return e.option(`burst-sensitivity`,{type:`string`,description:`The burst sensitivity. Must be one of 'low', 'medium', 'high'.`}).option(`mitigation-type`,{type:`string`,description:`The type of mitigation. Must be one of 'challenge' or 'retransmit'. Optional. Defaults to 'challenge'.`}).option(`name`,{type:`string`,description:`The name of the SYN Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'.`}).option(`rate-sensitivity`,{type:`string`,description:`The rate sensitivity. Must be one of 'low', 'medium', 'high'.`}).option(`scope`,{type:`string`,description:`The scope for the SYN Protection rule. Must be one of 'global', 'region', or 'datacenter'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The new SYN Protection rule to add.`})}const Me={command:`create`,describe:`Create a SYN Protection rule for an account.`,builder:je,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs syn protection rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({burst_sensitivity:f(r[`burst-sensitivity`],`burst-sensitivity`,`text`),mitigation_type:f(r[`mitigation-type`],`mitigation-type`,`text`),name:f(r.name,`name`,`text`),rate_sensitivity:f(r[`rate-sensitivity`],`rate-sensitivity`,`text`),scope:f(r.scope,`scope`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.advancedTcpProtection.configs.syn.protection.rules.create({...e,account_id:u})),{successLabel:`Created`});return}r[`burst-sensitivity`]===void 0&&(r[`burst-sensitivity`]=await p(`burst-sensitivity`,`The burst sensitivity. Must be one of 'low', 'medium', 'high'.`)),r.name===void 0&&(r.name=await p(`name`,`The name of the SYN Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'.`)),r[`rate-sensitivity`]===void 0&&(r[`rate-sensitivity`]=await p(`rate-sensitivity`,`The rate sensitivity. Must be one of 'low', 'medium', 'high'.`)),r.scope===void 0&&(r.scope=await p(`scope`,`The scope for the SYN Protection rule. Must be one of 'global', 'region', or 'datacenter'.`));let m=d({burst_sensitivity:f(r[`burst-sensitivity`],`burst-sensitivity`,`text`),mitigation_type:f(r[`mitigation-type`],`mitigation-type`,`text`),name:f(r.name,`name`,`text`),rate_sensitivity:f(r[`rate-sensitivity`],`rate-sensitivity`,`text`),scope:f(r.scope,`scope`,`text`)});a(await s(`Creating`,async()=>c.magicTransit.advancedTcpProtection.configs.syn.protection.rules.create({...m,account_id:u})),{successLabel:`Created`})}};function Ne(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Pe={command:`account`,describe:`Delete all SYN Protection rules for an account.`,builder:Ne,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs syn protection rules delete for account`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/rules`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.advancedTcpProtection.configs.syn.protection.rules.delete.for.account({account_id:l})),{successLabel:`Deleted`})}},Fe={command:`for`,describe:`Operations for advanced-tcp-protection.configs.syn.protection.rules.delete.for`,builder:e=>e.command(Pe).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ie(e){return e.positional(`rule-id`,{type:`string`,description:`The UUID of the SYN Protection rule to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Le={command:`rule <rule-id>`,describe:`Delete a SYN Protection rule specified by the given UUID.`,builder:Ie,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs syn protection rules delete protection rule`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.advancedTcpProtection.configs.syn.protection.rules.delete.protection.rule({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Deleted`})}},Re={command:`protection`,describe:`Operations for advanced-tcp-protection.configs.syn.protection.rules.delete.protection`,builder:e=>e.command(Le).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ze={command:`delete`,describe:`Operations for advanced-tcp-protection.configs.syn.protection.rules.delete`,builder:e=>e.command(Fe).command(Re).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Be(e){return e.positional(`rule-id`,{type:`string`,description:`The UUID of the SYN Protection rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ve={command:`get <rule-id>`,describe:`Get a SYN Protection rule specified by the given UUID.`,builder:Be,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs syn protection rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.advancedTcpProtection.configs.syn.protection.rules.get({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Loaded`})}};function He(e){return e.option(`page`,{type:`number`,description:`The page number for pagination. Defaults to 1.`}).option(`per-page`,{type:`number`,description:`The number of items per page. Must be between 10 and 1000. Defaults to 25.`}).option(`order`,{type:`string`,description:`The field to order by. Defaults to 'prefix'.`}).option(`direction`,{type:`string`,description:`The direction of ordering (ASC or DESC). Defaults to 'ASC'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ue={command:`list`,describe:`List all SYN Protection rules for an account.`,builder:He,handler:async r=>{let c={page:r.page,per_page:r[`per-page`],order:r.order,direction:r.direction};if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs syn protection rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/rules`,pathParams:{},query:c,bodyKind:`none`});return}let l=await i(r),u=r.local?e:await t();r.accountId=u,a(await s(`Loading`,async()=>l.magicTransit.advancedTcpProtection.configs.syn.protection.rules.list({account_id:u,...c})),{successLabel:`Loaded`})}};function We(e){return e.positional(`rule-id`,{type:`string`,description:`The UUID of the SYN Protection rule to update.`,demandOption:!0}).option(`burst-sensitivity`,{type:`string`,description:`The new burst sensitivity. Optional. Must be one of 'low', 'medium', 'high'.`}).option(`mitigation-type`,{type:`string`,description:`The new mitigation type. Optional. Must be one of 'challenge' or 'retransmit'.`}).option(`rate-sensitivity`,{type:`string`,description:`The new rate sensitivity. Optional. Must be one of 'low', 'medium', 'high'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The fields to update on the SYN Protection rule.`})}const Ge={command:`update <rule-id>`,describe:`Update a SYN Protection rule specified by the given UUID.`,builder:We,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs syn protection rules update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({burst_sensitivity:f(r[`burst-sensitivity`],`burst-sensitivity`,`text`),mitigation_type:f(r[`mitigation-type`],`mitigation-type`,`text`),rate_sensitivity:f(r[`rate-sensitivity`],`rate-sensitivity`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.advancedTcpProtection.configs.syn.protection.rules.update({...e,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}let p=d({burst_sensitivity:f(r[`burst-sensitivity`],`burst-sensitivity`,`text`),mitigation_type:f(r[`mitigation-type`],`mitigation-type`,`text`),rate_sensitivity:f(r[`rate-sensitivity`],`rate-sensitivity`,`text`)});a(await s(`Updating`,async()=>c.magicTransit.advancedTcpProtection.configs.syn.protection.rules.update({...p,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},Ke={command:`rules`,describe:`Operations for advanced-tcp-protection.configs.syn.protection.rules`,builder:e=>e.command(Me).command(Ve).command(Ue).command(Ge).command(ze).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},qe={command:`protection`,describe:`Operations for advanced-tcp-protection.configs.syn.protection`,builder:e=>e.command(Ae).command(Ke).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Je={command:`syn`,describe:`Operations for advanced-tcp-protection.configs.syn`,builder:e=>e.command(qe).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ye(e){return e.option(`expression`,{type:`string`,description:`The filter expression.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The new filter to create.`})}const Xe={command:`create`,describe:`Create a TCP Flow Protection filter for an account.`,builder:Ye,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection filters create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/filters`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({expression:f(r.expression,`expression`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.advancedTcpProtection.configs.tcp.flow.protection.filters.create({body:e,account_id:u})),{successLabel:`Created`});return}r.expression===void 0&&(r.expression=await p(`expression`,`The filter expression.`));let m=d({expression:f(r.expression,`expression`,`text`)});a(await s(`Creating`,async()=>c.magicTransit.advancedTcpProtection.configs.tcp.flow.protection.filters.create({body:m,account_id:u})),{successLabel:`Created`})}};function Ze(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Qe={command:`account`,describe:`Delete all TCP Flow Protection filters for an account.`,builder:Ze,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection filters delete for account`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/filters`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.advancedTcpProtection.configs.tcp.flow.protection.filters.delete.for.account({account_id:l})),{successLabel:`Deleted`})}},$e={command:`for`,describe:`Operations for advanced-tcp-protection.configs.tcp.flow.protection.filters.delete.for`,builder:e=>e.command(Qe).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function et(e){return e.positional(`filter-id`,{type:`string`,description:`The UUID of the filter to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const tt={command:`filter <filter-id>`,describe:`Delete a TCP Flow Protection filter specified by the given UUID.`,builder:et,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection filters delete protection filter`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/filters/${r[`filter-id`]==null?`<filter-id>`:encodeURIComponent(String(r[`filter-id`]))}`,pathParams:{"filter-id":String(r[`filter-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.advancedTcpProtection.configs.tcp.flow.protection.filters.delete.protection.filter({account_id:l,filter_id:r[`filter-id`]})),{successLabel:`Deleted`})}},nt={command:`protection`,describe:`Operations for advanced-tcp-protection.configs.tcp.flow.protection.filters.delete.protection`,builder:e=>e.command(tt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},rt={command:`delete`,describe:`Operations for advanced-tcp-protection.configs.tcp.flow.protection.filters.delete`,builder:e=>e.command($e).command(nt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function it(e){return e.positional(`filter-id`,{type:`string`,description:`The UUID of the filter to retrieve.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const at={command:`get <filter-id>`,describe:`Get a TCP Flow Protection filter specified by the given UUID.`,builder:it,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection filters get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/filters/${r[`filter-id`]==null?`<filter-id>`:encodeURIComponent(String(r[`filter-id`]))}`,pathParams:{"filter-id":String(r[`filter-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.advancedTcpProtection.configs.tcp.flow.protection.filters.get({account_id:l,filter_id:r[`filter-id`]})),{successLabel:`Loaded`})}};function ot(e){return e.option(`page`,{type:`number`,description:`The page number for pagination. Defaults to 1.`}).option(`per-page`,{type:`number`,description:`The number of items per page. Must be between 10 and 1000. Defaults to 25.`}).option(`order`,{type:`string`,description:`The field to order by. Defaults to 'prefix'.`}).option(`direction`,{type:`string`,description:`The direction of ordering (ASC or DESC). Defaults to 'ASC'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const st={command:`list`,describe:`List all TCP Flow Protection filters for an account.`,builder:ot,handler:async r=>{let c={page:r.page,per_page:r[`per-page`],order:r.order,direction:r.direction};if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection filters list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/filters`,pathParams:{},query:c,bodyKind:`none`});return}let l=await i(r),u=r.local?e:await t();r.accountId=u,a(await s(`Loading`,async()=>l.magicTransit.advancedTcpProtection.configs.tcp.flow.protection.filters.list({account_id:u,...c})),{successLabel:`Loaded`})}};function ct(e){return e.positional(`filter-id`,{type:`string`,description:`The UUID of the filter to update.`,demandOption:!0}).option(`expression`,{type:`string`,description:`The new filter expression. Optional.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updates to apply to the filter.`})}const lt={command:`update <filter-id>`,describe:`Update a TCP Flow Protection filter specified by the given UUID.`,builder:ct,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection filters update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/filters/${r[`filter-id`]==null?`<filter-id>`:encodeURIComponent(String(r[`filter-id`]))}`,pathParams:{"filter-id":String(r[`filter-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({expression:f(r.expression,`expression`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.advancedTcpProtection.configs.tcp.flow.protection.filters.update({body:e,account_id:u,filter_id:r[`filter-id`]})),{successLabel:`Updated`});return}let p=d({expression:f(r.expression,`expression`,`text`)});a(await s(`Updating`,async()=>c.magicTransit.advancedTcpProtection.configs.tcp.flow.protection.filters.update({body:p,account_id:u,filter_id:r[`filter-id`]})),{successLabel:`Updated`})}},ut={command:`filters`,describe:`Operations for advanced-tcp-protection.configs.tcp.flow.protection.filters`,builder:e=>e.command(Xe).command(at).command(st).command(lt).command(rt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function dt(e){return e.option(`burst-sensitivity`,{type:`string`,description:`The burst sensitivity. Must be one of 'low', 'medium', 'high'.`}).option(`name`,{type:`string`,description:`The name of the TCP Flow Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'.`}).option(`rate-sensitivity`,{type:`string`,description:`The rate sensitivity. Must be one of 'low', 'medium', 'high'.`}).option(`scope`,{type:`string`,description:`The scope for the TCP Flow Protection rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The new TCP Flow Protection rule.`})}const ft={command:`create`,describe:`Create a TCP Flow Protection rule for an account.`,builder:dt,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/rules`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({burst_sensitivity:f(r[`burst-sensitivity`],`burst-sensitivity`,`text`),name:f(r.name,`name`,`text`),rate_sensitivity:f(r[`rate-sensitivity`],`rate-sensitivity`,`text`),scope:f(r.scope,`scope`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.advancedTcpProtection.configs.tcp.flow.protection.rules.create({...e,account_id:u})),{successLabel:`Created`});return}r[`burst-sensitivity`]===void 0&&(r[`burst-sensitivity`]=await p(`burst-sensitivity`,`The burst sensitivity. Must be one of 'low', 'medium', 'high'.`)),r.name===void 0&&(r.name=await p(`name`,`The name of the TCP Flow Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'.`)),r[`rate-sensitivity`]===void 0&&(r[`rate-sensitivity`]=await p(`rate-sensitivity`,`The rate sensitivity. Must be one of 'low', 'medium', 'high'.`)),r.scope===void 0&&(r.scope=await p(`scope`,`The scope for the TCP Flow Protection rule.`));let m=d({burst_sensitivity:f(r[`burst-sensitivity`],`burst-sensitivity`,`text`),name:f(r.name,`name`,`text`),rate_sensitivity:f(r[`rate-sensitivity`],`rate-sensitivity`,`text`),scope:f(r.scope,`scope`,`text`)});a(await s(`Creating`,async()=>c.magicTransit.advancedTcpProtection.configs.tcp.flow.protection.rules.create({...m,account_id:u})),{successLabel:`Created`})}};function pt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const mt={command:`account`,describe:`Delete all TCP Flow Protection rules for an account.`,builder:pt,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection rules delete for account`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/rules`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.advancedTcpProtection.configs.tcp.flow.protection.rules.delete.for.account({account_id:l})),{successLabel:`Deleted`})}},ht={command:`for`,describe:`Operations for advanced-tcp-protection.configs.tcp.flow.protection.rules.delete.for`,builder:e=>e.command(mt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function gt(e){return e.positional(`rule-id`,{type:`string`,description:`The UUID of the TCP Flow Protection rule to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const _t={command:`rule <rule-id>`,describe:`Delete a TCP Flow Protection rule specified by the given UUID.`,builder:gt,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection rules delete protection rule`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.advancedTcpProtection.configs.tcp.flow.protection.rules.delete.protection.rule({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Deleted`})}},vt={command:`protection`,describe:`Operations for advanced-tcp-protection.configs.tcp.flow.protection.rules.delete.protection`,builder:e=>e.command(_t).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},yt={command:`delete`,describe:`Operations for advanced-tcp-protection.configs.tcp.flow.protection.rules.delete`,builder:e=>e.command(ht).command(vt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function bt(e){return e.positional(`rule-id`,{type:`string`,description:`The UUID of the TCP Flow Protection rule.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const xt={command:`get <rule-id>`,describe:`Get a TCP Flow Protection rule specified by the given UUID.`,builder:bt,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection rules get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.advancedTcpProtection.configs.tcp.flow.protection.rules.get({account_id:l,rule_id:r[`rule-id`]})),{successLabel:`Loaded`})}};function St(e){return e.option(`page`,{type:`number`,description:`The page number for pagination. Defaults to 1.`}).option(`per-page`,{type:`number`,description:`The number of items per page. Must be between 10 and 1000. Defaults to 25.`}).option(`order`,{type:`string`,description:`The field to order by. Defaults to 'prefix'.`}).option(`direction`,{type:`string`,description:`The direction of ordering (ASC or DESC). Defaults to 'ASC'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ct={command:`list`,describe:`List all TCP Flow Protection rules for an account.`,builder:St,handler:async r=>{let c={page:r.page,per_page:r[`per-page`],order:r.order,direction:r.direction};if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection rules list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/rules`,pathParams:{},query:c,bodyKind:`none`});return}let l=await i(r),u=r.local?e:await t();r.accountId=u,a(await s(`Loading`,async()=>l.magicTransit.advancedTcpProtection.configs.tcp.flow.protection.rules.list({account_id:u,...c})),{successLabel:`Loaded`})}};function wt(e){return e.positional(`rule-id`,{type:`string`,description:`The UUID of the TCP Flow Protection rule to update.`,demandOption:!0}).option(`burst-sensitivity`,{type:`string`,description:`The new burst sensitivity. Optional. Must be one of 'low', 'medium', 'high'.`}).option(`rate-sensitivity`,{type:`string`,description:`The new rate sensitivity. Optional. Must be one of 'low', 'medium', 'high'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updates to apply to the TCP Flow Protection rule.`})}const Tt={command:`update <rule-id>`,describe:`Update a TCP Flow Protection rule specified by the given UUID.`,builder:wt,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection rules update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/rules/${r[`rule-id`]==null?`<rule-id>`:encodeURIComponent(String(r[`rule-id`]))}`,pathParams:{"rule-id":String(r[`rule-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({burst_sensitivity:f(r[`burst-sensitivity`],`burst-sensitivity`,`text`),rate_sensitivity:f(r[`rate-sensitivity`],`rate-sensitivity`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.advancedTcpProtection.configs.tcp.flow.protection.rules.update({...e,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`});return}let p=d({burst_sensitivity:f(r[`burst-sensitivity`],`burst-sensitivity`,`text`),rate_sensitivity:f(r[`rate-sensitivity`],`rate-sensitivity`,`text`)});a(await s(`Updating`,async()=>c.magicTransit.advancedTcpProtection.configs.tcp.flow.protection.rules.update({...p,account_id:u,rule_id:r[`rule-id`]})),{successLabel:`Updated`})}},Et={command:`rules`,describe:`Operations for advanced-tcp-protection.configs.tcp.flow.protection.rules`,builder:e=>e.command(ft).command(xt).command(Ct).command(Tt).command(yt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Dt={command:`protection`,describe:`Operations for advanced-tcp-protection.configs.tcp.flow.protection`,builder:e=>e.command(ut).command(Et).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ot={command:`flow`,describe:`Operations for advanced-tcp-protection.configs.tcp.flow`,builder:e=>e.command(Dt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function kt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const At={command:`get`,describe:`Get the protection status of the account.`,builder:kt,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs tcp protection status get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_protection_status`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.advancedTcpProtection.configs.tcp.protection.status.get({account_id:l})),{successLabel:`Loaded`})}};function jt(e){return e.option(`enabled`,{type:`boolean`,description:`Enables or disables protection.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The update to apply to the protection status.`})}const Mt={command:`update`,describe:`Update the protection status of the account.`,builder:jt,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit advanced-tcp-protection configs tcp protection status update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_protection_status`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({enabled:r.enabled}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.advancedTcpProtection.configs.tcp.protection.status.update({...e,account_id:u})),{successLabel:`Updated`});return}if(r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let f=d({enabled:r.enabled});a(await s(`Updating`,async()=>c.magicTransit.advancedTcpProtection.configs.tcp.protection.status.update({...f,account_id:u})),{successLabel:`Updated`})}},Nt={command:`status`,describe:`Operations for advanced-tcp-protection.configs.tcp.protection.status`,builder:e=>e.command(At).command(Mt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Pt={command:`protection`,describe:`Operations for advanced-tcp-protection.configs.tcp.protection`,builder:e=>e.command(Nt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Ft={command:`tcp`,describe:`Operations for advanced-tcp-protection.configs.tcp`,builder:e=>e.command(Ot).command(Pt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},It={command:`configs`,describe:`Operations for advanced-tcp-protection.configs`,builder:e=>e.command(Z).command(me).command(Je).command(Ft).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Lt={command:`advanced-tcp-protection`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(It).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Rt(e){return e.option(`hostnames`,{type:`string`,array:!0,description:`FQDNs to associate with traffic decisions.`}).option(`name`,{type:`string`,description:`Display name for the app.`}).option(`type`,{type:`string`,description:`Category of the app.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const zt={command:`create`,describe:`Creates a new App for an account`,builder:Rt,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit apps create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/apps`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({hostnames:r.hostnames,name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.apps.create({body:e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await p(`name`,`Display name for the app.`)),r.type===void 0&&(r.type=await p(`type`,`Category of the app.`));let m=d({hostnames:r.hostnames,name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)});a(await s(`Creating`,async()=>c.magicTransit.apps.create({body:m,account_id:u})),{successLabel:`Created`})}};function Bt(e){return e.positional(`account-app-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Vt={command:`delete <account-app-id>`,describe:`Deletes specific Account App.`,builder:Bt,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit apps delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/apps/${r[`account-app-id`]==null?`<account-app-id>`:encodeURIComponent(String(r[`account-app-id`]))}`,pathParams:{"account-app-id":String(r[`account-app-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.apps.delete({account_id:l,account_app_id:r[`account-app-id`]})),{successLabel:`Deleted`})}};function Ht(e){return e.positional(`account-app-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`hostnames`,{type:`string`,array:!0,description:`FQDNs to associate with traffic decisions.`}).option(`name`,{type:`string`,description:`Display name for the app.`}).option(`type`,{type:`string`,description:`Category of the app.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ut={command:`edit <account-app-id>`,describe:`Updates an Account App`,builder:Ht,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit apps edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/apps/${r[`account-app-id`]==null?`<account-app-id>`:encodeURIComponent(String(r[`account-app-id`]))}`,pathParams:{"account-app-id":String(r[`account-app-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({hostnames:r.hostnames,name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.apps.edit({body:e,account_id:u,account_app_id:r[`account-app-id`]})),{successLabel:`Updated`});return}let p=d({hostnames:r.hostnames,name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)});a(await s(`Updating`,async()=>c.magicTransit.apps.edit({body:p,account_id:u,account_app_id:r[`account-app-id`]})),{successLabel:`Updated`})}};function Wt(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Gt={command:`list`,describe:`Lists Apps associated with an account.`,builder:Wt,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit apps list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/apps`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.apps.list({account_id:l})),{successLabel:`Loaded`})}};function Kt(e){return e.positional(`account-app-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`hostnames`,{type:`string`,array:!0,description:`FQDNs to associate with traffic decisions.`}).option(`name`,{type:`string`,description:`Display name for the app.`}).option(`type`,{type:`string`,description:`Category of the app.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const qt={command:`update <account-app-id>`,describe:`Updates an Account App`,builder:Kt,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit apps update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/apps/${r[`account-app-id`]==null?`<account-app-id>`:encodeURIComponent(String(r[`account-app-id`]))}`,pathParams:{"account-app-id":String(r[`account-app-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({hostnames:r.hostnames,name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.apps.update({body:e,account_id:u,account_app_id:r[`account-app-id`]})),{successLabel:`Updated`});return}let p=d({hostnames:r.hostnames,name:f(r.name,`name`,`text`),type:f(r.type,`type`,`text`)});a(await s(`Updating`,async()=>c.magicTransit.apps.update({body:p,account_id:u,account_app_id:r[`account-app-id`]})),{successLabel:`Updated`})}},Jt={command:`apps`,describe:`Application-aware traffic policies for Magic WAN that steer traffic by app type`,builder:e=>e.command(zt).command(Vt).command(Ut).command(Gt).command(qt).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Yt(e){return e.option(`description`,{type:`string`,description:`Description of the filter profile`,default:``}).option(`match-action`,{type:`string`,description:`Action to take when a route matches one of the targets in this profile`,choices:[`allow`,`deny`]}).option(`name`,{type:`string`,description:`Friendly name for the filter profile`}).option(`targets`,{type:`string`,array:!0,description:`List of CIDR prefixes. Each entry may carry an optional suffix that specifies which prefix lengths to match relative to the prefix length N: '{X,Y}' matches prefix lengths in the inclusive range [X, Y] where N <= X <= Y <= max (max is 32 for IPv4, 128 for IPv6), '{X}' matches exactly length X (equivalent to {X,X}), '+' is shorthand for {N, max} (the prefix and all more-specific subnets, including at length N itself; valid even when N is the maximum length). Omit the suffix to match the prefix exactly at length N.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Xt={command:`create`,describe:`Creates a new BGP filter profile for an account.`,builder:Yt,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit bgp-filter-profiles create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/bgp/filter_profiles`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),match_action:f(r[`match-action`],`match-action`,`text`),name:f(r.name,`name`,`text`),targets:r.targets}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.bgpFilterProfiles.create({...e,account_id:u})),{successLabel:`Created`});return}if(r[`match-action`]===void 0&&(r[`match-action`]=await m(`match-action`,`Action to take when a route matches one of the targets in this profile`,[`allow`,`deny`])),r.name===void 0&&(r.name=await p(`name`,`Friendly name for the filter profile`)),r.targets===void 0)throw Error(`--targets is required (or pass --body with this field set).`);let h=d({description:f(r.description,`description`,`text`),match_action:f(r[`match-action`],`match-action`,`text`),name:f(r.name,`name`,`text`),targets:r.targets});a(await s(`Creating`,async()=>c.magicTransit.bgpFilterProfiles.create({...h,account_id:u})),{successLabel:`Created`})}};function Zt(e){return e.positional(`profile-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Qt={command:`delete <profile-id>`,describe:`Deletes a BGP filter profile.`,builder:Zt,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit bgp-filter-profiles delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/bgp/filter_profiles/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.bgpFilterProfiles.delete({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Deleted`})}};function $t(e){return e.positional(`profile-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const en={command:`get <profile-id>`,describe:`Gets a specific BGP filter profile for an account.`,builder:$t,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit bgp-filter-profiles get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/bgp/filter_profiles/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.bgpFilterProfiles.get({account_id:l,profile_id:r[`profile-id`]})),{successLabel:`Loaded`})}};function tn(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const nn={command:`list`,describe:`Lists all BGP filter profiles for an account.`,builder:tn,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit bgp-filter-profiles list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/bgp/filter_profiles`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.bgpFilterProfiles.list({account_id:l})),{successLabel:`Loaded`})}};function rn(e){return e.positional(`profile-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`description`,{type:`string`,description:`Description of the filter profile`}).option(`match-action`,{type:`string`,description:`Action to take when a route matches one of the targets in this profile`,choices:[`allow`,`deny`]}).option(`name`,{type:`string`,description:`Friendly name for the filter profile`}).option(`targets`,{type:`string`,array:!0,description:`List of CIDR prefixes. Each entry may carry an optional suffix that specifies which prefix lengths to match relative to the prefix length N: '{X,Y}' matches prefix lengths in the inclusive range [X, Y] where N <= X <= Y <= max (max is 32 for IPv4, 128 for IPv6), '{X}' matches exactly length X (equivalent to {X,X}), '+' is shorthand for {N, max} (the prefix and all more-specific subnets, including at length N itself; valid even when N is the maximum length). Omit the suffix to match the prefix exactly at length N.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:'Partial update for a BGP filter profile. At least one property must be provided; omitted properties are left unchanged. To clear an existing description send `description: ""`.'})}const an={command:`update <profile-id>`,describe:'Updates a BGP filter profile. Omitted properties are left unchanged. To clear an existing description send `description: ""`.',builder:rn,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit bgp-filter-profiles update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/bgp/filter_profiles/${r[`profile-id`]==null?`<profile-id>`:encodeURIComponent(String(r[`profile-id`]))}`,pathParams:{"profile-id":String(r[`profile-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),match_action:f(r[`match-action`],`match-action`,`text`),name:f(r.name,`name`,`text`),targets:r.targets}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.bgpFilterProfiles.update({...e,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),match_action:f(r[`match-action`],`match-action`,`text`),name:f(r.name,`name`,`text`),targets:r.targets});a(await s(`Updating`,async()=>c.magicTransit.bgpFilterProfiles.update({...p,account_id:u,profile_id:r[`profile-id`]})),{successLabel:`Updated`})}},on={command:`bgp-filter-profiles`,describe:`BGP filter profiles for controlling which routes are allowed or denied on Magic Transit tunnels`,builder:e=>e.command(Xt).command(Qt).command(en).command(nn).command(an).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function sn(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const cn={command:`get`,describe:`Gets the BGP settings for an account, including the default ASN and redistribution configuration.`,builder:sn,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit bgp-settings get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/bgp/settings`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.bgpSettings.get({account_id:l})),{successLabel:`Loaded`})}};function ln(e){return e.option(`cloudflare-asn`,{type:`number`,description:`Route advertisements from Cloudflare to ramps in this account will use this ASN.`}).option(`redistribute-static:wan`,{type:`boolean`,description:`Redistribute static WAN routes into BGP`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const un={command:`update`,describe:`Modifies the BGP settings for an account, including the default ASN and redistribution configuration.`,builder:ln,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit bgp-settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/bgp/settings`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({cloudflare_asn:r[`cloudflare-asn`],redistribute:{"static:wan":r[`redistribute-static:wan`]}}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.bgpSettings.update({...e,account_id:u})),{successLabel:`Updated`});return}let f=d({cloudflare_asn:r[`cloudflare-asn`],redistribute:{"static:wan":r[`redistribute-static:wan`]}});a(await s(`Updating`,async()=>c.magicTransit.bgpSettings.update({...f,account_id:u})),{successLabel:`Updated`})}},dn={command:`bgp-settings`,describe:`BGP settings for controlling default ASN and route redistribution on Magic Transit tunnels`,builder:e=>e.command(cn).command(un).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function fn(e){return e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const pn={command:`bulk-update`,describe:"Updates multiple interconnects associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:fn,handler:async c=>{let u={};if(c[`x-magic-new-hc-target`]!==void 0&&(u[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit cf-interconnects bulk-update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/cf_interconnects`,pathParams:{},bodyKind:`json`,body:c.body===void 0?void 0:l(c.body)});return}let d=await i(c),f=c.local?e:await t();if(c.accountId=f,c.body){let e=l(c.body);a(await s(`Updating`,async()=>r(d,`PUT`,`/accounts/${f}/magic/cf_interconnects`,{body:e,headers:Object.keys(u).length>0?u:void 0})),{successLabel:`Updated`});return}a(await s(`Updating`,async()=>r(d,`PUT`,`/accounts/${f}/magic/cf_interconnects`,{headers:Object.keys(u).length>0?u:void 0})),{successLabel:`Updated`})}};function mn(e){return e.positional(`cf-interconnect-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const hn={command:`get <cf-interconnect-id>`,describe:`Lists details for a specific interconnect.`,builder:mn,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit cf-interconnects get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/cf_interconnects/${c[`cf-interconnect-id`]==null?`<cf-interconnect-id>`:encodeURIComponent(String(c[`cf-interconnect-id`]))}`,pathParams:{"cf-interconnect-id":String(c[`cf-interconnect-id`]??``)},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();c.accountId=d,a(await s(`Loading`,async()=>r(u,`GET`,`/accounts/${d}/magic/cf_interconnects/${encodeURIComponent(String(c[`cf-interconnect-id`]))}`,{headers:Object.keys(l).length>0?l:void 0})),{successLabel:`Loaded`})}};function gn(e){return e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const _n={command:`list`,describe:`Lists interconnects associated with an account.`,builder:gn,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit cf-interconnects list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/cf_interconnects`,pathParams:{},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();c.accountId=d,a(await s(`Loading`,async()=>r(u,`GET`,`/accounts/${d}/magic/cf_interconnects`,{headers:Object.keys(l).length>0?l:void 0})),{successLabel:`Loaded`})}};function vn(e){return e.positional(`cf-interconnect-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`automatic-return-routing`,{type:`boolean`,description:"True if automatic stateful return routing should be enabled for a tunnel, false otherwise. Requires the `coupler_integration` account flag to be enabled; requests setting this to `true` without that flag will be rejected."}).option(`bgp-as-no`,{type:`number`,description:`Deprecated. Use customer_asn.`}).option(`bgp-cloudflare-endpoint`,{type:`string`,description:`Read-only for v1.5; derived from interface_address.`}).option(`bgp-customer-asn`,{type:`number`,description:`ASN used on the customer end of the BGP session.`}).option(`bgp-customer-endpoint`,{type:`string`,description:`Read-only for v1.5; derived from interface_address.`}).option(`bgp-export-filter-id`,{type:`string`,description:`ID of the BGP filter profile applied to routes advertised to the customer.`}).option(`bgp-extra-prefixes`,{type:`string`,array:!0,description:`Prefixes in this list will be advertised to the customer device, in addition to the routes in the Magic routing table.`}).option(`bgp-import-filter-id`,{type:`string`,description:`ID of the BGP filter profile applied to routes received from the customer.`}).option(`bgp-md5-key`,{type:`string`,description:`MD5 key to use for session authentication.
+
+Note that *this is not a security measure*. MD5 is not a valid security mechanism, and the
+key is not treated as a secret value. This is *only* supported for preventing
+misconfiguration, not for defending against malicious attacks.
+
+The MD5 key, if set, must be of non-zero length and consist only of the following types of
+character:
+
+* ASCII alphanumerics: \`[a-zA-Z0-9]\`
+* Special characters in the set \`'!@#$%^&*()+[]{}<>/.,;:_-~\`= \\|\`
+
+In other words, MD5 keys may contain any printable ASCII character aside from newline (0x0A),
+quotation mark (\`"\`), vertical tab (0x0B), carriage return (0x0D), tab (0x09), form feed
+(0x0C), and the question mark (\`?\`). Requests specifying an MD5 key with one or more of
+these disallowed characters will be rejected.`}).option(`description`,{type:`string`,description:`An optional description of the interconnect.`}).option(`gre-cloudflare-endpoint`,{type:`string`,description:`The IP address assigned to the Cloudflare side of the GRE tunnel created as part of the Interconnect.`}).option(`health-check-enabled`,{type:`boolean`,description:`Determines whether to run healthchecks for a tunnel.`}).option(`health-check-rate`,{type:`string`,description:"How frequent the health check is run. The default value is `mid`.",choices:[`low`,`mid`,`high`]}).option(`health-check-target-saved`,{type:`string`,description:`The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.`}).option(`health-check-type`,{type:`string`,description:"The type of healthcheck to run, reply or request. The default value is `reply`.",choices:[`reply`,`request`]}).option(`health-check-direction`,{type:`string`,description:`The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the interconnect and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the interconnect.`,choices:[`unidirectional`,`bidirectional`]}).option(`health-check-source`,{type:`string`,description:"The source IPv4 address used for bidirectional health checks. Supported only for version 1.5 interconnects. It is required when `direction` is `bidirectional` and must be omitted (and is cleared) when `direction` is `unidirectional`. The address must be within RFC1918 space, the approved link-local range 169.254.240.0/20, or the Cloudflare reserved range 198.41.199.224/27."}).option(`interface-address`,{type:`string`,description:`The IPv4 interface address for the interconnect. For MPLS Interconnects,
+use a /30 or /31 prefix. For GRE Interconnects, a /30 or /31 prefix
+may be used. Version 1.5 interconnects require a /31 prefix and may
+also use a prefix from the account's authorized prefixes; otherwise,
+select the subnet from RFC 1918 or the approved link-local ranges.
+`}).option(`interface-address6`,{type:`string`,description:`A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127`}).option(`mtu`,{type:`number`,description:`The Maximum Transmission Unit (MTU) in bytes for the interconnect. The minimum value is 576.`}).option(`name`,{type:`string`,description:`The name of the interconnect. The name cannot share a name with other tunnels.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const yn={command:`update <cf-interconnect-id>`,describe:"Updates a specific interconnect associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:vn,handler:async u=>{let p={};if(u[`x-magic-new-hc-target`]!==void 0&&(p[`x-magic-new-hc-target`]=String(u[`x-magic-new-hc-target`])),u.dryRun){o({command:`cf magic-transit cf-interconnects update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/cf_interconnects/${u[`cf-interconnect-id`]==null?`<cf-interconnect-id>`:encodeURIComponent(String(u[`cf-interconnect-id`]))}`,pathParams:{"cf-interconnect-id":String(u[`cf-interconnect-id`]??``)},bodyKind:`json`,body:u.body===void 0?d({automatic_return_routing:u[`automatic-return-routing`],bgp:{as_no:u[`bgp-as-no`],cloudflare_endpoint:f(u[`bgp-cloudflare-endpoint`],`bgp-cloudflare-endpoint`,`text`),customer_asn:u[`bgp-customer-asn`],customer_endpoint:f(u[`bgp-customer-endpoint`],`bgp-customer-endpoint`,`text`),export_filter_id:f(u[`bgp-export-filter-id`],`bgp-export-filter-id`,`text`),extra_prefixes:u[`bgp-extra-prefixes`],import_filter_id:f(u[`bgp-import-filter-id`],`bgp-import-filter-id`,`text`),md5_key:f(u[`bgp-md5-key`],`bgp-md5-key`,`text`)},description:f(u.description,`description`,`text`),gre:{cloudflare_endpoint:f(u[`gre-cloudflare-endpoint`],`gre-cloudflare-endpoint`,`text`)},health_check:{enabled:u[`health-check-enabled`],rate:f(u[`health-check-rate`],`health-check-rate`,`text`),target:{saved:f(u[`health-check-target-saved`],`health-check-target-saved`,`text`)},type:f(u[`health-check-type`],`health-check-type`,`text`),direction:f(u[`health-check-direction`],`health-check-direction`,`text`),source:f(u[`health-check-source`],`health-check-source`,`text`)},interface_address:f(u[`interface-address`],`interface-address`,`text`),interface_address6:f(u[`interface-address6`],`interface-address6`,`text`),mtu:u.mtu,name:f(u.name,`name`,`text`)}):l(u.body)});return}let m=await i(u),h=u.local?e:await t();if(u.accountId=h,u.body){let e=l(u.body);a(await s(`Updating`,async()=>r(m,`PUT`,`/accounts/${h}/magic/cf_interconnects/${encodeURIComponent(String(u[`cf-interconnect-id`]))}`,{body:e,headers:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated`});return}let g={};u[`automatic-return-routing`]!==void 0&&c(g,[`automatic_return_routing`],u[`automatic-return-routing`]),u[`bgp-as-no`]!==void 0&&c(g,[`bgp`,`as_no`],u[`bgp-as-no`]),u[`bgp-cloudflare-endpoint`]!==void 0&&c(g,[`bgp`,`cloudflare_endpoint`],f(u[`bgp-cloudflare-endpoint`],`bgp-cloudflare-endpoint`,`text`)),u[`bgp-customer-asn`]!==void 0&&c(g,[`bgp`,`customer_asn`],u[`bgp-customer-asn`]),u[`bgp-customer-endpoint`]!==void 0&&c(g,[`bgp`,`customer_endpoint`],f(u[`bgp-customer-endpoint`],`bgp-customer-endpoint`,`text`)),u[`bgp-export-filter-id`]!==void 0&&c(g,[`bgp`,`export_filter_id`],f(u[`bgp-export-filter-id`],`bgp-export-filter-id`,`text`)),u[`bgp-extra-prefixes`]!==void 0&&c(g,[`bgp`,`extra_prefixes`],u[`bgp-extra-prefixes`]),u[`bgp-import-filter-id`]!==void 0&&c(g,[`bgp`,`import_filter_id`],f(u[`bgp-import-filter-id`],`bgp-import-filter-id`,`text`)),u[`bgp-md5-key`]!==void 0&&c(g,[`bgp`,`md5_key`],f(u[`bgp-md5-key`],`bgp-md5-key`,`text`)),u.description!==void 0&&c(g,[`description`],f(u.description,`description`,`text`)),u[`gre-cloudflare-endpoint`]!==void 0&&c(g,[`gre`,`cloudflare_endpoint`],f(u[`gre-cloudflare-endpoint`],`gre-cloudflare-endpoint`,`text`)),u[`health-check-enabled`]!==void 0&&c(g,[`health_check`,`enabled`],u[`health-check-enabled`]),u[`health-check-rate`]!==void 0&&c(g,[`health_check`,`rate`],f(u[`health-check-rate`],`health-check-rate`,`text`)),u[`health-check-target-saved`]!==void 0&&c(g,[`health_check`,`target`,`saved`],f(u[`health-check-target-saved`],`health-check-target-saved`,`text`)),u[`health-check-type`]!==void 0&&c(g,[`health_check`,`type`],f(u[`health-check-type`],`health-check-type`,`text`)),u[`health-check-direction`]!==void 0&&c(g,[`health_check`,`direction`],f(u[`health-check-direction`],`health-check-direction`,`text`)),u[`health-check-source`]!==void 0&&c(g,[`health_check`,`source`],f(u[`health-check-source`],`health-check-source`,`text`)),u[`interface-address`]!==void 0&&c(g,[`interface_address`],f(u[`interface-address`],`interface-address`,`text`)),u[`interface-address6`]!==void 0&&c(g,[`interface_address6`],f(u[`interface-address6`],`interface-address6`,`text`)),u.mtu!==void 0&&c(g,[`mtu`],u.mtu),u.name!==void 0&&c(g,[`name`],f(u.name,`name`,`text`)),a(await s(`Updating`,async()=>r(m,`PUT`,`/accounts/${h}/magic/cf_interconnects/${encodeURIComponent(String(u[`cf-interconnect-id`]))}`,{body:Object.keys(g).length>0?g:void 0,headers:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated`})}},bn={command:`cf-interconnects`,describe:`Cloudflare Network Interconnect (CNI) links for direct physical or virtual peering`,builder:e=>e.command(pn).command(hn).command(_n).command(yn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function xn(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Sn={command:`create`,describe:`Creates new CF1 Sites for an account. Each site must have a unique name within the account.`,builder:xn,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit cf1-sites create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/cf1_sites`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.cf1Sites.create({body:e,account_id:u})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function Cn(e){return e.positional(`cf1-site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const wn={command:`delete <cf1-site-id>`,describe:`Deletes a specific CF1 Site for an account.`,builder:Cn,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit cf1-sites delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/cf1_sites/${r[`cf1-site-id`]==null?`<cf1-site-id>`:encodeURIComponent(String(r[`cf1-site-id`]))}`,pathParams:{"cf1-site-id":String(r[`cf1-site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.cf1Sites.delete({account_id:l,cf1_site_id:r[`cf1-site-id`]})),{successLabel:`Deleted`})}};function Tn(e){return e.positional(`cf1-site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const En={command:`get <cf1-site-id>`,describe:`Gets a specific CF1 Site for an account.`,builder:Tn,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit cf1-sites get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/cf1_sites/${r[`cf1-site-id`]==null?`<cf1-site-id>`:encodeURIComponent(String(r[`cf1-site-id`]))}`,pathParams:{"cf1-site-id":String(r[`cf1-site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.cf1Sites.get({account_id:l,cf1_site_id:r[`cf1-site-id`]})),{successLabel:`Loaded`})}};function Dn(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const On={command:`list`,describe:`Lists CF1 Sites associated with an account. A CF1 Site represents a physical customer network location with optional geographic coordinates.`,builder:Dn,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit cf1-sites list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/cf1_sites`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.cf1Sites.list({account_id:l})),{successLabel:`Loaded`})}};function kn(e){return e.positional(`cf1-site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const An={command:`create <cf1-site-id>`,describe:`Creates ramps (network connections) for a CF1 Site.`,builder:kn,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit cf1-sites ramps create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/cf1_sites/${r[`cf1-site-id`]==null?`<cf1-site-id>`:encodeURIComponent(String(r[`cf1-site-id`]))}/ramps`,pathParams:{"cf1-site-id":String(r[`cf1-site-id`]??``)},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.cf1Sites.ramps.create({body:e,account_id:u,cf1_site_id:r[`cf1-site-id`]})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function jn(e){return e.positional(`ramp-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`cf1-site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Mn={command:`delete <ramp-id>`,describe:`Deletes a specific ramp from a CF1 Site.`,builder:jn,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit cf1-sites ramps delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/cf1_sites/${r[`cf1-site-id`]==null?`<cf1-site-id>`:encodeURIComponent(String(r[`cf1-site-id`]))}/ramps/${r[`ramp-id`]==null?`<ramp-id>`:encodeURIComponent(String(r[`ramp-id`]))}`,pathParams:{"cf1-site-id":String(r[`cf1-site-id`]??``),"ramp-id":String(r[`ramp-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.cf1Sites.ramps.delete({account_id:l,cf1_site_id:r[`cf1-site-id`],ramp_id:r[`ramp-id`]})),{successLabel:`Deleted`})}};function Nn(e){return e.positional(`ramp-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`cf1-site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Pn={command:`get <ramp-id>`,describe:`Gets a specific ramp for a CF1 Site.`,builder:Nn,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit cf1-sites ramps get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/cf1_sites/${r[`cf1-site-id`]==null?`<cf1-site-id>`:encodeURIComponent(String(r[`cf1-site-id`]))}/ramps/${r[`ramp-id`]==null?`<ramp-id>`:encodeURIComponent(String(r[`ramp-id`]))}`,pathParams:{"cf1-site-id":String(r[`cf1-site-id`]??``),"ramp-id":String(r[`ramp-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.cf1Sites.ramps.get({account_id:l,cf1_site_id:r[`cf1-site-id`],ramp_id:r[`ramp-id`]})),{successLabel:`Loaded`})}};function Fn(e){return e.option(`cf1-site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const $={command:`list`,describe:`Lists ramps (network connections) associated with a CF1 Site. Ramps represent GRE tunnels, IPsec tunnels, interconnects, or MCONN links.`,builder:Fn,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit cf1-sites ramps list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/cf1_sites/${r[`cf1-site-id`]==null?`<cf1-site-id>`:encodeURIComponent(String(r[`cf1-site-id`]))}/ramps`,pathParams:{"cf1-site-id":String(r[`cf1-site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.cf1Sites.ramps.list({account_id:l,cf1_site_id:r[`cf1-site-id`]})),{successLabel:`Loaded`})}},In={command:`ramps`,describe:`Operations for cf1-sites.ramps`,builder:e=>e.command(An).command(Mn).command(Pn).command($).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ln(e){return e.positional(`cf1-site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`description`,{type:`string`,description:`A human-provided description of the CF1 Site.`}).option(`location-lat`,{type:`number`,description:`Latitude of the CF1 Site.`}).option(`location-long`,{type:`number`,description:`Longitude of the CF1 Site.`}).option(`location-name`,{type:`string`,description:`Name of nearest town, city, or village.`}).option(`name`,{type:`string`,description:`A human-provided name describing the CF1 Site that should be unique within the account.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Partial update payload for a CF1 Site. All properties are optional; only fields supplied in the request body are modified.`})}const Rn={command:`update <cf1-site-id>`,describe:`Partially updates a specific CF1 Site for an account. Only the fields included in the request body are modified; omitted fields retain their existing values.`,builder:Ln,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit cf1-sites update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/cf1_sites/${r[`cf1-site-id`]==null?`<cf1-site-id>`:encodeURIComponent(String(r[`cf1-site-id`]))}`,pathParams:{"cf1-site-id":String(r[`cf1-site-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),location:{lat:r[`location-lat`],long:r[`location-long`],name:f(r[`location-name`],`location-name`,`text`)},name:f(r.name,`name`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.cf1Sites.update({...e,account_id:u,cf1_site_id:r[`cf1-site-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),location:{lat:r[`location-lat`],long:r[`location-long`],name:f(r[`location-name`],`location-name`,`text`)},name:f(r.name,`name`,`text`)});a(await s(`Updating`,async()=>c.magicTransit.cf1Sites.update({...p,account_id:u,cf1_site_id:r[`cf1-site-id`]})),{successLabel:`Updated`})}},zn={command:`cf1-sites`,describe:`Operations for cf1-sites`,builder:e=>e.command(Sn).command(wn).command(En).command(On).command(Rn).command(In).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Bn(e){return e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Vn={command:`bulk-update`,describe:"Updates multiple GRE tunnels. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:Bn,handler:async c=>{let u={};if(c[`x-magic-new-hc-target`]!==void 0&&(u[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit gre-tunnels bulk-update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/gre_tunnels`,pathParams:{},bodyKind:`json`,body:c.body===void 0?void 0:l(c.body)});return}let d=await i(c),f=c.local?e:await t();if(c.accountId=f,c.body){let e=l(c.body);a(await s(`Updating`,async()=>r(d,`PUT`,`/accounts/${f}/magic/gre_tunnels`,{body:e,headers:Object.keys(u).length>0?u:void 0})),{successLabel:`Updated`});return}a(await s(`Updating`,async()=>r(d,`PUT`,`/accounts/${f}/magic/gre_tunnels`,{headers:Object.keys(u).length>0?u:void 0})),{successLabel:`Updated`})}};function Hn(e){return e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`automatic-return-routing`,{type:`boolean`,description:"True if automatic stateful return routing should be enabled for a tunnel, false otherwise. Requires the `coupler_integration` account flag to be enabled; requests setting this to `true` without that flag will be rejected.",default:!1}).option(`bgp-customer-asn`,{type:`number`,description:`ASN used on the customer end of the BGP session`}).option(`bgp-export-filter-id`,{type:`string`,description:`ID of the BGP filter profile applied to routes advertised to the customer.`}).option(`bgp-extra-prefixes`,{type:`string`,array:!0,description:`Prefixes in this list will be advertised to the customer device, in addition to the routes in the Magic routing table.`}).option(`bgp-import-filter-id`,{type:`string`,description:`ID of the BGP filter profile applied to routes received from the customer.`}).option(`bgp-md5-key`,{type:`string`,description:`MD5 key to use for session authentication.
+
+Note that *this is not a security measure*. MD5 is not a valid security mechanism, and the
+key is not treated as a secret value. This is *only* supported for preventing
+misconfiguration, not for defending against malicious attacks.
+
+The MD5 key, if set, must be of non-zero length and consist only of the following types of
+character:
+
+* ASCII alphanumerics: \`[a-zA-Z0-9]\`
+* Special characters in the set \`'!@#$%^&*()+[]{}<>/.,;:_-~\`= \\|\`
+
+In other words, MD5 keys may contain any printable ASCII character aside from newline (0x0A),
+quotation mark (\`"\`), vertical tab (0x0B), carriage return (0x0D), tab (0x09), form feed
+(0x0C), and the question mark (\`?\`). Requests specifying an MD5 key with one or more of
+these disallowed characters will be rejected.`}).option(`cloudflare-gre-endpoint`,{type:`string`,description:`The IP address assigned to the Cloudflare side of the GRE tunnel.`}).option(`customer-gre-endpoint`,{type:`string`,description:`The IP address assigned to the customer side of the GRE tunnel.`}).option(`description`,{type:`string`,description:`An optional description of the GRE tunnel.`}).option(`health-check-enabled`,{type:`boolean`,description:`Determines whether to run healthchecks for a tunnel.`}).option(`health-check-rate`,{type:`string`,description:"How frequent the health check is run. The default value is `mid`.",choices:[`low`,`mid`,`high`]}).option(`health-check-target-saved`,{type:`string`,description:`The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.`}).option(`health-check-type`,{type:`string`,description:"The type of healthcheck to run, reply or request. The default value is `reply`.",choices:[`reply`,`request`]}).option(`health-check-direction`,{type:`string`,description:`The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.`,choices:[`unidirectional`,`bidirectional`]}).option(`interface-address`,{type:`string`,description:`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`}).option(`interface-address6`,{type:`string`,description:`A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127`}).option(`mtu`,{type:`number`,description:`Maximum Transmission Unit (MTU) in bytes for the GRE tunnel. The minimum value is 576.`,default:1476}).option(`name`,{type:`string`,description:`The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.`}).option(`ttl`,{type:`number`,description:`Time To Live (TTL) in number of hops of the GRE tunnel.`,default:64}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`bgp-customer-asn`,`bgp-export-filter-id`,`bgp-extra-prefixes`,`bgp-import-filter-id`,`bgp-md5-key`].some(t=>e[t]!==void 0)){let t=[`bgp-customer-asn`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --bgp-* flag is set`)}return!0})}const Un={command:`create`,describe:"Creates a new GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:Hn,handler:async u=>{let m={};if(u[`x-magic-new-hc-target`]!==void 0&&(m[`x-magic-new-hc-target`]=String(u[`x-magic-new-hc-target`])),u.dryRun){o({command:`cf magic-transit gre-tunnels create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/gre_tunnels`,pathParams:{},bodyKind:`json`,body:u.body===void 0?d({automatic_return_routing:u[`automatic-return-routing`],bgp:{customer_asn:u[`bgp-customer-asn`],export_filter_id:f(u[`bgp-export-filter-id`],`bgp-export-filter-id`,`text`),extra_prefixes:u[`bgp-extra-prefixes`],import_filter_id:f(u[`bgp-import-filter-id`],`bgp-import-filter-id`,`text`),md5_key:f(u[`bgp-md5-key`],`bgp-md5-key`,`text`)},cloudflare_gre_endpoint:f(u[`cloudflare-gre-endpoint`],`cloudflare-gre-endpoint`,`text`),customer_gre_endpoint:f(u[`customer-gre-endpoint`],`customer-gre-endpoint`,`text`),description:f(u.description,`description`,`text`),health_check:{enabled:u[`health-check-enabled`],rate:f(u[`health-check-rate`],`health-check-rate`,`text`),target:{saved:f(u[`health-check-target-saved`],`health-check-target-saved`,`text`)},type:f(u[`health-check-type`],`health-check-type`,`text`),direction:f(u[`health-check-direction`],`health-check-direction`,`text`)},interface_address:f(u[`interface-address`],`interface-address`,`text`),interface_address6:f(u[`interface-address6`],`interface-address6`,`text`),mtu:u.mtu,name:f(u.name,`name`,`text`),ttl:u.ttl}):l(u.body)});return}let h=await i(u),g=u.local?e:await t();if(u.accountId=g,u.body){let e=l(u.body);a(await s(`Creating`,async()=>r(h,`POST`,`/accounts/${g}/magic/gre_tunnels`,{body:e,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Created`});return}u[`cloudflare-gre-endpoint`]===void 0&&(u[`cloudflare-gre-endpoint`]=await p(`cloudflare-gre-endpoint`,`The IP address assigned to the Cloudflare side of the GRE tunnel.`)),u[`customer-gre-endpoint`]===void 0&&(u[`customer-gre-endpoint`]=await p(`customer-gre-endpoint`,`The IP address assigned to the customer side of the GRE tunnel.`)),u[`interface-address`]===void 0&&(u[`interface-address`]=await p(`interface-address`,`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`)),u.name===void 0&&(u.name=await p(`name`,`The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.`));let _={};u[`automatic-return-routing`]!==void 0&&c(_,[`automatic_return_routing`],u[`automatic-return-routing`]),u[`bgp-customer-asn`]!==void 0&&c(_,[`bgp`,`customer_asn`],u[`bgp-customer-asn`]),u[`bgp-export-filter-id`]!==void 0&&c(_,[`bgp`,`export_filter_id`],f(u[`bgp-export-filter-id`],`bgp-export-filter-id`,`text`)),u[`bgp-extra-prefixes`]!==void 0&&c(_,[`bgp`,`extra_prefixes`],u[`bgp-extra-prefixes`]),u[`bgp-import-filter-id`]!==void 0&&c(_,[`bgp`,`import_filter_id`],f(u[`bgp-import-filter-id`],`bgp-import-filter-id`,`text`)),u[`bgp-md5-key`]!==void 0&&c(_,[`bgp`,`md5_key`],f(u[`bgp-md5-key`],`bgp-md5-key`,`text`)),u[`cloudflare-gre-endpoint`]!==void 0&&c(_,[`cloudflare_gre_endpoint`],f(u[`cloudflare-gre-endpoint`],`cloudflare-gre-endpoint`,`text`)),u[`customer-gre-endpoint`]!==void 0&&c(_,[`customer_gre_endpoint`],f(u[`customer-gre-endpoint`],`customer-gre-endpoint`,`text`)),u.description!==void 0&&c(_,[`description`],f(u.description,`description`,`text`)),u[`health-check-enabled`]!==void 0&&c(_,[`health_check`,`enabled`],u[`health-check-enabled`]),u[`health-check-rate`]!==void 0&&c(_,[`health_check`,`rate`],f(u[`health-check-rate`],`health-check-rate`,`text`)),u[`health-check-target-saved`]!==void 0&&c(_,[`health_check`,`target`,`saved`],f(u[`health-check-target-saved`],`health-check-target-saved`,`text`)),u[`health-check-type`]!==void 0&&c(_,[`health_check`,`type`],f(u[`health-check-type`],`health-check-type`,`text`)),u[`health-check-direction`]!==void 0&&c(_,[`health_check`,`direction`],f(u[`health-check-direction`],`health-check-direction`,`text`)),u[`interface-address`]!==void 0&&c(_,[`interface_address`],f(u[`interface-address`],`interface-address`,`text`)),u[`interface-address6`]!==void 0&&c(_,[`interface_address6`],f(u[`interface-address6`],`interface-address6`,`text`)),u.mtu!==void 0&&c(_,[`mtu`],u.mtu),u.name!==void 0&&c(_,[`name`],f(u.name,`name`,`text`)),u.ttl!==void 0&&c(_,[`ttl`],u.ttl),a(await s(`Creating`,async()=>r(h,`POST`,`/accounts/${g}/magic/gre_tunnels`,{body:Object.keys(_).length>0?_:void 0,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Created`})}};function Wn(e){return e.positional(`gre-tunnel-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Gn={command:`delete <gre-tunnel-id>`,describe:"Disables and removes a specific static GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:Wn,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit gre-tunnels delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/gre_tunnels/${c[`gre-tunnel-id`]==null?`<gre-tunnel-id>`:encodeURIComponent(String(c[`gre-tunnel-id`]))}`,pathParams:{"gre-tunnel-id":String(c[`gre-tunnel-id`]??``)},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();if(c.accountId=d,!await h({force:!!c.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r(u,`DELETE`,`/accounts/${d}/magic/gre_tunnels/${encodeURIComponent(String(c[`gre-tunnel-id`]))}`,{headers:Object.keys(l).length>0?l:void 0})),{successLabel:`Deleted`})}};function Kn(e){return e.positional(`gre-tunnel-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const qn={command:`get <gre-tunnel-id>`,describe:`Lists informtion for a specific GRE tunnel.`,builder:Kn,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit gre-tunnels get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/gre_tunnels/${c[`gre-tunnel-id`]==null?`<gre-tunnel-id>`:encodeURIComponent(String(c[`gre-tunnel-id`]))}`,pathParams:{"gre-tunnel-id":String(c[`gre-tunnel-id`]??``)},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();c.accountId=d,a(await s(`Loading`,async()=>r(u,`GET`,`/accounts/${d}/magic/gre_tunnels/${encodeURIComponent(String(c[`gre-tunnel-id`]))}`,{headers:Object.keys(l).length>0?l:void 0})),{successLabel:`Loaded`})}};function Jn(e){return e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Yn={command:`list`,describe:`Lists GRE tunnels associated with an account.`,builder:Jn,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit gre-tunnels list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/gre_tunnels`,pathParams:{},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();c.accountId=d,a(await s(`Loading`,async()=>r(u,`GET`,`/accounts/${d}/magic/gre_tunnels`,{headers:Object.keys(l).length>0?l:void 0})),{successLabel:`Loaded`})}};function Xn(e){return e.positional(`gre-tunnel-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`automatic-return-routing`,{type:`boolean`,description:"True if automatic stateful return routing should be enabled for a tunnel, false otherwise. Requires the `coupler_integration` account flag to be enabled; requests setting this to `true` without that flag will be rejected."}).option(`cloudflare-gre-endpoint`,{type:`string`,description:`The IP address assigned to the Cloudflare side of the GRE tunnel.`}).option(`customer-gre-endpoint`,{type:`string`,description:`The IP address assigned to the customer side of the GRE tunnel.`}).option(`description`,{type:`string`,description:`An optional description of the GRE tunnel.`}).option(`health-check-enabled`,{type:`boolean`,description:`Determines whether to run healthchecks for a tunnel.`}).option(`health-check-rate`,{type:`string`,description:"How frequent the health check is run. The default value is `mid`.",choices:[`low`,`mid`,`high`]}).option(`health-check-target-saved`,{type:`string`,description:`The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.`}).option(`health-check-type`,{type:`string`,description:"The type of healthcheck to run, reply or request. The default value is `reply`.",choices:[`reply`,`request`]}).option(`health-check-direction`,{type:`string`,description:`The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.`,choices:[`unidirectional`,`bidirectional`]}).option(`interface-address`,{type:`string`,description:`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`}).option(`interface-address6`,{type:`string`,description:`A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127`}).option(`mtu`,{type:`number`,description:`Maximum Transmission Unit (MTU) in bytes for the GRE tunnel. The minimum value is 576.`}).option(`name`,{type:`string`,description:`The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.`}).option(`ttl`,{type:`number`,description:`Time To Live (TTL) in number of hops of the GRE tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Zn={command:`update <gre-tunnel-id>`,describe:"Updates a specific GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:Xn,handler:async u=>{let m={};if(u[`x-magic-new-hc-target`]!==void 0&&(m[`x-magic-new-hc-target`]=String(u[`x-magic-new-hc-target`])),u.dryRun){o({command:`cf magic-transit gre-tunnels update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/gre_tunnels/${u[`gre-tunnel-id`]==null?`<gre-tunnel-id>`:encodeURIComponent(String(u[`gre-tunnel-id`]))}`,pathParams:{"gre-tunnel-id":String(u[`gre-tunnel-id`]??``)},bodyKind:`json`,body:u.body===void 0?d({automatic_return_routing:u[`automatic-return-routing`],cloudflare_gre_endpoint:f(u[`cloudflare-gre-endpoint`],`cloudflare-gre-endpoint`,`text`),customer_gre_endpoint:f(u[`customer-gre-endpoint`],`customer-gre-endpoint`,`text`),description:f(u.description,`description`,`text`),health_check:{enabled:u[`health-check-enabled`],rate:f(u[`health-check-rate`],`health-check-rate`,`text`),target:{saved:f(u[`health-check-target-saved`],`health-check-target-saved`,`text`)},type:f(u[`health-check-type`],`health-check-type`,`text`),direction:f(u[`health-check-direction`],`health-check-direction`,`text`)},interface_address:f(u[`interface-address`],`interface-address`,`text`),interface_address6:f(u[`interface-address6`],`interface-address6`,`text`),mtu:u.mtu,name:f(u.name,`name`,`text`),ttl:u.ttl}):l(u.body)});return}let h=await i(u),g=u.local?e:await t();if(u.accountId=g,u.body){let e=l(u.body);a(await s(`Updating`,async()=>r(h,`PUT`,`/accounts/${g}/magic/gre_tunnels/${encodeURIComponent(String(u[`gre-tunnel-id`]))}`,{body:e,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated`});return}u[`cloudflare-gre-endpoint`]===void 0&&(u[`cloudflare-gre-endpoint`]=await p(`cloudflare-gre-endpoint`,`The IP address assigned to the Cloudflare side of the GRE tunnel.`)),u[`customer-gre-endpoint`]===void 0&&(u[`customer-gre-endpoint`]=await p(`customer-gre-endpoint`,`The IP address assigned to the customer side of the GRE tunnel.`)),u[`interface-address`]===void 0&&(u[`interface-address`]=await p(`interface-address`,`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`)),u.name===void 0&&(u.name=await p(`name`,`The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.`));let _={};u[`automatic-return-routing`]!==void 0&&c(_,[`automatic_return_routing`],u[`automatic-return-routing`]),u[`cloudflare-gre-endpoint`]!==void 0&&c(_,[`cloudflare_gre_endpoint`],f(u[`cloudflare-gre-endpoint`],`cloudflare-gre-endpoint`,`text`)),u[`customer-gre-endpoint`]!==void 0&&c(_,[`customer_gre_endpoint`],f(u[`customer-gre-endpoint`],`customer-gre-endpoint`,`text`)),u.description!==void 0&&c(_,[`description`],f(u.description,`description`,`text`)),u[`health-check-enabled`]!==void 0&&c(_,[`health_check`,`enabled`],u[`health-check-enabled`]),u[`health-check-rate`]!==void 0&&c(_,[`health_check`,`rate`],f(u[`health-check-rate`],`health-check-rate`,`text`)),u[`health-check-target-saved`]!==void 0&&c(_,[`health_check`,`target`,`saved`],f(u[`health-check-target-saved`],`health-check-target-saved`,`text`)),u[`health-check-type`]!==void 0&&c(_,[`health_check`,`type`],f(u[`health-check-type`],`health-check-type`,`text`)),u[`health-check-direction`]!==void 0&&c(_,[`health_check`,`direction`],f(u[`health-check-direction`],`health-check-direction`,`text`)),u[`interface-address`]!==void 0&&c(_,[`interface_address`],f(u[`interface-address`],`interface-address`,`text`)),u[`interface-address6`]!==void 0&&c(_,[`interface_address6`],f(u[`interface-address6`],`interface-address6`,`text`)),u.mtu!==void 0&&c(_,[`mtu`],u.mtu),u.name!==void 0&&c(_,[`name`],f(u.name,`name`,`text`)),u.ttl!==void 0&&c(_,[`ttl`],u.ttl),a(await s(`Updating`,async()=>r(h,`PUT`,`/accounts/${g}/magic/gre_tunnels/${encodeURIComponent(String(u[`gre-tunnel-id`]))}`,{body:Object.keys(_).length>0?_:void 0,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated`})}},Qn={command:`gre-tunnels`,describe:`GRE tunnel endpoints that connect your network to Cloudflare for Magic Transit`,builder:e=>e.command(Vn).command(Un).command(Gn).command(qn).command(Yn).command(Zn).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function $n(e){return e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const er={command:`bulk-update`,describe:"Update multiple IPsec tunnels associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:$n,handler:async c=>{let u={};if(c[`x-magic-new-hc-target`]!==void 0&&(u[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit ipsec-tunnels bulk-update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/ipsec_tunnels`,pathParams:{},bodyKind:`json`,body:c.body===void 0?void 0:l(c.body)});return}let d=await i(c),f=c.local?e:await t();if(c.accountId=f,c.body){let e=l(c.body);a(await s(`Updating`,async()=>r(d,`PUT`,`/accounts/${f}/magic/ipsec_tunnels`,{body:e,headers:Object.keys(u).length>0?u:void 0})),{successLabel:`Updated`});return}a(await s(`Updating`,async()=>r(d,`PUT`,`/accounts/${f}/magic/ipsec_tunnels`,{headers:Object.keys(u).length>0?u:void 0})),{successLabel:`Updated`})}};function tr(e){return e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`automatic-return-routing`,{type:`boolean`,description:"True if automatic stateful return routing should be enabled for a tunnel, false otherwise. Requires the `coupler_integration` account flag to be enabled; requests setting this to `true` without that flag will be rejected.",default:!1}).option(`bgp-customer-asn`,{type:`number`,description:`ASN used on the customer end of the BGP session`}).option(`bgp-export-filter-id`,{type:`string`,description:`ID of the BGP filter profile applied to routes advertised to the customer.`}).option(`bgp-extra-prefixes`,{type:`string`,array:!0,description:`Prefixes in this list will be advertised to the customer device, in addition to the routes in the Magic routing table.`}).option(`bgp-import-filter-id`,{type:`string`,description:`ID of the BGP filter profile applied to routes received from the customer.`}).option(`bgp-md5-key`,{type:`string`,description:`MD5 key to use for session authentication.
+
+Note that *this is not a security measure*. MD5 is not a valid security mechanism, and the
+key is not treated as a secret value. This is *only* supported for preventing
+misconfiguration, not for defending against malicious attacks.
+
+The MD5 key, if set, must be of non-zero length and consist only of the following types of
+character:
+
+* ASCII alphanumerics: \`[a-zA-Z0-9]\`
+* Special characters in the set \`'!@#$%^&*()+[]{}<>/.,;:_-~\`= \\|\`
+
+In other words, MD5 keys may contain any printable ASCII character aside from newline (0x0A),
+quotation mark (\`"\`), vertical tab (0x0B), carriage return (0x0D), tab (0x09), form feed
+(0x0C), and the question mark (\`?\`). Requests specifying an MD5 key with one or more of
+these disallowed characters will be rejected.`}).option(`cloudflare-endpoint`,{type:`string`,description:`The IP address assigned to the Cloudflare side of the IPsec tunnel.`}).option(`custom-remote-identities-fqdn-id`,{type:`string`,description:`A custom IKE ID of type FQDN that may be used to identity the IPsec tunnel. The
+generated IKE IDs can still be used even if this custom value is specified.
+
+Must be of the form \`<custom label>.<account ID>.custom.ipsec.cloudflare.com\`.
+
+This custom ID does not need to be unique. Two IPsec tunnels may have the same custom
+fqdn_id. However, if another IPsec tunnel has the same value then the two tunnels
+cannot have the same cloudflare_endpoint.`}).option(`customer-endpoint`,{type:`string`,description:`The IP address assigned to the customer side of the IPsec tunnel. Not required, but must be set for proactive traceroutes to work.`}).option(`description`,{type:`string`,description:`An optional description forthe IPsec tunnel.`}).option(`health-check-enabled`,{type:`boolean`,description:`Determines whether to run healthchecks for a tunnel.`}).option(`health-check-rate`,{type:`string`,description:"How frequent the health check is run. The default value is `mid`.",choices:[`low`,`mid`,`high`]}).option(`health-check-target-saved`,{type:`string`,description:`The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.`}).option(`health-check-type`,{type:`string`,description:"The type of healthcheck to run, reply or request. The default value is `reply`.",choices:[`reply`,`request`]}).option(`health-check-direction`,{type:`string`,description:`The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.`,choices:[`unidirectional`,`bidirectional`]}).option(`interface-address`,{type:`string`,description:`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`}).option(`interface-address6`,{type:`string`,description:`A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127`}).option(`name`,{type:`string`,description:`The name of the IPsec tunnel. The name cannot share a name with other tunnels.`}).option(`psk`,{type:`string`,description:`A randomly generated or provided string for use in the IPsec tunnel.`}).option(`replay-protection`,{type:`boolean`,description:"If `true`, then IPsec replay protection will be supported in the Cloudflare-to-customer direction.",default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`bgp-customer-asn`,`bgp-export-filter-id`,`bgp-extra-prefixes`,`bgp-import-filter-id`,`bgp-md5-key`].some(t=>e[t]!==void 0)){let t=[`bgp-customer-asn`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --bgp-* flag is set`)}return!0})}const nr={command:`create`,describe:"Creates a new IPsec tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:tr,handler:async u=>{let m={};if(u[`x-magic-new-hc-target`]!==void 0&&(m[`x-magic-new-hc-target`]=String(u[`x-magic-new-hc-target`])),u.dryRun){o({command:`cf magic-transit ipsec-tunnels create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/ipsec_tunnels`,pathParams:{},bodyKind:`json`,body:u.body===void 0?d({automatic_return_routing:u[`automatic-return-routing`],bgp:{customer_asn:u[`bgp-customer-asn`],export_filter_id:f(u[`bgp-export-filter-id`],`bgp-export-filter-id`,`text`),extra_prefixes:u[`bgp-extra-prefixes`],import_filter_id:f(u[`bgp-import-filter-id`],`bgp-import-filter-id`,`text`),md5_key:f(u[`bgp-md5-key`],`bgp-md5-key`,`text`)},cloudflare_endpoint:f(u[`cloudflare-endpoint`],`cloudflare-endpoint`,`text`),custom_remote_identities:{fqdn_id:f(u[`custom-remote-identities-fqdn-id`],`custom-remote-identities-fqdn-id`,`text`)},customer_endpoint:f(u[`customer-endpoint`],`customer-endpoint`,`text`),description:f(u.description,`description`,`text`),health_check:{enabled:u[`health-check-enabled`],rate:f(u[`health-check-rate`],`health-check-rate`,`text`),target:{saved:f(u[`health-check-target-saved`],`health-check-target-saved`,`text`)},type:f(u[`health-check-type`],`health-check-type`,`text`),direction:f(u[`health-check-direction`],`health-check-direction`,`text`)},interface_address:f(u[`interface-address`],`interface-address`,`text`),interface_address6:f(u[`interface-address6`],`interface-address6`,`text`),name:f(u.name,`name`,`text`),psk:f(u.psk,`psk`,`text`),replay_protection:u[`replay-protection`]}):l(u.body)});return}let h=await i(u),g=u.local?e:await t();if(u.accountId=g,u.body){let e=l(u.body);a(await s(`Creating`,async()=>r(h,`POST`,`/accounts/${g}/magic/ipsec_tunnels`,{body:e,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Created`});return}u[`cloudflare-endpoint`]===void 0&&(u[`cloudflare-endpoint`]=await p(`cloudflare-endpoint`,`The IP address assigned to the Cloudflare side of the IPsec tunnel.`)),u[`interface-address`]===void 0&&(u[`interface-address`]=await p(`interface-address`,`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`)),u.name===void 0&&(u.name=await p(`name`,`The name of the IPsec tunnel. The name cannot share a name with other tunnels.`));let _={};u[`automatic-return-routing`]!==void 0&&c(_,[`automatic_return_routing`],u[`automatic-return-routing`]),u[`bgp-customer-asn`]!==void 0&&c(_,[`bgp`,`customer_asn`],u[`bgp-customer-asn`]),u[`bgp-export-filter-id`]!==void 0&&c(_,[`bgp`,`export_filter_id`],f(u[`bgp-export-filter-id`],`bgp-export-filter-id`,`text`)),u[`bgp-extra-prefixes`]!==void 0&&c(_,[`bgp`,`extra_prefixes`],u[`bgp-extra-prefixes`]),u[`bgp-import-filter-id`]!==void 0&&c(_,[`bgp`,`import_filter_id`],f(u[`bgp-import-filter-id`],`bgp-import-filter-id`,`text`)),u[`bgp-md5-key`]!==void 0&&c(_,[`bgp`,`md5_key`],f(u[`bgp-md5-key`],`bgp-md5-key`,`text`)),u[`cloudflare-endpoint`]!==void 0&&c(_,[`cloudflare_endpoint`],f(u[`cloudflare-endpoint`],`cloudflare-endpoint`,`text`)),u[`custom-remote-identities-fqdn-id`]!==void 0&&c(_,[`custom_remote_identities`,`fqdn_id`],f(u[`custom-remote-identities-fqdn-id`],`custom-remote-identities-fqdn-id`,`text`)),u[`customer-endpoint`]!==void 0&&c(_,[`customer_endpoint`],f(u[`customer-endpoint`],`customer-endpoint`,`text`)),u.description!==void 0&&c(_,[`description`],f(u.description,`description`,`text`)),u[`health-check-enabled`]!==void 0&&c(_,[`health_check`,`enabled`],u[`health-check-enabled`]),u[`health-check-rate`]!==void 0&&c(_,[`health_check`,`rate`],f(u[`health-check-rate`],`health-check-rate`,`text`)),u[`health-check-target-saved`]!==void 0&&c(_,[`health_check`,`target`,`saved`],f(u[`health-check-target-saved`],`health-check-target-saved`,`text`)),u[`health-check-type`]!==void 0&&c(_,[`health_check`,`type`],f(u[`health-check-type`],`health-check-type`,`text`)),u[`health-check-direction`]!==void 0&&c(_,[`health_check`,`direction`],f(u[`health-check-direction`],`health-check-direction`,`text`)),u[`interface-address`]!==void 0&&c(_,[`interface_address`],f(u[`interface-address`],`interface-address`,`text`)),u[`interface-address6`]!==void 0&&c(_,[`interface_address6`],f(u[`interface-address6`],`interface-address6`,`text`)),u.name!==void 0&&c(_,[`name`],f(u.name,`name`,`text`)),u.psk!==void 0&&c(_,[`psk`],f(u.psk,`psk`,`text`)),u[`replay-protection`]!==void 0&&c(_,[`replay_protection`],u[`replay-protection`]),a(await s(`Creating`,async()=>r(h,`POST`,`/accounts/${g}/magic/ipsec_tunnels`,{body:Object.keys(_).length>0?_:void 0,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Created`})}};function rr(e){return e.positional(`ipsec-tunnel-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const ir={command:`delete <ipsec-tunnel-id>`,describe:"Disables and removes a specific static IPsec Tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:rr,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit ipsec-tunnels delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/ipsec_tunnels/${c[`ipsec-tunnel-id`]==null?`<ipsec-tunnel-id>`:encodeURIComponent(String(c[`ipsec-tunnel-id`]))}`,pathParams:{"ipsec-tunnel-id":String(c[`ipsec-tunnel-id`]??``)},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();if(c.accountId=d,!await h({force:!!c.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>r(u,`DELETE`,`/accounts/${d}/magic/ipsec_tunnels/${encodeURIComponent(String(c[`ipsec-tunnel-id`]))}`,{headers:Object.keys(l).length>0?l:void 0})),{successLabel:`Deleted`})}};function ar(e){return e.positional(`ipsec-tunnel-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const or={command:`get <ipsec-tunnel-id>`,describe:`Lists details for a specific IPsec tunnel.`,builder:ar,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit ipsec-tunnels get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/ipsec_tunnels/${c[`ipsec-tunnel-id`]==null?`<ipsec-tunnel-id>`:encodeURIComponent(String(c[`ipsec-tunnel-id`]))}`,pathParams:{"ipsec-tunnel-id":String(c[`ipsec-tunnel-id`]??``)},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();c.accountId=d,a(await s(`Loading`,async()=>r(u,`GET`,`/accounts/${d}/magic/ipsec_tunnels/${encodeURIComponent(String(c[`ipsec-tunnel-id`]))}`,{headers:Object.keys(l).length>0?l:void 0})),{successLabel:`Loaded`})}};function sr(e){return e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const cr={command:`list`,describe:`Lists IPsec tunnels associated with an account.`,builder:sr,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit ipsec-tunnels list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/ipsec_tunnels`,pathParams:{},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();c.accountId=d,a(await s(`Loading`,async()=>r(u,`GET`,`/accounts/${d}/magic/ipsec_tunnels`,{headers:Object.keys(l).length>0?l:void 0})),{successLabel:`Loaded`})}};function lr(e){return e.positional(`ipsec-tunnel-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ur={command:`psk-generate <ipsec-tunnel-id>`,describe:"Generates a Pre-Shared Key for a specific IPsec tunnel used in the IKE session. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. After a PSK is generated, the PSK is immediately persisted to Cloudflare's edge and cannot be retrieved later. Store the PSK in a safe place.",builder:lr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit ipsec-tunnels psk-generate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/ipsec_tunnels/${r[`ipsec-tunnel-id`]==null?`<ipsec-tunnel-id>`:encodeURIComponent(String(r[`ipsec-tunnel-id`]))}/psk_generate`,pathParams:{"ipsec-tunnel-id":String(r[`ipsec-tunnel-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Creating`,async()=>c.magicTransit.ipsecTunnels.pskGenerate({account_id:l,ipsec_tunnel_id:r[`ipsec-tunnel-id`]})),{successLabel:`Created`})}};function dr(e){return e.option(`validate-only`,{type:`boolean`,description:"If `true`, only run validation without persisting changes."}).option(`psks`,{type:`string`,description:`List of tunnel ID and PSK pairs. Provide as a JSON array of objects or @path/to/file.json.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Request body for setting PSKs for multiple IPsec tunnels.`})}const fr={command:`psk-set`,describe:"Sets Pre-Shared Keys for multiple IPsec tunnels associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. After PSKs are applied, they are immediately persisted to Cloudflare's edge and cannot be retrieved later. Store the PSKs in a safe place.",builder:dr,handler:async r=>{let c={validate_only:r[`validate-only`]};if(r.dryRun){o({command:`cf magic-transit ipsec-tunnels psk-set`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/ipsec_tunnels/psk`,pathParams:{},query:c,bodyKind:`json`,body:r.body===void 0?d({psks:u(r.psks,`psks`)}):l(r.body)});return}let f=await i(r),p=r.local?e:await t();if(r.accountId=p,r.body){let e=l(r.body);new URLSearchParams(Object.entries(c).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString(),a(await s(`Creating`,async()=>f.magicTransit.ipsecTunnels.pskSet({...e,account_id:p,...c})),{successLabel:`Created`});return}if(r.psks===void 0)throw Error(`--psks is required (or pass --body with this field set).`);let m=d({psks:u(r.psks,`psks`)});new URLSearchParams(Object.entries(c).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString(),a(await s(`Creating`,async()=>f.magicTransit.ipsecTunnels.pskSet({...m,account_id:p,...c})),{successLabel:`Created`})}};function pr(e){return e.positional(`ipsec-tunnel-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`automatic-return-routing`,{type:`boolean`,description:"True if automatic stateful return routing should be enabled for a tunnel, false otherwise. Requires the `coupler_integration` account flag to be enabled; requests setting this to `true` without that flag will be rejected."}).option(`bgp-customer-asn`,{type:`number`,description:`ASN used on the customer end of the BGP session`}).option(`bgp-export-filter-id`,{type:`string`,description:`ID of the BGP filter profile applied to routes advertised to the customer.`}).option(`bgp-extra-prefixes`,{type:`string`,array:!0,description:`Prefixes in this list will be advertised to the customer device, in addition to the routes in the Magic routing table.`}).option(`bgp-import-filter-id`,{type:`string`,description:`ID of the BGP filter profile applied to routes received from the customer.`}).option(`bgp-md5-key`,{type:`string`,description:`MD5 key to use for session authentication.
+
+Note that *this is not a security measure*. MD5 is not a valid security mechanism, and the
+key is not treated as a secret value. This is *only* supported for preventing
+misconfiguration, not for defending against malicious attacks.
+
+The MD5 key, if set, must be of non-zero length and consist only of the following types of
+character:
+
+* ASCII alphanumerics: \`[a-zA-Z0-9]\`
+* Special characters in the set \`'!@#$%^&*()+[]{}<>/.,;:_-~\`= \\|\`
+
+In other words, MD5 keys may contain any printable ASCII character aside from newline (0x0A),
+quotation mark (\`"\`), vertical tab (0x0B), carriage return (0x0D), tab (0x09), form feed
+(0x0C), and the question mark (\`?\`). Requests specifying an MD5 key with one or more of
+these disallowed characters will be rejected.`}).option(`cloudflare-endpoint`,{type:`string`,description:`The IP address assigned to the Cloudflare side of the IPsec tunnel.`}).option(`custom-remote-identities-fqdn-id`,{type:`string`,description:`A custom IKE ID of type FQDN that may be used to identity the IPsec tunnel. The
+generated IKE IDs can still be used even if this custom value is specified.
+
+Must be of the form \`<custom label>.<account ID>.custom.ipsec.cloudflare.com\`.
+
+This custom ID does not need to be unique. Two IPsec tunnels may have the same custom
+fqdn_id. However, if another IPsec tunnel has the same value then the two tunnels
+cannot have the same cloudflare_endpoint.`}).option(`customer-endpoint`,{type:`string`,description:`The IP address assigned to the customer side of the IPsec tunnel. Not required, but must be set for proactive traceroutes to work.`}).option(`description`,{type:`string`,description:`An optional description forthe IPsec tunnel.`}).option(`health-check-enabled`,{type:`boolean`,description:`Determines whether to run healthchecks for a tunnel.`}).option(`health-check-rate`,{type:`string`,description:"How frequent the health check is run. The default value is `mid`.",choices:[`low`,`mid`,`high`]}).option(`health-check-target-saved`,{type:`string`,description:`The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.`}).option(`health-check-type`,{type:`string`,description:"The type of healthcheck to run, reply or request. The default value is `reply`.",choices:[`reply`,`request`]}).option(`health-check-direction`,{type:`string`,description:`The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.`,choices:[`unidirectional`,`bidirectional`]}).option(`interface-address`,{type:`string`,description:`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`}).option(`interface-address6`,{type:`string`,description:`A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127`}).option(`name`,{type:`string`,description:`The name of the IPsec tunnel. The name cannot share a name with other tunnels.`}).option(`psk`,{type:`string`,description:`A randomly generated or provided string for use in the IPsec tunnel.`}).option(`replay-protection`,{type:`boolean`,description:"If `true`, then IPsec replay protection will be supported in the Cloudflare-to-customer direction."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`bgp-customer-asn`,`bgp-export-filter-id`,`bgp-extra-prefixes`,`bgp-import-filter-id`,`bgp-md5-key`].some(t=>e[t]!==void 0)){let t=[`bgp-customer-asn`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --bgp-* flag is set`)}return!0})}const mr={command:`update <ipsec-tunnel-id>`,describe:"Updates a specific IPsec tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:pr,handler:async u=>{let m={};if(u[`x-magic-new-hc-target`]!==void 0&&(m[`x-magic-new-hc-target`]=String(u[`x-magic-new-hc-target`])),u.dryRun){o({command:`cf magic-transit ipsec-tunnels update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/ipsec_tunnels/${u[`ipsec-tunnel-id`]==null?`<ipsec-tunnel-id>`:encodeURIComponent(String(u[`ipsec-tunnel-id`]))}`,pathParams:{"ipsec-tunnel-id":String(u[`ipsec-tunnel-id`]??``)},bodyKind:`json`,body:u.body===void 0?d({automatic_return_routing:u[`automatic-return-routing`],bgp:{customer_asn:u[`bgp-customer-asn`],export_filter_id:f(u[`bgp-export-filter-id`],`bgp-export-filter-id`,`text`),extra_prefixes:u[`bgp-extra-prefixes`],import_filter_id:f(u[`bgp-import-filter-id`],`bgp-import-filter-id`,`text`),md5_key:f(u[`bgp-md5-key`],`bgp-md5-key`,`text`)},cloudflare_endpoint:f(u[`cloudflare-endpoint`],`cloudflare-endpoint`,`text`),custom_remote_identities:{fqdn_id:f(u[`custom-remote-identities-fqdn-id`],`custom-remote-identities-fqdn-id`,`text`)},customer_endpoint:f(u[`customer-endpoint`],`customer-endpoint`,`text`),description:f(u.description,`description`,`text`),health_check:{enabled:u[`health-check-enabled`],rate:f(u[`health-check-rate`],`health-check-rate`,`text`),target:{saved:f(u[`health-check-target-saved`],`health-check-target-saved`,`text`)},type:f(u[`health-check-type`],`health-check-type`,`text`),direction:f(u[`health-check-direction`],`health-check-direction`,`text`)},interface_address:f(u[`interface-address`],`interface-address`,`text`),interface_address6:f(u[`interface-address6`],`interface-address6`,`text`),name:f(u.name,`name`,`text`),psk:f(u.psk,`psk`,`text`),replay_protection:u[`replay-protection`]}):l(u.body)});return}let h=await i(u),g=u.local?e:await t();if(u.accountId=g,u.body){let e=l(u.body);a(await s(`Updating`,async()=>r(h,`PUT`,`/accounts/${g}/magic/ipsec_tunnels/${encodeURIComponent(String(u[`ipsec-tunnel-id`]))}`,{body:e,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated`});return}u[`cloudflare-endpoint`]===void 0&&(u[`cloudflare-endpoint`]=await p(`cloudflare-endpoint`,`The IP address assigned to the Cloudflare side of the IPsec tunnel.`)),u[`interface-address`]===void 0&&(u[`interface-address`]=await p(`interface-address`,`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`)),u.name===void 0&&(u.name=await p(`name`,`The name of the IPsec tunnel. The name cannot share a name with other tunnels.`));let _={};u[`automatic-return-routing`]!==void 0&&c(_,[`automatic_return_routing`],u[`automatic-return-routing`]),u[`bgp-customer-asn`]!==void 0&&c(_,[`bgp`,`customer_asn`],u[`bgp-customer-asn`]),u[`bgp-export-filter-id`]!==void 0&&c(_,[`bgp`,`export_filter_id`],f(u[`bgp-export-filter-id`],`bgp-export-filter-id`,`text`)),u[`bgp-extra-prefixes`]!==void 0&&c(_,[`bgp`,`extra_prefixes`],u[`bgp-extra-prefixes`]),u[`bgp-import-filter-id`]!==void 0&&c(_,[`bgp`,`import_filter_id`],f(u[`bgp-import-filter-id`],`bgp-import-filter-id`,`text`)),u[`bgp-md5-key`]!==void 0&&c(_,[`bgp`,`md5_key`],f(u[`bgp-md5-key`],`bgp-md5-key`,`text`)),u[`cloudflare-endpoint`]!==void 0&&c(_,[`cloudflare_endpoint`],f(u[`cloudflare-endpoint`],`cloudflare-endpoint`,`text`)),u[`custom-remote-identities-fqdn-id`]!==void 0&&c(_,[`custom_remote_identities`,`fqdn_id`],f(u[`custom-remote-identities-fqdn-id`],`custom-remote-identities-fqdn-id`,`text`)),u[`customer-endpoint`]!==void 0&&c(_,[`customer_endpoint`],f(u[`customer-endpoint`],`customer-endpoint`,`text`)),u.description!==void 0&&c(_,[`description`],f(u.description,`description`,`text`)),u[`health-check-enabled`]!==void 0&&c(_,[`health_check`,`enabled`],u[`health-check-enabled`]),u[`health-check-rate`]!==void 0&&c(_,[`health_check`,`rate`],f(u[`health-check-rate`],`health-check-rate`,`text`)),u[`health-check-target-saved`]!==void 0&&c(_,[`health_check`,`target`,`saved`],f(u[`health-check-target-saved`],`health-check-target-saved`,`text`)),u[`health-check-type`]!==void 0&&c(_,[`health_check`,`type`],f(u[`health-check-type`],`health-check-type`,`text`)),u[`health-check-direction`]!==void 0&&c(_,[`health_check`,`direction`],f(u[`health-check-direction`],`health-check-direction`,`text`)),u[`interface-address`]!==void 0&&c(_,[`interface_address`],f(u[`interface-address`],`interface-address`,`text`)),u[`interface-address6`]!==void 0&&c(_,[`interface_address6`],f(u[`interface-address6`],`interface-address6`,`text`)),u.name!==void 0&&c(_,[`name`],f(u.name,`name`,`text`)),u.psk!==void 0&&c(_,[`psk`],f(u.psk,`psk`,`text`)),u[`replay-protection`]!==void 0&&c(_,[`replay_protection`],u[`replay-protection`]),a(await s(`Updating`,async()=>r(h,`PUT`,`/accounts/${g}/magic/ipsec_tunnels/${encodeURIComponent(String(u[`ipsec-tunnel-id`]))}`,{body:Object.keys(_).length>0?_:void 0,headers:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated`})}},hr={command:`ipsec-tunnels`,describe:`IPsec tunnel endpoints with pre-shared key management for encrypted transit`,builder:e=>e.command(er).command(nr).command(ir).command(or).command(cr).command(ur).command(fr).command(mr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function gr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const _r={command:`create`,describe:`Create new PCAP request for account.`,builder:gr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit pcaps create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/pcaps`,pathParams:{},bodyKind:`json`,body:r.body===void 0?void 0:l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.pcaps.create({body:e,account_id:u})),{successLabel:`Created`});return}if(r.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}};function vr(e){return e.positional(`pcap-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`text`,{type:`boolean`,description:`Decode the response body as UTF-8 text instead of writing raw bytes`,default:!1})}const yr={command:`get <pcap-id>`,describe:`Download PCAP information into a file. Response is a binary PCAP file.`,builder:vr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit pcaps download get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/pcaps/${r[`pcap-id`]==null?`<pcap-id>`:encodeURIComponent(String(r[`pcap-id`]))}/download`,pathParams:{"pcap-id":String(r[`pcap-id`]??``)},bodyKind:`none`});return}await i(r);let a=r.local?e:await t();r.accountId=a;let c=await s(`Loading`,async()=>_(`/accounts/${a}/pcaps/${encodeURIComponent(String(r[`pcap-id`]))}/download`,{method:`GET`,local:r.local===!0,persistTo:r.persistTo}));g(r.text===!0?c.toString(`utf-8`):c)}},br={command:`download`,describe:`Operations for pcaps.download`,builder:e=>e.command(yr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function xr(e){return e.positional(`pcap-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sr={command:`get <pcap-id>`,describe:`Get information for a PCAP request by id.`,builder:xr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit pcaps get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/pcaps/${r[`pcap-id`]==null?`<pcap-id>`:encodeURIComponent(String(r[`pcap-id`]))}`,pathParams:{"pcap-id":String(r[`pcap-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.pcaps.get({account_id:l,pcap_id:r[`pcap-id`]})),{successLabel:`Loaded`})}};function Cr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wr={command:`list`,describe:`Lists all packet capture requests for an account.`,builder:Cr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit pcaps list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/pcaps`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.pcaps.list({account_id:l})),{successLabel:`Loaded`})}};function Tr(e){return e.option(`destination-conf`,{type:`string`,description:"The full URI for the bucket. This field only applies to `full` packet captures."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Er={command:`create`,describe:`Adds an AWS or GCP bucket to use with full packet captures.`,builder:Tr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit pcaps ownership create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/pcaps/ownership`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({destination_conf:f(r[`destination-conf`],`destination-conf`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.pcaps.ownership.create({...e,account_id:u})),{successLabel:`Created`});return}r[`destination-conf`]===void 0&&(r[`destination-conf`]=await p(`destination-conf`,"The full URI for the bucket. This field only applies to `full` packet captures."));let m=d({destination_conf:f(r[`destination-conf`],`destination-conf`,`text`)});a(await s(`Creating`,async()=>c.magicTransit.pcaps.ownership.create({...m,account_id:u})),{successLabel:`Created`})}};function Dr(e){return e.positional(`ownership-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Or={command:`delete <ownership-id>`,describe:`Deletes buckets added to the packet captures API.`,builder:Dr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit pcaps ownership delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/pcaps/ownership/${r[`ownership-id`]==null?`<ownership-id>`:encodeURIComponent(String(r[`ownership-id`]))}`,pathParams:{"ownership-id":String(r[`ownership-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.pcaps.ownership.delete({account_id:l,ownership_id:r[`ownership-id`]})),{successLabel:`Deleted`})}};function kr(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ar={command:`get`,describe:`List all buckets configured for use with PCAPs API.`,builder:kr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit pcaps ownership get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/pcaps/ownership`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.pcaps.ownership.get({account_id:l})),{successLabel:`Loaded`})}};function jr(e){return e.option(`destination-conf`,{type:`string`,description:"The full URI for the bucket. This field only applies to `full` packet captures."}).option(`ownership-challenge`,{type:`string`,description:`The ownership challenge filename stored in the bucket.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Mr={command:`validate`,describe:`Validates buckets added to the packet captures API.`,builder:jr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit pcaps ownership validate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/pcaps/ownership/validate`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({destination_conf:f(r[`destination-conf`],`destination-conf`,`text`),ownership_challenge:f(r[`ownership-challenge`],`ownership-challenge`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.pcaps.ownership.validate({...e,account_id:u})),{successLabel:`Created`});return}r[`destination-conf`]===void 0&&(r[`destination-conf`]=await p(`destination-conf`,"The full URI for the bucket. This field only applies to `full` packet captures.")),r[`ownership-challenge`]===void 0&&(r[`ownership-challenge`]=await p(`ownership-challenge`,`The ownership challenge filename stored in the bucket.`));let m=d({destination_conf:f(r[`destination-conf`],`destination-conf`,`text`),ownership_challenge:f(r[`ownership-challenge`],`ownership-challenge`,`text`)});a(await s(`Creating`,async()=>c.magicTransit.pcaps.ownership.validate({...m,account_id:u})),{successLabel:`Created`})}},Nr={command:`ownership`,describe:`Operations for pcaps.ownership`,builder:e=>e.command(Er).command(Or).command(Ar).command(Mr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Pr(e){return e.positional(`pcap-id`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Fr={command:`stop <pcap-id>`,describe:`Stop full PCAP.`,builder:Pr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit pcaps stop`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/pcaps/${r[`pcap-id`]==null?`<pcap-id>`:encodeURIComponent(String(r[`pcap-id`]))}/stop`,pathParams:{"pcap-id":String(r[`pcap-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force,message:`This operation halts an in-progress full packet capture. Any unsaved capture data will be lost.`})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.pcaps.stop({account_id:l,pcap_id:r[`pcap-id`]})),{successLabel:`Deleted`})}},Ir={command:`pcaps`,describe:`Operations for pcaps`,builder:e=>e.command(_r).command(Sr).command(wr).command(Fr).command(br).command(Nr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Lr(e){return e.option(`description`,{type:`string`,description:`Optional description`,default:``}).option(`members`,{type:`string`,description:`Tunnels to add to the group. Provide as a JSON array of objects or @path/to/file.json.`}).option(`name`,{type:`string`,description:`Human-readable name for the redundancy group`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Rr={command:`create`,describe:`Creates a new redundancy group, optionally with tunnel members.`,builder:Lr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit redundancy-groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/redundancy_groups`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),members:u(r.members,`members`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let c=await i(r),m=r.local?e:await t();if(r.accountId=m,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.redundancyGroups.create({body:e,account_id:m})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await p(`name`,`Human-readable name for the redundancy group`));let h=d({description:f(r.description,`description`,`text`),members:u(r.members,`members`),name:f(r.name,`name`,`text`)});a(await s(`Creating`,async()=>c.magicTransit.redundancyGroups.create({body:h,account_id:m})),{successLabel:`Created`})}};function zr(e){return e.positional(`redundancy-group-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Br={command:`delete <redundancy-group-id>`,describe:`Deletes a redundancy group. Member tunnels are not deleted — their redundancy_group_id is cleared.`,builder:zr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit redundancy-groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/redundancy_groups/${r[`redundancy-group-id`]==null?`<redundancy-group-id>`:encodeURIComponent(String(r[`redundancy-group-id`]))}`,pathParams:{"redundancy-group-id":String(r[`redundancy-group-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.redundancyGroups.delete({account_id:l,redundancy_group_id:r[`redundancy-group-id`]})),{successLabel:`Deleted`})}};function Vr(e){return e.positional(`redundancy-group-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Hr={command:`get <redundancy-group-id>`,describe:`Gets details for a specific redundancy group, including full member tunnel data.`,builder:Vr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit redundancy-groups get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/redundancy_groups/${r[`redundancy-group-id`]==null?`<redundancy-group-id>`:encodeURIComponent(String(r[`redundancy-group-id`]))}`,pathParams:{"redundancy-group-id":String(r[`redundancy-group-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.redundancyGroups.get({account_id:l,redundancy_group_id:r[`redundancy-group-id`]})),{successLabel:`Loaded`})}};function Ur(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Wr={command:`list`,describe:`Lists redundancy groups associated with an account, including full member tunnel data.`,builder:Ur,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit redundancy-groups list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/redundancy_groups`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.redundancyGroups.list({account_id:l})),{successLabel:`Loaded`})}};function Gr(e){return e.positional(`redundancy-group-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`description`,{type:`string`,description:`Optional description`}).option(`members`,{type:`string`,description:`Tunnels to add to the group. Provide as a JSON array of objects or @path/to/file.json.`}).option(`name`,{type:`string`,description:`Human-readable name for the redundancy group`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Kr={command:`update <redundancy-group-id>`,describe:`Replaces the name, description, and full set of members for an existing redundancy group.`,builder:Gr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit redundancy-groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/redundancy_groups/${r[`redundancy-group-id`]==null?`<redundancy-group-id>`:encodeURIComponent(String(r[`redundancy-group-id`]))}`,pathParams:{"redundancy-group-id":String(r[`redundancy-group-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),members:u(r.members,`members`),name:f(r.name,`name`,`text`)}):l(r.body)});return}let c=await i(r),m=r.local?e:await t();if(r.accountId=m,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.redundancyGroups.update({body:e,account_id:m,redundancy_group_id:r[`redundancy-group-id`]})),{successLabel:`Updated`});return}r.name===void 0&&(r.name=await p(`name`,`Human-readable name for the redundancy group`));let h=d({description:f(r.description,`description`,`text`),members:u(r.members,`members`),name:f(r.name,`name`,`text`)});a(await s(`Updating`,async()=>c.magicTransit.redundancyGroups.update({body:h,account_id:m,redundancy_group_id:r[`redundancy-group-id`]})),{successLabel:`Updated`})}},qr={command:`redundancy-groups`,describe:`Operations for redundancy-groups`,builder:e=>e.command(Rr).command(Br).command(Hr).command(Wr).command(Kr).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Jr(e){return e.option(`routes`,{type:`string`,description:`The routes field. Provide as a JSON array of objects or @path/to/file.json.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Yr={command:`bulk-update`,describe:"Update multiple Magic static routes. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes. Only fields for a route that need to be changed need be provided.",builder:Jr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit routes bulk-update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/routes`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({routes:u(r.routes,`routes`)}):l(r.body)});return}let c=await i(r),f=r.local?e:await t();if(r.accountId=f,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.routes.bulkUpdate({...e,account_id:f})),{successLabel:`Updated`});return}if(r.routes===void 0)throw Error(`--routes is required (or pass --body with this field set).`);let p=d({routes:u(r.routes,`routes`)});a(await s(`Updating`,async()=>c.magicTransit.routes.bulkUpdate({...p,account_id:f})),{successLabel:`Updated`})}};function Xr(e){return e.option(`description`,{type:`string`,description:`An optional human provided description of the static route.`}).option(`nexthop`,{type:`string`,description:`The next-hop IP Address for the static route.`}).option(`prefix`,{type:`string`,description:`IP Prefix in Classless Inter-Domain Routing format.`}).option(`priority`,{type:`number`,description:`Priority of the static route.`}).option(`scope-colo-names`,{type:`string`,array:!0,description:`List of colo names for the ECMP scope.`}).option(`scope-colo-regions`,{type:`string`,array:!0,description:`List of colo regions for the ECMP scope.`}).option(`weight`,{type:`number`,description:`Optional weight of the ECMP scope - if provided.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Zr={command:`create`,describe:"Creates a new Magic static route. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes.",builder:Xr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit routes create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/routes`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),nexthop:f(r.nexthop,`nexthop`,`text`),prefix:f(r.prefix,`prefix`,`text`),priority:r.priority,scope:{colo_names:r[`scope-colo-names`],colo_regions:r[`scope-colo-regions`]},weight:r.weight}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.routes.create({...e,account_id:u})),{successLabel:`Created`});return}if(r.nexthop===void 0&&(r.nexthop=await p(`nexthop`,`The next-hop IP Address for the static route.`)),r.prefix===void 0&&(r.prefix=await p(`prefix`,`IP Prefix in Classless Inter-Domain Routing format.`)),r.priority===void 0)throw Error(`--priority is required (or pass --body with this field set).`);let m=d({description:f(r.description,`description`,`text`),nexthop:f(r.nexthop,`nexthop`,`text`),prefix:f(r.prefix,`prefix`,`text`),priority:r.priority,scope:{colo_names:r[`scope-colo-names`],colo_regions:r[`scope-colo-regions`]},weight:r.weight});a(await s(`Creating`,async()=>c.magicTransit.routes.create({...m,account_id:u})),{successLabel:`Created`})}};function Qr(e){return e.positional(`route-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const $r={command:`delete <route-id>`,describe:`Disable and remove a specific Magic static route.`,builder:Qr,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit routes delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/routes/${r[`route-id`]==null?`<route-id>`:encodeURIComponent(String(r[`route-id`]))}`,pathParams:{"route-id":String(r[`route-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.routes.delete({account_id:l,route_id:r[`route-id`]})),{successLabel:`Deleted`})}};function ei(e){return e.option(`routes`,{type:`string`,description:`The routes field. Provide as a JSON array of objects or @path/to/file.json.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ti={command:`empty`,describe:`Delete multiple Magic static routes.`,builder:ei,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit routes empty`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/routes`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({routes:u(r.routes,`routes`)}):l(r.body)});return}let c=await i(r),f=r.local?e:await t();if(r.accountId=f,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}if(r.body){let e=l(r.body);a(await s(`Deleting`,async()=>c.magicTransit.routes.empty({...e,account_id:f})),{successLabel:`Deleted`});return}if(r.routes===void 0)throw Error(`--routes is required (or pass --body with this field set).`);let p=d({routes:u(r.routes,`routes`)});a(await s(`Deleting`,async()=>c.magicTransit.routes.empty({...p,account_id:f})),{successLabel:`Deleted`})}};function ni(e){return e.positional(`route-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ri={command:`get <route-id>`,describe:`Get a specific Magic static route.`,builder:ni,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit routes get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/routes/${r[`route-id`]==null?`<route-id>`:encodeURIComponent(String(r[`route-id`]))}`,pathParams:{"route-id":String(r[`route-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.routes.get({account_id:l,route_id:r[`route-id`]})),{successLabel:`Loaded`})}};function ii(e){return e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ai={command:`list`,describe:`List all Magic static routes.`,builder:ii,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit routes list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/routes`,pathParams:{},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.routes.list({account_id:l})),{successLabel:`Loaded`})}};function oi(e){return e.positional(`route-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`description`,{type:`string`,description:`An optional human provided description of the static route.`}).option(`nexthop`,{type:`string`,description:`The next-hop IP Address for the static route.`}).option(`prefix`,{type:`string`,description:`IP Prefix in Classless Inter-Domain Routing format.`}).option(`priority`,{type:`number`,description:`Priority of the static route.`}).option(`scope-colo-names`,{type:`string`,array:!0,description:`List of colo names for the ECMP scope.`}).option(`scope-colo-regions`,{type:`string`,array:!0,description:`List of colo regions for the ECMP scope.`}).option(`weight`,{type:`number`,description:`Optional weight of the ECMP scope - if provided.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const si={command:`update <route-id>`,describe:"Update a specific Magic static route. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes.",builder:oi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit routes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/routes/${r[`route-id`]==null?`<route-id>`:encodeURIComponent(String(r[`route-id`]))}`,pathParams:{"route-id":String(r[`route-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),nexthop:f(r.nexthop,`nexthop`,`text`),prefix:f(r.prefix,`prefix`,`text`),priority:r.priority,scope:{colo_names:r[`scope-colo-names`],colo_regions:r[`scope-colo-regions`]},weight:r.weight}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.routes.update({body:e,account_id:u,route_id:r[`route-id`]})),{successLabel:`Updated`});return}if(r.nexthop===void 0&&(r.nexthop=await p(`nexthop`,`The next-hop IP Address for the static route.`)),r.prefix===void 0&&(r.prefix=await p(`prefix`,`IP Prefix in Classless Inter-Domain Routing format.`)),r.priority===void 0)throw Error(`--priority is required (or pass --body with this field set).`);let m=d({description:f(r.description,`description`,`text`),nexthop:f(r.nexthop,`nexthop`,`text`),prefix:f(r.prefix,`prefix`,`text`),priority:r.priority,scope:{colo_names:r[`scope-colo-names`],colo_regions:r[`scope-colo-regions`]},weight:r.weight});a(await s(`Updating`,async()=>c.magicTransit.routes.update({body:m,account_id:u,route_id:r[`route-id`]})),{successLabel:`Updated`})}},ci={command:`routes`,describe:`Static routes that direct IP prefix traffic through specific GRE/IPsec tunnels`,builder:e=>e.command(Yr).command(Zr).command($r).command(ti).command(ri).command(ai).command(si).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function li(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`description`,{type:`string`,description:`Description for the ACL.`}).option(`forward-locally`,{type:`boolean`,description:`The desired forwarding action for this ACL policy. If set to "false", the policy will forward traffic to Cloudflare. If set to "true", the policy will forward traffic locally on the Magic Connector. If not included in request, will default to false.`}).option(`lan-1-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-1-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-1-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-1-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-2-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-2-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`name`,{type:`string`,description:`The name of the ACL.`}).option(`protocols`,{type:`string`,array:!0,description:`The protocols field`}).option(`unidirectional`,{type:`boolean`,description:`The desired traffic direction for this ACL policy. If set to "false", the policy will allow bidirectional traffic. If set to "true", the policy will only allow traffic in one direction. If not included in request, will default to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Bidirectional ACL policy for local network traffic within a site.`})}const ui={command:`create <site-id>`,describe:`Creates a new Site ACL.`,builder:li,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites acls create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/acls`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),forward_locally:r[`forward-locally`],lan_1:{lan_id:f(r[`lan-1-lan-id`],`lan-1-lan-id`,`text`),lan_name:f(r[`lan-1-lan-name`],`lan-1-lan-name`,`text`),port_ranges:r[`lan-1-port-ranges`],ports:r[`lan-1-ports`]},lan_2:{lan_id:f(r[`lan-2-lan-id`],`lan-2-lan-id`,`text`),lan_name:f(r[`lan-2-lan-name`],`lan-2-lan-name`,`text`),port_ranges:r[`lan-2-port-ranges`],ports:r[`lan-2-ports`]},name:f(r.name,`name`,`text`),protocols:r.protocols,unidirectional:r.unidirectional}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.sites.acls.create({...e,account_id:u,site_id:r[`site-id`]})),{successLabel:`Created`});return}r[`lan-1-lan-id`]===void 0&&(r[`lan-1-lan-id`]=await p(`lan-1-lan-id`,`The identifier for the LAN you want to create an ACL policy with.`)),r[`lan-2-lan-id`]===void 0&&(r[`lan-2-lan-id`]=await p(`lan-2-lan-id`,`The identifier for the LAN you want to create an ACL policy with.`)),r.name===void 0&&(r.name=await p(`name`,`The name of the ACL.`));let m=d({description:f(r.description,`description`,`text`),forward_locally:r[`forward-locally`],lan_1:{lan_id:f(r[`lan-1-lan-id`],`lan-1-lan-id`,`text`),lan_name:f(r[`lan-1-lan-name`],`lan-1-lan-name`,`text`),port_ranges:r[`lan-1-port-ranges`],ports:r[`lan-1-ports`]},lan_2:{lan_id:f(r[`lan-2-lan-id`],`lan-2-lan-id`,`text`),lan_name:f(r[`lan-2-lan-name`],`lan-2-lan-name`,`text`),port_ranges:r[`lan-2-port-ranges`],ports:r[`lan-2-ports`]},name:f(r.name,`name`,`text`),protocols:r.protocols,unidirectional:r.unidirectional});a(await s(`Creating`,async()=>c.magicTransit.sites.acls.create({...m,account_id:u,site_id:r[`site-id`]})),{successLabel:`Created`})}};function di(e){return e.positional(`acl-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const fi={command:`delete <acl-id>`,describe:`Remove a specific Site ACL.`,builder:di,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites acls delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/acls/${r[`acl-id`]==null?`<acl-id>`:encodeURIComponent(String(r[`acl-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"acl-id":String(r[`acl-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.sites.acls.delete({account_id:l,site_id:r[`site-id`],acl_id:r[`acl-id`]})),{successLabel:`Deleted`})}};function pi(e){return e.positional(`acl-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`description`,{type:`string`,description:`Description for the ACL.`}).option(`forward-locally`,{type:`boolean`,description:`The desired forwarding action for this ACL policy. If set to "false", the policy will forward traffic to Cloudflare. If set to "true", the policy will forward traffic locally on the Magic Connector. If not included in request, will default to false.`}).option(`lan-1-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-1-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-1-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-1-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-2-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-2-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`name`,{type:`string`,description:`The name of the ACL.`}).option(`protocols`,{type:`string`,array:!0,description:`The protocols field`}).option(`unidirectional`,{type:`boolean`,description:`The desired traffic direction for this ACL policy. If set to "false", the policy will allow bidirectional traffic. If set to "true", the policy will only allow traffic in one direction. If not included in request, will default to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`lan-1-lan-id`,`lan-1-lan-name`,`lan-1-port-ranges`,`lan-1-ports`].some(t=>e[t]!==void 0)){let t=[`lan-1-lan-id`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --lan_1-* flag is set`)}return!0}).check(e=>{if([`lan-2-lan-id`,`lan-2-lan-name`,`lan-2-port-ranges`,`lan-2-ports`].some(t=>e[t]!==void 0)){let t=[`lan-2-lan-id`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --lan_2-* flag is set`)}return!0})}const mi={command:`edit <acl-id>`,describe:`Patch a specific Site ACL.`,builder:pi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites acls edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/acls/${r[`acl-id`]==null?`<acl-id>`:encodeURIComponent(String(r[`acl-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"acl-id":String(r[`acl-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),forward_locally:r[`forward-locally`],lan_1:{lan_id:f(r[`lan-1-lan-id`],`lan-1-lan-id`,`text`),lan_name:f(r[`lan-1-lan-name`],`lan-1-lan-name`,`text`),port_ranges:r[`lan-1-port-ranges`],ports:r[`lan-1-ports`]},lan_2:{lan_id:f(r[`lan-2-lan-id`],`lan-2-lan-id`,`text`),lan_name:f(r[`lan-2-lan-name`],`lan-2-lan-name`,`text`),port_ranges:r[`lan-2-port-ranges`],ports:r[`lan-2-ports`]},name:f(r.name,`name`,`text`),protocols:r.protocols,unidirectional:r.unidirectional}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.sites.acls.edit({body:e,account_id:u,site_id:r[`site-id`],acl_id:r[`acl-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),forward_locally:r[`forward-locally`],lan_1:{lan_id:f(r[`lan-1-lan-id`],`lan-1-lan-id`,`text`),lan_name:f(r[`lan-1-lan-name`],`lan-1-lan-name`,`text`),port_ranges:r[`lan-1-port-ranges`],ports:r[`lan-1-ports`]},lan_2:{lan_id:f(r[`lan-2-lan-id`],`lan-2-lan-id`,`text`),lan_name:f(r[`lan-2-lan-name`],`lan-2-lan-name`,`text`),port_ranges:r[`lan-2-port-ranges`],ports:r[`lan-2-ports`]},name:f(r.name,`name`,`text`),protocols:r.protocols,unidirectional:r.unidirectional});a(await s(`Updating`,async()=>c.magicTransit.sites.acls.edit({body:p,account_id:u,site_id:r[`site-id`],acl_id:r[`acl-id`]})),{successLabel:`Updated`})}};function hi(e){return e.positional(`acl-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const gi={command:`get <acl-id>`,describe:`Get a specific Site ACL.`,builder:hi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites acls get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/acls/${r[`acl-id`]==null?`<acl-id>`:encodeURIComponent(String(r[`acl-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"acl-id":String(r[`acl-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.acls.get({account_id:l,site_id:r[`site-id`],acl_id:r[`acl-id`]})),{successLabel:`Loaded`})}};function _i(e){return e.option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const vi={command:`list`,describe:`Lists Site ACLs associated with an account.`,builder:_i,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites acls list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/acls`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.acls.list({account_id:l,site_id:r[`site-id`]})),{successLabel:`Loaded`})}};function yi(e){return e.positional(`acl-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`description`,{type:`string`,description:`Description for the ACL.`}).option(`forward-locally`,{type:`boolean`,description:`The desired forwarding action for this ACL policy. If set to "false", the policy will forward traffic to Cloudflare. If set to "true", the policy will forward traffic locally on the Magic Connector. If not included in request, will default to false.`}).option(`lan-1-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-1-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-1-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-1-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-2-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-2-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`name`,{type:`string`,description:`The name of the ACL.`}).option(`protocols`,{type:`string`,array:!0,description:`The protocols field`}).option(`unidirectional`,{type:`boolean`,description:`The desired traffic direction for this ACL policy. If set to "false", the policy will allow bidirectional traffic. If set to "true", the policy will only allow traffic in one direction. If not included in request, will default to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`lan-1-lan-id`,`lan-1-lan-name`,`lan-1-port-ranges`,`lan-1-ports`].some(t=>e[t]!==void 0)){let t=[`lan-1-lan-id`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --lan_1-* flag is set`)}return!0}).check(e=>{if([`lan-2-lan-id`,`lan-2-lan-name`,`lan-2-port-ranges`,`lan-2-ports`].some(t=>e[t]!==void 0)){let t=[`lan-2-lan-id`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --lan_2-* flag is set`)}return!0})}const bi={command:`update <acl-id>`,describe:`Update a specific Site ACL.`,builder:yi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites acls update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/acls/${r[`acl-id`]==null?`<acl-id>`:encodeURIComponent(String(r[`acl-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"acl-id":String(r[`acl-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({description:f(r.description,`description`,`text`),forward_locally:r[`forward-locally`],lan_1:{lan_id:f(r[`lan-1-lan-id`],`lan-1-lan-id`,`text`),lan_name:f(r[`lan-1-lan-name`],`lan-1-lan-name`,`text`),port_ranges:r[`lan-1-port-ranges`],ports:r[`lan-1-ports`]},lan_2:{lan_id:f(r[`lan-2-lan-id`],`lan-2-lan-id`,`text`),lan_name:f(r[`lan-2-lan-name`],`lan-2-lan-name`,`text`),port_ranges:r[`lan-2-port-ranges`],ports:r[`lan-2-ports`]},name:f(r.name,`name`,`text`),protocols:r.protocols,unidirectional:r.unidirectional}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.sites.acls.update({body:e,account_id:u,site_id:r[`site-id`],acl_id:r[`acl-id`]})),{successLabel:`Updated`});return}let p=d({description:f(r.description,`description`,`text`),forward_locally:r[`forward-locally`],lan_1:{lan_id:f(r[`lan-1-lan-id`],`lan-1-lan-id`,`text`),lan_name:f(r[`lan-1-lan-name`],`lan-1-lan-name`,`text`),port_ranges:r[`lan-1-port-ranges`],ports:r[`lan-1-ports`]},lan_2:{lan_id:f(r[`lan-2-lan-id`],`lan-2-lan-id`,`text`),lan_name:f(r[`lan-2-lan-name`],`lan-2-lan-name`,`text`),port_ranges:r[`lan-2-port-ranges`],ports:r[`lan-2-ports`]},name:f(r.name,`name`,`text`),protocols:r.protocols,unidirectional:r.unidirectional});a(await s(`Updating`,async()=>c.magicTransit.sites.acls.update({body:p,account_id:u,site_id:r[`site-id`],acl_id:r[`acl-id`]})),{successLabel:`Updated`})}},xi={command:`acls`,describe:`Operations for sites.acls`,builder:e=>e.command(ui).command(fi).command(mi).command(gi).command(vi).command(bi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Si(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`breakout`,{type:`boolean`,description:`Whether to breakout traffic to the app's endpoints directly. Null preserves default behavior.`}).option(`preferred-wans`,{type:`string`,array:!0,description:`WAN interfaces to prefer over default WANs, highest-priority first. Can only be specified for breakout rules (breakout must be true).`}).option(`priority`,{type:`number`,description:`Priority of traffic. 0 is default, anything greater is prioritized. (Currently only 0 and 1 are supported)`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ci={command:`create <site-id>`,describe:`Creates a new App Config for a site`,builder:Si,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites app-configuration create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/app_configs`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({breakout:r.breakout,preferred_wans:r[`preferred-wans`],priority:r.priority}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.sites.appConfiguration.create({...e,account_id:u,site_id:r[`site-id`]})),{successLabel:`Created`});return}let f=d({breakout:r.breakout,preferred_wans:r[`preferred-wans`],priority:r.priority});a(await s(`Creating`,async()=>c.magicTransit.sites.appConfiguration.create({...f,account_id:u,site_id:r[`site-id`]})),{successLabel:`Created`})}};function wi(e){return e.positional(`app-config-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ti={command:`delete <app-config-id>`,describe:`Deletes specific App Config associated with a site.`,builder:wi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites app-configuration delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/app_configs/${r[`app-config-id`]==null?`<app-config-id>`:encodeURIComponent(String(r[`app-config-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"app-config-id":String(r[`app-config-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.sites.appConfiguration.delete({account_id:l,site_id:r[`site-id`],app_config_id:r[`app-config-id`]})),{successLabel:`Deleted`})}};function Ei(e){return e.positional(`app-config-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`account-app-id`,{type:`string`,description:`Magic account app ID.`}).option(`breakout`,{type:`boolean`,description:`Whether to breakout traffic to the app's endpoints directly. Null preserves default behavior.`}).option(`managed-app-id`,{type:`string`,description:`Managed app ID.`}).option(`preferred-wans`,{type:`string`,array:!0,description:`WAN interfaces to prefer over default WANs, highest-priority first. Can only be specified for breakout rules (breakout must be true).`}).option(`priority`,{type:`number`,description:`Priority of traffic. 0 is default, anything greater is prioritized. (Currently only 0 and 1 are supported)`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Di={command:`edit <app-config-id>`,describe:`Updates an App Config for a site`,builder:Ei,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites app-configuration edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/app_configs/${r[`app-config-id`]==null?`<app-config-id>`:encodeURIComponent(String(r[`app-config-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"app-config-id":String(r[`app-config-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({account_app_id:f(r[`account-app-id`],`account-app-id`,`text`),breakout:r.breakout,managed_app_id:f(r[`managed-app-id`],`managed-app-id`,`text`),preferred_wans:r[`preferred-wans`],priority:r.priority}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.sites.appConfiguration.edit({body:e,account_id:u,site_id:r[`site-id`],app_config_id:r[`app-config-id`]})),{successLabel:`Updated`});return}let p=d({account_app_id:f(r[`account-app-id`],`account-app-id`,`text`),breakout:r.breakout,managed_app_id:f(r[`managed-app-id`],`managed-app-id`,`text`),preferred_wans:r[`preferred-wans`],priority:r.priority});a(await s(`Updating`,async()=>c.magicTransit.sites.appConfiguration.edit({body:p,account_id:u,site_id:r[`site-id`],app_config_id:r[`app-config-id`]})),{successLabel:`Updated`})}};function Oi(e){return e.option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ki={command:`list`,describe:`Lists App Configs associated with a site.`,builder:Oi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites app-configuration list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/app_configs`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.appConfiguration.list({account_id:l,site_id:r[`site-id`]})),{successLabel:`Loaded`})}};function Ai(e){return e.positional(`app-config-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`account-app-id`,{type:`string`,description:`Magic account app ID.`}).option(`breakout`,{type:`boolean`,description:`Whether to breakout traffic to the app's endpoints directly. Null preserves default behavior.`}).option(`managed-app-id`,{type:`string`,description:`Managed app ID.`}).option(`preferred-wans`,{type:`string`,array:!0,description:`WAN interfaces to prefer over default WANs, highest-priority first. Can only be specified for breakout rules (breakout must be true).`}).option(`priority`,{type:`number`,description:`Priority of traffic. 0 is default, anything greater is prioritized. (Currently only 0 and 1 are supported)`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ji={command:`update <app-config-id>`,describe:`Updates an App Config for a site`,builder:Ai,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites app-configuration update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/app_configs/${r[`app-config-id`]==null?`<app-config-id>`:encodeURIComponent(String(r[`app-config-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"app-config-id":String(r[`app-config-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({account_app_id:f(r[`account-app-id`],`account-app-id`,`text`),breakout:r.breakout,managed_app_id:f(r[`managed-app-id`],`managed-app-id`,`text`),preferred_wans:r[`preferred-wans`],priority:r.priority}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.sites.appConfiguration.update({body:e,account_id:u,site_id:r[`site-id`],app_config_id:r[`app-config-id`]})),{successLabel:`Updated`});return}let p=d({account_app_id:f(r[`account-app-id`],`account-app-id`,`text`),breakout:r.breakout,managed_app_id:f(r[`managed-app-id`],`managed-app-id`,`text`),preferred_wans:r[`preferred-wans`],priority:r.priority});a(await s(`Updating`,async()=>c.magicTransit.sites.appConfiguration.update({body:p,account_id:u,site_id:r[`site-id`],app_config_id:r[`app-config-id`]})),{successLabel:`Updated`})}},Mi={command:`app-configuration`,describe:`Operations for sites.app-configuration`,builder:e=>e.command(Ci).command(Ti).command(Di).command(ki).command(ji).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function Ni(e){return e.option(`connector-id`,{type:`string`,description:`Magic Connector identifier tag.`}).option(`description`,{type:`string`,description:`The description field`}).option(`ha-mode`,{type:`boolean`,description:`Site high availability mode. If set to true, the site can have two connectors and runs in high availability mode.`}).option(`location-lat`,{type:`string`,description:`Latitude`}).option(`location-lon`,{type:`string`,description:`Longitude`}).option(`name`,{type:`string`,description:`The name of the site.`}).option(`secondary-connector-id`,{type:`string`,description:`Magic Connector identifier tag. Used when high availability mode is on.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Pi={command:`create`,describe:`Creates a new Site`,builder:Ni,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites`,pathParams:{},bodyKind:`json`,body:r.body===void 0?d({connector_id:f(r[`connector-id`],`connector-id`,`text`),description:f(r.description,`description`,`text`),ha_mode:r[`ha-mode`],location:{lat:f(r[`location-lat`],`location-lat`,`text`),lon:f(r[`location-lon`],`location-lon`,`text`)},name:f(r.name,`name`,`text`),secondary_connector_id:f(r[`secondary-connector-id`],`secondary-connector-id`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.sites.create({...e,account_id:u})),{successLabel:`Created`});return}r.name===void 0&&(r.name=await p(`name`,`The name of the site.`));let m=d({connector_id:f(r[`connector-id`],`connector-id`,`text`),description:f(r.description,`description`,`text`),ha_mode:r[`ha-mode`],location:{lat:f(r[`location-lat`],`location-lat`,`text`),lon:f(r[`location-lon`],`location-lon`,`text`)},name:f(r.name,`name`,`text`),secondary_connector_id:f(r[`secondary-connector-id`],`secondary-connector-id`,`text`)});a(await s(`Creating`,async()=>c.magicTransit.sites.create({...m,account_id:u})),{successLabel:`Created`})}};function Fi(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Ii={command:`delete <site-id>`,describe:`Remove a specific Site.`,builder:Fi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.sites.delete({account_id:l,site_id:r[`site-id`]})),{successLabel:`Deleted`})}};function Li(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`connector-id`,{type:`string`,description:`Magic Connector identifier tag.`}).option(`description`,{type:`string`,description:`The description field`}).option(`location-lat`,{type:`string`,description:`Latitude`}).option(`location-lon`,{type:`string`,description:`Longitude`}).option(`name`,{type:`string`,description:`The name of the site.`}).option(`secondary-connector-id`,{type:`string`,description:`Magic Connector identifier tag. Used when high availability mode is on.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const Ri={command:`edit <site-id>`,describe:`Patch a specific Site.`,builder:Li,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({connector_id:f(r[`connector-id`],`connector-id`,`text`),description:f(r.description,`description`,`text`),location:{lat:f(r[`location-lat`],`location-lat`,`text`),lon:f(r[`location-lon`],`location-lon`,`text`)},name:f(r.name,`name`,`text`),secondary_connector_id:f(r[`secondary-connector-id`],`secondary-connector-id`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.sites.edit({body:e,account_id:u,site_id:r[`site-id`]})),{successLabel:`Updated`});return}let p=d({connector_id:f(r[`connector-id`],`connector-id`,`text`),description:f(r.description,`description`,`text`),location:{lat:f(r[`location-lat`],`location-lat`,`text`),lon:f(r[`location-lon`],`location-lon`,`text`)},name:f(r.name,`name`,`text`),secondary_connector_id:f(r[`secondary-connector-id`],`secondary-connector-id`,`text`)});a(await s(`Updating`,async()=>c.magicTransit.sites.edit({body:p,account_id:u,site_id:r[`site-id`]})),{successLabel:`Updated`})}};function zi(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Bi={command:`get <site-id>`,describe:`Get a specific Site.`,builder:zi,handler:async c=>{let l={};if(c[`x-magic-new-hc-target`]!==void 0&&(l[`x-magic-new-hc-target`]=String(c[`x-magic-new-hc-target`])),c.dryRun){o({command:`cf magic-transit sites get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${c[`site-id`]==null?`<site-id>`:encodeURIComponent(String(c[`site-id`]))}`,pathParams:{"site-id":String(c[`site-id`]??``)},bodyKind:`none`});return}let u=await i(c),d=c.local?e:await t();c.accountId=d,a(await s(`Loading`,async()=>r(u,`GET`,`/accounts/${d}/magic/sites/${encodeURIComponent(String(c[`site-id`]))}`,{headers:Object.keys(l).length>0?l:void 0})),{successLabel:`Loaded`})}};function Vi(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`bond-id`,{type:`number`,description:`The bond_id field`}).option(`ha-link`,{type:`boolean`,description:`mark true to use this LAN for HA probing. only works for site with HA turned on. only one LAN can be set as the ha_link.`}).option(`is-breakout`,{type:`boolean`,description:`mark true to use this LAN for source-based breakout traffic`}).option(`is-prioritized`,{type:`boolean`,description:`mark true to use this LAN for source-based prioritized traffic`}).option(`name`,{type:`string`,description:`The name field`}).option(`nat-static-prefix`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`routed-subnets`,{type:`string`,description:`The routed_subnets field. Provide as a JSON array of objects or @path/to/file.json.`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-dhcp-relay-server-addresses`,{type:`string`,array:!0,description:`List of DHCP server IPs.`}).option(`static-addressing-dhcp-server-dhcp-pool-end`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dhcp-pool-start`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-servers`,{type:`string`,array:!0,description:`The static_addressing.dhcp_server.dns_servers field`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-virtual-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-dhcp-relay-server-addresses`,`static-addressing-dhcp-server-dhcp-pool-end`,`static-addressing-dhcp-server-dhcp-pool-start`,`static-addressing-dhcp-server-dns-servers`,`static-addressing-secondary-address`,`static-addressing-virtual-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0})}const Hi={command:`create <site-id>`,describe:`Creates a new Site LAN. If the site is in high availability mode, static_addressing is required along with secondary and virtual address.`,builder:Vi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({bond_id:r[`bond-id`],ha_link:r[`ha-link`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:f(r.name,`name`,`text`),nat:{static_prefix:f(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,routed_subnets:u(r[`routed-subnets`],`routed-subnets`),static_addressing:{address:f(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:f(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:f(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:f(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:f(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]}):l(r.body)});return}let c=await i(r),p=r.local?e:await t();if(r.accountId=p,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.sites.lans.create({...e,account_id:p,site_id:r[`site-id`]})),{successLabel:`Created`});return}let m=d({bond_id:r[`bond-id`],ha_link:r[`ha-link`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:f(r.name,`name`,`text`),nat:{static_prefix:f(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,routed_subnets:u(r[`routed-subnets`],`routed-subnets`),static_addressing:{address:f(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:f(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:f(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:f(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:f(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]});a(await s(`Creating`,async()=>c.magicTransit.sites.lans.create({...m,account_id:p,site_id:r[`site-id`]})),{successLabel:`Created`})}};function Ui(e){return e.positional(`lan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const Wi={command:`delete <lan-id>`,describe:`Remove a specific Site LAN.`,builder:Ui,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans/${r[`lan-id`]==null?`<lan-id>`:encodeURIComponent(String(r[`lan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"lan-id":String(r[`lan-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.sites.lans.delete({account_id:l,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Deleted`})}};function Gi(e){return e.positional(`lan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`bond-id`,{type:`number`,description:`The bond_id field`}).option(`is-breakout`,{type:`boolean`,description:`mark true to use this LAN for source-based breakout traffic`}).option(`is-prioritized`,{type:`boolean`,description:`mark true to use this LAN for source-based prioritized traffic`}).option(`name`,{type:`string`,description:`The name field`}).option(`nat-static-prefix`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`routed-subnets`,{type:`string`,description:`The routed_subnets field. Provide as a JSON array of objects or @path/to/file.json.`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-dhcp-relay-server-addresses`,{type:`string`,array:!0,description:`List of DHCP server IPs.`}).option(`static-addressing-dhcp-server-dhcp-pool-end`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dhcp-pool-start`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-servers`,{type:`string`,array:!0,description:`The static_addressing.dhcp_server.dns_servers field`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-virtual-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-dhcp-relay-server-addresses`,`static-addressing-dhcp-server-dhcp-pool-end`,`static-addressing-dhcp-server-dhcp-pool-start`,`static-addressing-dhcp-server-dns-servers`,`static-addressing-secondary-address`,`static-addressing-virtual-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0})}const Ki={command:`edit <lan-id>`,describe:`Patch a specific Site LAN.`,builder:Gi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans/${r[`lan-id`]==null?`<lan-id>`:encodeURIComponent(String(r[`lan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"lan-id":String(r[`lan-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({bond_id:r[`bond-id`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:f(r.name,`name`,`text`),nat:{static_prefix:f(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,routed_subnets:u(r[`routed-subnets`],`routed-subnets`),static_addressing:{address:f(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:f(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:f(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:f(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:f(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]}):l(r.body)});return}let c=await i(r),p=r.local?e:await t();if(r.accountId=p,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.sites.lans.edit({body:e,account_id:p,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Updated`});return}let m=d({bond_id:r[`bond-id`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:f(r.name,`name`,`text`),nat:{static_prefix:f(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,routed_subnets:u(r[`routed-subnets`],`routed-subnets`),static_addressing:{address:f(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:f(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:f(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:f(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:f(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]});a(await s(`Updating`,async()=>c.magicTransit.sites.lans.edit({body:m,account_id:p,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Updated`})}};function qi(e){return e.positional(`lan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Ji={command:`get <lan-id>`,describe:`Get a specific Site LAN.`,builder:qi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans/${r[`lan-id`]==null?`<lan-id>`:encodeURIComponent(String(r[`lan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"lan-id":String(r[`lan-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.lans.get({account_id:l,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Loaded`})}};function Yi(e){return e.option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Xi={command:`list`,describe:`Lists Site LANs associated with an account.`,builder:Yi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.lans.list({account_id:l,site_id:r[`site-id`]})),{successLabel:`Loaded`})}};function Zi(e){return e.positional(`lan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`bond-id`,{type:`number`,description:`The bond_id field`}).option(`is-breakout`,{type:`boolean`,description:`mark true to use this LAN for source-based breakout traffic`}).option(`is-prioritized`,{type:`boolean`,description:`mark true to use this LAN for source-based prioritized traffic`}).option(`name`,{type:`string`,description:`The name field`}).option(`nat-static-prefix`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`routed-subnets`,{type:`string`,description:`The routed_subnets field. Provide as a JSON array of objects or @path/to/file.json.`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-dhcp-relay-server-addresses`,{type:`string`,array:!0,description:`List of DHCP server IPs.`}).option(`static-addressing-dhcp-server-dhcp-pool-end`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dhcp-pool-start`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-servers`,{type:`string`,array:!0,description:`The static_addressing.dhcp_server.dns_servers field`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-virtual-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-dhcp-relay-server-addresses`,`static-addressing-dhcp-server-dhcp-pool-end`,`static-addressing-dhcp-server-dhcp-pool-start`,`static-addressing-dhcp-server-dns-servers`,`static-addressing-secondary-address`,`static-addressing-virtual-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0})}const Qi={command:`update <lan-id>`,describe:`Update a specific Site LAN.`,builder:Zi,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites lans update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/lans/${r[`lan-id`]==null?`<lan-id>`:encodeURIComponent(String(r[`lan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"lan-id":String(r[`lan-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({bond_id:r[`bond-id`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:f(r.name,`name`,`text`),nat:{static_prefix:f(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,routed_subnets:u(r[`routed-subnets`],`routed-subnets`),static_addressing:{address:f(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:f(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:f(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:f(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:f(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]}):l(r.body)});return}let c=await i(r),p=r.local?e:await t();if(r.accountId=p,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.sites.lans.update({body:e,account_id:p,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Updated`});return}let m=d({bond_id:r[`bond-id`],is_breakout:r[`is-breakout`],is_prioritized:r[`is-prioritized`],name:f(r.name,`name`,`text`),nat:{static_prefix:f(r[`nat-static-prefix`],`nat-static-prefix`,`text`)},physport:r.physport,routed_subnets:u(r[`routed-subnets`],`routed-subnets`),static_addressing:{address:f(r[`static-addressing-address`],`static-addressing-address`,`text`),dhcp_relay:{server_addresses:r[`static-addressing-dhcp-relay-server-addresses`]},dhcp_server:{dhcp_pool_end:f(r[`static-addressing-dhcp-server-dhcp-pool-end`],`static-addressing-dhcp-server-dhcp-pool-end`,`text`),dhcp_pool_start:f(r[`static-addressing-dhcp-server-dhcp-pool-start`],`static-addressing-dhcp-server-dhcp-pool-start`,`text`),dns_servers:r[`static-addressing-dhcp-server-dns-servers`]},secondary_address:f(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`),virtual_address:f(r[`static-addressing-virtual-address`],`static-addressing-virtual-address`,`text`)},vlan_tag:r[`vlan-tag`]});a(await s(`Updating`,async()=>c.magicTransit.sites.lans.update({body:m,account_id:p,site_id:r[`site-id`],lan_id:r[`lan-id`]})),{successLabel:`Updated`})}},$i={command:`lans`,describe:`Operations for sites.lans`,builder:e=>e.command(Hi).command(Wi).command(Ki).command(Ji).command(Xi).command(Qi).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function ea(e){return e.option(`connectorid`,{type:`string`,description:`Identifier`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const ta={command:`list`,describe:`Lists Sites associated with an account. Use connectorid query param to return sites where connectorid matches either site.ConnectorID or site.SecondaryConnectorID.`,builder:ea,handler:async r=>{let c={connectorid:r.connectorid};if(r.dryRun){o({command:`cf magic-transit sites list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites`,pathParams:{},query:c,bodyKind:`none`});return}let l=await i(r),u=r.local?e:await t();r.accountId=u,a(await s(`Loading`,async()=>l.magicTransit.sites.list({account_id:u,...c})),{successLabel:`Loaded`})}};function na(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`active-timeout`,{type:`number`,description:`Timeout in seconds for active flows.`}).option(`collector-ip`,{type:`string`,description:`IPv4 address of the NetFlow collector.`}).option(`collector-port`,{type:`number`,description:`UDP port of the NetFlow collector.`}).option(`inactive-timeout`,{type:`number`,description:`Timeout in seconds for inactive flows.`}).option(`sampling-rate`,{type:`number`,description:`Sampling rate for NetFlow records (1 = every packet).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ra={command:`create <site-id>`,describe:`Creates a NetFlow configuration for a site.`,builder:na,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites netflow-config create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/netflow_config`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({active_timeout:r[`active-timeout`],collector_ip:f(r[`collector-ip`],`collector-ip`,`text`),collector_port:r[`collector-port`],inactive_timeout:r[`inactive-timeout`],sampling_rate:r[`sampling-rate`]}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.sites.netflowConfig.create({body:e,account_id:u,site_id:r[`site-id`]})),{successLabel:`Created`});return}let p=d({active_timeout:r[`active-timeout`],collector_ip:f(r[`collector-ip`],`collector-ip`,`text`),collector_port:r[`collector-port`],inactive_timeout:r[`inactive-timeout`],sampling_rate:r[`sampling-rate`]});a(await s(`Creating`,async()=>c.magicTransit.sites.netflowConfig.create({body:p,account_id:u,site_id:r[`site-id`]})),{successLabel:`Created`})}};function ia(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const aa={command:`delete <site-id>`,describe:`Remove NetFlow configuration for a site.`,builder:ia,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites netflow-config delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/netflow_config`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.sites.netflowConfig.delete({account_id:l,site_id:r[`site-id`]})),{successLabel:`Deleted`})}};function oa(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`active-timeout`,{type:`number`,description:`Timeout in seconds for active flows.`}).option(`collector-ip`,{type:`string`,description:`IPv4 address of the NetFlow collector.`}).option(`collector-port`,{type:`number`,description:`UDP port of the NetFlow collector.`}).option(`inactive-timeout`,{type:`number`,description:`Timeout in seconds for inactive flows.`}).option(`sampling-rate`,{type:`number`,description:`Sampling rate for NetFlow records (1 = every packet).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const sa={command:`edit <site-id>`,describe:`Updates NetFlow configuration for a site.`,builder:oa,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites netflow-config edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/netflow_config`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({active_timeout:r[`active-timeout`],collector_ip:f(r[`collector-ip`],`collector-ip`,`text`),collector_port:r[`collector-port`],inactive_timeout:r[`inactive-timeout`],sampling_rate:r[`sampling-rate`]}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.sites.netflowConfig.edit({body:e,account_id:u,site_id:r[`site-id`]})),{successLabel:`Updated`});return}let p=d({active_timeout:r[`active-timeout`],collector_ip:f(r[`collector-ip`],`collector-ip`,`text`),collector_port:r[`collector-port`],inactive_timeout:r[`inactive-timeout`],sampling_rate:r[`sampling-rate`]});a(await s(`Updating`,async()=>c.magicTransit.sites.netflowConfig.edit({body:p,account_id:u,site_id:r[`site-id`]})),{successLabel:`Updated`})}};function ca(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const la={command:`get <site-id>`,describe:`Get NetFlow configuration for a site.`,builder:ca,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites netflow-config get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/netflow_config`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.netflowConfig.get({account_id:l,site_id:r[`site-id`]})),{successLabel:`Loaded`})}};function ua(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`active-timeout`,{type:`number`,description:`Timeout in seconds for active flows.`}).option(`collector-ip`,{type:`string`,description:`IPv4 address of the NetFlow collector.`}).option(`collector-port`,{type:`number`,description:`UDP port of the NetFlow collector.`}).option(`inactive-timeout`,{type:`number`,description:`Timeout in seconds for inactive flows.`}).option(`sampling-rate`,{type:`number`,description:`Sampling rate for NetFlow records (1 = every packet).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const da={command:`update <site-id>`,describe:`Updates NetFlow configuration for a site (partial update).`,builder:ua,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites netflow-config update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/netflow_config`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({active_timeout:r[`active-timeout`],collector_ip:f(r[`collector-ip`],`collector-ip`,`text`),collector_port:r[`collector-port`],inactive_timeout:r[`inactive-timeout`],sampling_rate:r[`sampling-rate`]}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.sites.netflowConfig.update({body:e,account_id:u,site_id:r[`site-id`]})),{successLabel:`Updated`});return}let p=d({active_timeout:r[`active-timeout`],collector_ip:f(r[`collector-ip`],`collector-ip`,`text`),collector_port:r[`collector-port`],inactive_timeout:r[`inactive-timeout`],sampling_rate:r[`sampling-rate`]});a(await s(`Updating`,async()=>c.magicTransit.sites.netflowConfig.update({body:p,account_id:u,site_id:r[`site-id`]})),{successLabel:`Updated`})}},fa={command:`netflow-config`,describe:`Operations for sites.netflow-config`,builder:e=>e.command(ra).command(aa).command(sa).command(la).command(da).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};function pa(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`connector-id`,{type:`string`,description:`Magic Connector identifier tag.`}).option(`description`,{type:`string`,description:`The description field`}).option(`location-lat`,{type:`string`,description:`Latitude`}).option(`location-lon`,{type:`string`,description:`Longitude`}).option(`name`,{type:`string`,description:`The name of the site.`}).option(`secondary-connector-id`,{type:`string`,description:`Magic Connector identifier tag. Used when high availability mode is on.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`})}const ma={command:`update <site-id>`,describe:`Update a specific Site.`,builder:pa,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({connector_id:f(r[`connector-id`],`connector-id`,`text`),description:f(r.description,`description`,`text`),location:{lat:f(r[`location-lat`],`location-lat`,`text`),lon:f(r[`location-lon`],`location-lon`,`text`)},name:f(r.name,`name`,`text`),secondary_connector_id:f(r[`secondary-connector-id`],`secondary-connector-id`,`text`)}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.sites.update({body:e,account_id:u,site_id:r[`site-id`]})),{successLabel:`Updated`});return}let p=d({connector_id:f(r[`connector-id`],`connector-id`,`text`),description:f(r.description,`description`,`text`),location:{lat:f(r[`location-lat`],`location-lat`,`text`),lon:f(r[`location-lon`],`location-lon`,`text`)},name:f(r.name,`name`,`text`),secondary_connector_id:f(r[`secondary-connector-id`],`secondary-connector-id`,`text`)});a(await s(`Updating`,async()=>c.magicTransit.sites.update({body:p,account_id:u,site_id:r[`site-id`]})),{successLabel:`Updated`})}};function ha(e){return e.positional(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`name`,{type:`string`,description:`The name field`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`priority`,{type:`number`,description:`The priority field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-gateway-address`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-gateway-address`,`static-addressing-secondary-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`,`static-addressing-gateway-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0})}const ga={command:`create <site-id>`,describe:`Creates a new Site WAN.`,builder:ha,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites wans create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/wans`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({name:f(r.name,`name`,`text`),physport:r.physport,priority:r.priority,static_addressing:{address:f(r[`static-addressing-address`],`static-addressing-address`,`text`),gateway_address:f(r[`static-addressing-gateway-address`],`static-addressing-gateway-address`,`text`),secondary_address:f(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`)},vlan_tag:r[`vlan-tag`]}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Creating`,async()=>c.magicTransit.sites.wans.create({...e,account_id:u,site_id:r[`site-id`]})),{successLabel:`Created`});return}if(r.physport===void 0)throw Error(`--physport is required (or pass --body with this field set).`);let p=d({name:f(r.name,`name`,`text`),physport:r.physport,priority:r.priority,static_addressing:{address:f(r[`static-addressing-address`],`static-addressing-address`,`text`),gateway_address:f(r[`static-addressing-gateway-address`],`static-addressing-gateway-address`,`text`),secondary_address:f(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`)},vlan_tag:r[`vlan-tag`]});a(await s(`Creating`,async()=>c.magicTransit.sites.wans.create({...p,account_id:u,site_id:r[`site-id`]})),{successLabel:`Created`})}};function _a(e){return e.positional(`wan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1})}const va={command:`delete <wan-id>`,describe:`Remove a specific Site WAN.`,builder:_a,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites wans delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/wans/${r[`wan-id`]==null?`<wan-id>`:encodeURIComponent(String(r[`wan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"wan-id":String(r[`wan-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();if(r.accountId=l,!await h({force:!!r.force})){process.stderr.write(`Aborted.
+`);return}a(await s(`Deleting`,async()=>c.magicTransit.sites.wans.delete({account_id:l,site_id:r[`site-id`],wan_id:r[`wan-id`]})),{successLabel:`Deleted`})}};function ya(e){return e.positional(`wan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`name`,{type:`string`,description:`The name field`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`priority`,{type:`number`,description:`The priority field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-gateway-address`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-gateway-address`,`static-addressing-secondary-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`,`static-addressing-gateway-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0})}const ba={command:`edit <wan-id>`,describe:`Patch a specific Site WAN.`,builder:ya,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites wans edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/wans/${r[`wan-id`]==null?`<wan-id>`:encodeURIComponent(String(r[`wan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"wan-id":String(r[`wan-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({name:f(r.name,`name`,`text`),physport:r.physport,priority:r.priority,static_addressing:{address:f(r[`static-addressing-address`],`static-addressing-address`,`text`),gateway_address:f(r[`static-addressing-gateway-address`],`static-addressing-gateway-address`,`text`),secondary_address:f(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`)},vlan_tag:r[`vlan-tag`]}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.sites.wans.edit({body:e,account_id:u,site_id:r[`site-id`],wan_id:r[`wan-id`]})),{successLabel:`Updated`});return}let p=d({name:f(r.name,`name`,`text`),physport:r.physport,priority:r.priority,static_addressing:{address:f(r[`static-addressing-address`],`static-addressing-address`,`text`),gateway_address:f(r[`static-addressing-gateway-address`],`static-addressing-gateway-address`,`text`),secondary_address:f(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`)},vlan_tag:r[`vlan-tag`]});a(await s(`Updating`,async()=>c.magicTransit.sites.wans.edit({body:p,account_id:u,site_id:r[`site-id`],wan_id:r[`wan-id`]})),{successLabel:`Updated`})}};function xa(e){return e.positional(`wan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const Sa={command:`get <wan-id>`,describe:`Get a specific Site WAN.`,builder:xa,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites wans get`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/wans/${r[`wan-id`]==null?`<wan-id>`:encodeURIComponent(String(r[`wan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"wan-id":String(r[`wan-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.wans.get({account_id:l,site_id:r[`site-id`],wan_id:r[`wan-id`]})),{successLabel:`Loaded`})}};function Ca(e){return e.option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1})}const wa={command:`list`,describe:`Lists Site WANs associated with an account.`,builder:Ca,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites wans list`,method:`GET`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/wans`,pathParams:{"site-id":String(r[`site-id`]??``)},bodyKind:`none`});return}let c=await i(r),l=r.local?e:await t();r.accountId=l,a(await s(`Loading`,async()=>c.magicTransit.sites.wans.list({account_id:l,site_id:r[`site-id`]})),{successLabel:`Loaded`})}};function Ta(e){return e.positional(`wan-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`name`,{type:`string`,description:`The name field`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`priority`,{type:`number`,description:`The priority field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-gateway-address`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-gateway-address`,`static-addressing-secondary-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`,`static-addressing-gateway-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0})}const Ea={command:`update <wan-id>`,describe:`Update a specific Site WAN.`,builder:Ta,handler:async r=>{if(r.dryRun){o({command:`cf magic-transit sites wans update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${await n()??`<account-id>`}/magic/sites/${r[`site-id`]==null?`<site-id>`:encodeURIComponent(String(r[`site-id`]))}/wans/${r[`wan-id`]==null?`<wan-id>`:encodeURIComponent(String(r[`wan-id`]))}`,pathParams:{"site-id":String(r[`site-id`]??``),"wan-id":String(r[`wan-id`]??``)},bodyKind:`json`,body:r.body===void 0?d({name:f(r.name,`name`,`text`),physport:r.physport,priority:r.priority,static_addressing:{address:f(r[`static-addressing-address`],`static-addressing-address`,`text`),gateway_address:f(r[`static-addressing-gateway-address`],`static-addressing-gateway-address`,`text`),secondary_address:f(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`)},vlan_tag:r[`vlan-tag`]}):l(r.body)});return}let c=await i(r),u=r.local?e:await t();if(r.accountId=u,r.body){let e=l(r.body);a(await s(`Updating`,async()=>c.magicTransit.sites.wans.update({body:e,account_id:u,site_id:r[`site-id`],wan_id:r[`wan-id`]})),{successLabel:`Updated`});return}let p=d({name:f(r.name,`name`,`text`),physport:r.physport,priority:r.priority,static_addressing:{address:f(r[`static-addressing-address`],`static-addressing-address`,`text`),gateway_address:f(r[`static-addressing-gateway-address`],`static-addressing-gateway-address`,`text`),secondary_address:f(r[`static-addressing-secondary-address`],`static-addressing-secondary-address`,`text`)},vlan_tag:r[`vlan-tag`]});a(await s(`Updating`,async()=>c.magicTransit.sites.wans.update({body:p,account_id:u,site_id:r[`site-id`],wan_id:r[`wan-id`]})),{successLabel:`Updated`})}},Da={command:`wans`,describe:`Operations for sites.wans`,builder:e=>e.command(ga).command(va).command(ba).command(Sa).command(wa).command(Ea).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},Oa={command:`sites`,describe:`Magic WAN branch sites — base CRUD, LAN/WAN interface configuration, ACLs, connectors, app configuration, and NetFlow config`,builder:e=>e.command(Pi).command(Ii).command(Ri).command(Bi).command(ta).command(ma).command(xi).command(Mi).command($i).command(fa).command(Da).demandCommand(1,`Please specify a subcommand`),handler:()=>{}},ka={command:`magic-transit`,describe:`DDoS-protected network transit — GRE/IPsec tunnels, static routes, Magic WAN sites, connectors, and packet captures`,builder:e=>e.command(F).command(Lt).command(Jt).command(on).command(dn).command(bn).command(zn).command(Qn).command(hr).command(Ir).command(qr).command(ci).command(Oa).demandCommand(1,`Please specify a subcommand`),handler:()=>{}};export{ka as default};